深入理解安卓系統(tǒng)的安全性

1、深入理解安卓系統(tǒng)的安全性下一代開放操作系統(tǒng)的主流將不會在桌面上，但是將會出現(xiàn)在我們每天攜帶的手機上。這些開放性的環(huán)境將會帶領這些新的應用可能集成這些已經(jīng)存在的在線服務，當然隨著日以具增的數(shù)據(jù)與服務在手機上的支持，手機上的安全缺陷也越發(fā)明顯。下一代操作系統(tǒng)本質(zhì)在于是否提供一個完整綜合的安全平臺。由開放手機聯(lián)盟（open Handset Alliance 谷歌領導）所開發(fā)的android 系統(tǒng)是一個被廣泛看好的一個手機開源系統(tǒng)，該系統(tǒng)提供一個基本的操作系統(tǒng)，一個中間件應用層，一個java開發(fā)工具和一個系統(tǒng)應用收集器（collection of system applications ）。盡管and

2、roid SDK自2007年就發(fā)布了，但是第一部android 手機卻在2008年10月才誕生。自從這時起谷歌開起了自己的時代，T-Mobile的G1的制造商臺灣 HTC估算G1的發(fā)貨量在2008年底已經(jīng)超過100萬部。據(jù)業(yè)內(nèi)人士預期該G1手機的銷量將會在2009年繼續(xù)保持。不久的將來其他許多手機供應商要計劃支持這個系統(tǒng)。一個圍繞android龐大的開發(fā)者社區(qū)已經(jīng)建立，同時很多新的產(chǎn)品和應用已經(jīng)可以在android上使用。一個Android的主要賣點是它使開發(fā)人員無縫把在線服務擴展到手機。這方面最明顯的例子是谷歌的緊密集成Gmail，日歷和聯(lián)系人Web應用程序通過該系統(tǒng)。用戶只需提供一個and

3、roid用戶名和密碼，其手機自動同步與谷歌的服務。其他廠商正在迅速適應自己的現(xiàn)有的即時通訊，社交網(wǎng)絡和游戲服務。Android和許多企業(yè)尋找新途徑來整合他們的自己已有的業(yè)務到android上。傳統(tǒng)的臺式機和服務器的操作系統(tǒng)一直在努力進行安全功能的集成。這些個人和商業(yè)應用在單一平臺的很出色，然而這一塊業(yè)務一個手機平臺上像android上不是很有用。它給了許多研究人員希望。Android沒有停在為其他平臺體用應用支持：應用的執(zhí)行依賴于頂層JAVA中間件，這個中間件運行在嵌入式Linux 內(nèi)核之上。所以開發(fā)人員要把他們的應用部署到Android必須使用其自定義的用戶界面環(huán)境。此外，android系統(tǒng)

4、應用限制各應用相互調(diào)用API協(xié)作，并且對方為自己的用戶應用進行身份驗證。盡管這些應用有一定的安全特性，我們一些有經(jīng)驗的開發(fā)人員開發(fā)android應用人士透露，設計安全應用程序并不總是直線前進的。Android使用一個簡單的許可標簽分配模式限制訪問的資源，但其他應用程序的原因必要性和便利，其設計師們增加了困惑對這個系統(tǒng)。本文試圖對Android的安全的復雜性進行講解，并注意一些可能的發(fā)展缺陷以及應用程序的安全。我們通過嘗試得出一些經(jīng)驗教訓，希望對未來的安全有用。Android Application Android應用程序框架對開發(fā)者來說是一個強制架構(gòu)。它沒有一個main（）函數(shù)功能或單一入口點

5、執(zhí)行，相反，開發(fā)人員必須在設計方面的應用組件。我們開發(fā)的應用對android的sdk的幫助的APIExample Application。我們開發(fā)了一個描述如何創(chuàng)建android的應用。有興趣的讀者可以去我們的站點下載讓我們考慮一個基于位置的社交網(wǎng)絡應用，其中手機用戶可以通過本應用發(fā)現(xiàn)他們的朋友們位置。我們進行功能拆分，分成兩個應用程序：一個用于跟蹤查看朋友和?？此麄?。如圖1所示，F(xiàn)riendTracker應用包括跟蹤的組件specifc朋友的位置（例如，通過一個Web服務），儲存地理坐標，并分享這些合作統(tǒng)籌與其他應用程序。然后用戶使用友情查看器應用程序來檢索地理坐標和儲存在地圖上查看朋友。這

6、兩個應用程序包含的多個組件包括展示自己任務，他們組件是由他們組件類型所決定的。 。一個Android 開發(fā)者選擇從根據(jù)不同的組件類型組件的目的決定 （如與一個用戶或存儲數(shù)據(jù)接口）。圖1。例如Android應用程序。FriendTracker和FriendViewer應用由多個不同類型的組件，每個提供一個不同的組功能。Activity提供一個用戶界面，Service執(zhí)行后臺處理，Content提供存儲，Broadcast receiver接收機其他應用程序的信息。Component Types android系通定義了4種組件類型。 Activity 組件定義應用程序的用戶界面。通常，應用程序開

7、發(fā)者定義每一個活動“畫面?！盇ctivity可以自己開始，也可能通過傳遞和返回值。在一時間只有一個鍵盤的系統(tǒng)Activity可以進行處理，在這個時候所有其他的Activity都會被暫停。Service組件執(zhí)行后臺處理。當一個活動需要進行一些操作，在用戶界面消失以后（如下載一個文件或播放音樂），它通常采取此種動作特殊設計的服務。開發(fā)人員還可以在系統(tǒng)啟動使用特殊的守護進程，Service通常定義一個遠程過程調(diào)用（RPC），其他系統(tǒng)組件可以用來傳送接口命令和檢索數(shù)據(jù)，以及注冊一個回調(diào)函數(shù)。Content組件存儲和共享數(shù)據(jù) 用關系數(shù)據(jù)庫接口。每個Content供應者都有一個關聯(lián)的“權(quán)限”來形容它的內(nèi)容

8、包含。其他組件使用時作為一個handle執(zhí)行SQL查詢（如的SELECT，INSERT或DELETE內(nèi)容。雖然Content供應者通常存儲把數(shù)值放在數(shù)據(jù)庫記錄中，數(shù)據(jù)檢索是實現(xiàn)特殊的例子，文件也同時通過內(nèi)容提供商共享接口。Broadcast receiver該組件作為為從郵件信箱發(fā)送信息給他應用程序。通常，廣播消息的應用程序代碼隱含的目的地。因此，廣播接收器訂閱這些目的地接收發(fā)送給它的消息。應用程序代碼也可以解決明確廣播接收機包括命名空間分配。圖1顯示了FriendTracker和FriendViewer應用所包含的不同的組件類型。開發(fā)者組件使用一個主要定義文件（也用于定義權(quán)限，稍后介紹）。上

9、有一個應用程序的組件的數(shù)量沒有限制定義每種類型，但作為習慣，一組件應具有相同的名稱該應用程序。通常情況下，這是作為在FriendViewer activity中進行注冊。這一動作通常指示主activity作為該系統(tǒng)應用程序啟動器用于啟動用戶界面;然而，如果需要啟動特定的activity，開發(fā)者需要者在選擇配置manifest 信息來實現(xiàn)這一個功能。在在FriendTracker應用，例如，F(xiàn)riendTrackerControl活動被標記為主用戶界面的啟動點。在這種情況下，我們保留名稱“FriendTracker”為服務執(zhí)行的核心組成部分的應用程序邏輯。在FriendTracker應用包含四種

10、類型的組件。在FriendTracker服務搜尋調(diào)查外部服務并發(fā)現(xiàn)好友的位置。在我們的示例代碼中，位置是我們隨機生成的，但直接通過網(wǎng)絡連接組件接口的服務。該FriendProvider Content 提供保持最新的朋友地理坐標，F(xiàn)riendTrackerControl活動用于啟動和用戶界面停止跟蹤好友功能，該系統(tǒng)一旦啟動 BootReceiver通知從廣播系統(tǒng)啟動。該FriendViewer應用主要是顯示有關好友的位置的信息。每個啟動的FriendViewer將會列出了所有的朋友和他們的地理坐標，F(xiàn)riendMap顯示他們在地圖上的位置。FriendReceiver將會等待接收附近的手機發(fā)送

11、的消息這個消息來一個所指定的朋友。盡管我們可以在這些組件內(nèi)放置在FriendTracker應用，但是我們?nèi)匀粍?chuàng)建了一個單獨的應用程序來展示跨應用的溝通。此外，通過分離程序功能和接口，我們可以創(chuàng)建不同的顯示和功能，可選用戶界面是，許多應用程序可以重用這些來自FriendTracker的功能。Component Interaction該組件交互的主要機制是一個intent ，這是一個簡單的消息對象，其中包含一個目的地組件的地址和數(shù)據(jù)。 Android的API定義了他的方法中傳入intent ，并使用該信息來啟動一個activity例如開始一個activity(startActivity(inten

12、t)，啟動服務（startService（intent）和廣播信息（sendBroadcast（intent）。Android框架來通知這些方法的調(diào)用開始執(zhí)行在目標應用程序代碼。這個過程中內(nèi)部組件通信稱為一個動作。簡單地說， Intent對象定義的“Intent”以執(zhí)行“action”。Android的一個最強大的特點是允許的多種intent尋址機制。開發(fā)人員可以解決一個目標組件使用其應用的空間，他們也可以指定一個隱含的名稱。在后一種情況下，系統(tǒng)決定了一個action的最佳組件，通過考慮安裝的應用程序和用戶的選擇 。這個隱含的名字被稱為動作字符串因為他特殊的類型的請求動作。例如一個view動作

13、字符串，在一個intent中和數(shù)據(jù)域指向一個圖像文件，系統(tǒng)將會直接指首選圖像瀏覽器、開發(fā)者也能使用動作字符串進行大量廣播發(fā)送和接收。在接收端的接收者，開發(fā)者使用一intent 過濾器來定制特殊的動作字符串。Android系包括附加目標的決議規(guī)則，但可選的數(shù)據(jù)操作字符串類型是最常見的。圖2顯示了組件之間的FriendTracker和FriendViewer應用程序和組件的交互作用在應用程序中定義為基礎的Android發(fā)布的一部分。在每一種情況下，發(fā)起一個組件與其他的溝通。為了簡單起見，我們稱這個為件間通信（ICC）。在許多方面，ICC是類似于進程間通信（IPC）在基于Unix的系統(tǒng)中。對于開發(fā)人

14、員，ICC的功能相同無論目標是在相同或不同的應用與界定將在下文的安全規(guī)則中說明。可用的ICC的動作取決于目標的組成部分。每個組件類型支持自己的類型例如，當FriendViewer開始FriendMap的FriendMap活動出現(xiàn)在屏幕上。服務組件支持啟動，停止，并結(jié)合行動，所以FriendTrackerControl活動，例如，可以啟動和停止FriendTracker服務在后臺運行。Action的綁定組件之間建立連接，使啟動執(zhí)行的服務定義的RPC。在我們的例子，F(xiàn)riendTracker結(jié)合到系統(tǒng)中的服務器位置的管理。Understand android security The next g

15、eneration of open operating systems wont be on desktops or mainframes but on the small mobile devices we carry every day. The openness of these new environments will lead to new applications and markets and will enable greater integration with existing online services. However, as the importance of

16、the data and services our cell phones support increases, so too do the opportunities for vulnerability. Its essential that this next generation of platforms provide a comprehensive and usable security infrastructure. Developed by the Open Handset Alliance (visibly led by Google), Android is a widely

17、 anticipated open source operating system for mobile devices that provides a base operating system, an application middleware layer, a Java software development kit (SDK), and a collection of system applications. Although the Android SDK has been available since late 2007, the first publicly availab

18、le Android-ready “G1” phone debuted in late October 2008. Since then, Androids growth has been phenomenal: TMobiles G1 manufacturer HTC estimates shipment volumes of more than 1 million phones by the end of 2008, and industry insiders expect public adoption to increase steeply in 2009. Many other ce

19、ll phone providers have either promised or plan to support it in the near future.A large community of developers has organized around Android, and many new products and applications are now available for it. One of Androids chief selling points is that it lets developers seamlessly .Extend online se

20、rvices to phones. The most visible example of this feature isunsurprisinglythe tight integration of Googles Gmail, Calendar, and Contacts Web applications with system utilities. Android users simply supply a username and password, and their phones automatically synchronize with Google services. Othe

21、r vendors are rapidly adapting their existing instant messaging, social networks, and gaming services to Android, and many enterprises are looking for ways to integrate their own internal operations (such as inventory management, purchasing, receiving, and so forth) into it as well. Traditional desk

22、top and server operating systems have struggled to securely integrate such personal and business applications and services on a single platform; although doing so on a mobile platform such as Android remains nontrivial, many researchers hope it provides a clean slate devoid of the complications that

23、 legacy software can cause. Android doesnt officially support applications eloped for other platforms: applications execute on top of a Java middleware layer running on an embedded Linux kernel, so developers wishing to port their application to Android must use its custom user interface environment

24、. Additionally, Android restricts application interaction to its special APIs by running each application as its own user identity. Although this controlled interaction has several beneficial security features, our experiences developing Android applications have revealed that designing secure forwa

25、rd. Android uses a simple permission label assignment model to restrict access to resources and other applications, but for reasons of necessity and convenience, its designers have added several potentially confusing refinements as the system has evolved. This article attempts to unmask the complexi

26、ty of Android security and note some possible development pitfalls that occur when defining an applications security. We conclude by attempting to draw some lessons and identify opportunities for future enhancements that should aid in clarity and correctness. Android Applications The Android applica

27、tion framework forces a structure on developers. It doesnt have a main() function or single entry point for executioninstead, developers must design applications in terms of components. Example Application.We developed a pair of applications to help describe how Android applications operate. Interes

28、ted readers can download the source code from our web sitepttp://android_sec_tutorial.html).Lets consider a location-sensitive social networking application for mobile phones in which users can discover their friends locations. We split the functionality into two applications: one fo

29、r tracking friends and one for viewing them. As Figure 1 shows, the FriendTracker application consists of components specific to tracking friend locations (for example, via a Web service), storing geographic coordinates, and sharing those coordinates with other applications. The user then uses the F

30、riendViewer application to retrieve the stored geographic coordinates and view friends on a map. Both applications contain multiple components for performing their respective tasks; the components themselves are classified by their component types. An Android developer chooses from predefined compon

31、ent types depending on the components purpose (such as interfacing with a user or storing data).Component TypesAndroid defines four component types: Activity components define an applications user interface. Typically, an application developer defines one activity per “screen.” Activities start each

32、 other, possibly passing and returning values. Only one activity on the system has keyboard and accessing focus at a time; all others are suspended. Service components perform background processing. When an activity needs to perform some operation that must continue after the user interface disappea

33、rs (such as download a fle or play music), it commonly starts a service specifically designed for that action. The developer can also use services as application-specific daemons, possibly starting on boot. Services often define an interface for Remote Procedure Call (RPC) that other system componen

34、ts can use to send commands and retrieve data, as well as register callbacks. Content providercomponents store and share data using a relational database interface. Each content provider has an associated “authority” describing the content it contains. Other components use the authority name as a ha

35、ndle to perform SQL queries (such as SELECT, INSERT, or DELETE) to read and write content. Although content providers typically store values in database records, data retrieval is implementation-specificfor example, fles are also shared through content provider interfaces. Broadcast receiver compone

36、nts act as mailboxes for messages from other applications. Commonly, application code broadcasts messages to an implicit destination. Broadcast receivers thus sub-scribe to such destinations to receive the messages sent to it. Application code can also address a broadcast receiver explicitly by incl

37、uding the namespace assigned to its containing application. Figure 1 shows the FriendTrack-er and FriendViewer applications containing the different component types. The developer specifies components using a manifest fle (also used to define policy as described later). There are no restrictions on

38、the number of components an application defines for each type, but as a convention, one component has the same name as the application. Frequently, this is an activity, as in the FriendViewer application. This activity usually indicates the primary activity that the system application launcher uses

39、to start the user interface; however, the specifc activity chosen on launch is marked by meta information in the manifest. In the FriendTracker application, for example, the FriendTrackerControl activity is marked as the main user interface entry point. In this case, we reserved the name “FriendTrac

40、ker” for the service component performing the core application logic. The FriendTracker application contains each of the four component types. The FriendTracker service polls an external service to discover friends locations. In our example code, we generate local FriendTracker application BootRecei

41、ver Broadcast receiver ActivityFriendTracker FriendProvider Content provider Service FriendTracker control FriendViewer application FriendReceiver Broadcast receiver Activity FriendTracker Activity FriendViewer Figure 1. Example Android application. The FriendTracker and FriendViewer applications co

42、nsist of multiple components of different types, each of which provides a different set of functionalities. Activities provide a user interface, services execute background processing, content providers are data storage facilities, and broadcast receivers act as mailboxes for messages from other app

43、lications. tions randomly, but extending the component to interface with a Web service is straightforward. The FriendProvider content provider maintains the most recent geographic coordinates for friends, the FriendTrackerControl activity defines a user interface for starting and stopping the tracki

44、ng functionality, and the BootReceiver broadcast receiver obtains a notification from the system once it boots (the application uses this to automatically start the FriendTracker service).The FriendViewer application bis primarily concerned with showing information about friends locations. The Frien

45、dViewer activity lists all friends and their geographic coordinates, and the FriendMap activity displays them on a map. The FriendReceiver broadcast receiver waits for messages that indicate the physical phone is near a particular friend and displays a message to the user upon such an event. Althoug

46、h we could have placed these components within the FriendTracker application, we created a separate application to demonstrate cross-application communication. additionally, by separating the tracking and user interface logic, we can create alternative user interfaces with different displays and fea

47、turesthat is, many applications can reuse the logic performed in FriendTracker. Component Interaction The primary mechanism for component interaction is an intent, which is simply a message object containing a destination component address and data. The Android API defines methods that accept intent

48、s, and uses that information to start activities (start Activity(Intent), start services (start Service (Intent), and broadcast messages (send Broadcast(Intent). The invocation of these methods tells the Android framework to begin executing code in the target application. This process of inter compo

49、nent communication is known as an action. Simply put, an intent object defines the “intent” to perform an “action”. One of Androids most powerful features is the flexibility allowed by its intent-addressing mechanism. Although developers can uniquely address a target component using its applications

50、 namespace, they can also specify an implicit name. In the latter case, the system determines the best component for an action by considering the set of installed applications and user choices. The implicit name is called an action string because it specifies the type of requested actionfor example, if the “V