the study of security and privacy in mobile applications name: liang wei email: [email protected]
TRANSCRIPT
Introduction
• Why do we need to pay attention to the security and privacy in mobile applications?
Introduction
• The reason is that now many mobile applications may try to transfer sensitive data, for example, personal information through the network.
Mobile Payment Application
Mobile payment applications need a secure mechanism to protect the credit card information of the users.
Mobile Social Network Application
Mobile social network applications need to authenticate the identities of the users at first. Only after the authentication, the mobile social network application can start to exchange information with the server.
Mobile Database Application
Mobile database application is used for the users to make small-footprint modifications through the mobile device. The data in the server and mobile device are both need to be protected.
Mobile Database Application (MDA)
1. A mobile database is a part of a replica of the central database
2. The user make modifications of the mobile database at first
3. Synchronization occurs between the server and the mobile device to ensure the data are the same
4. In order to complete the synchronization, a publication is needed. A publication is the meta-data package of information about which data is replicated. With the publication, the database server can synchronize with the mobile database correctly. The publication can only be accessed by the users after they are authenticated.
Information Risks
1. The mobile device may be stolen by malicious attacker. Then the attacker may try to access the data stored in the device.
2. The sensitive data transferred through the network may be intercepted by the malicious attacker.
3. The users who have no accounts of mobile applications may try to access the server without permissions. Or they may try to log in with others’ accounts to obtain the personal information of them.
4. The malicious users of the mobile applications may try to modify the data in the server even if they are not granted with sufficient permissions or they may try to access the data which are not allowed them to obtain.
Methods to Ensure Security and Privacy in Mobile Applications
1. Secure Network Connection
2. Encrypted Local Data
3. User Authentication
4. Grant Minimum Sufficient Permissions
5. Separate User Accounts
6. Applications Provided Security Mechanisms
Analysis
1. Secure Network ConnectionIn order to ensure that the sensitive data transferred through the
network will not be obtained by malicious attacker, we can choose a secure network connection.
We can make use of https instead of http because all the traffic are encrypted so that the data can be protected.
Analysis
2. Encrypted Local Data
Because the mobile device may be lost or stolen, so it is also necessary to take some mechanisms to ensure that the data in the device are also safe. Therefore, we can encrypt the data in the mobile device.
Analysis
3. User Authentication
In order to keep malicious attacker from entering into the system, user authentication is necessary.
If the mobile application is a mobile database application, then it means that the user must be authenticated by the database server. Only after they are authenticated then they can access the publication to synchronize the mobile database with the database server.
Analysis
3. User Authentication
And also, user should also be authenticated at the Web Server to protect them from accessing the Web Server just by the same URL.
Analysis
4. Grant Sufficient Minimum Permissions
The users should be granted with sufficient minimum permissions to ensure the security and privacy in mobile applications.
For example, the user who can only view the data should not be granted with the write permission because they may try to make modifications as their wishes.
Analysis
5. Separate User Accounts
Sometimes we may provide a user with two accounts in order to ensure the security and privacy in the mobile applications.
For example, a user can view all the data but only modify part of them. Therefore, we can design two accounts. The first one is a read-only account and it can view all the data. While the other one is a read-write account but it can only view and modify part of the data.
Analysis
6. Application Provided Security and Privacy Mechanism
The mobile application can provide other security and privacy mechanisms.
For example, the application may encrypt and sign the data before they enter into the secure communication link. Another example is that the user can only access a replica of the main table of the central database so that even if they successfully attack the replica through the mobile application, the data in the central database can still be protected.
Future Work
1. With the development of network infrastructure, for example, 3G to 4G, new properties should be taken into consideration to develop new secure mechanisms.
2. Apple, Google and many other companies will release new mobile device in the future, and they may provide new features in their devices to ensure security and privacy. Therefore, we need to research new devices to change our methods.
Conclusion
From my point of view, the following aspects are the basic points to ensure security and privacy in mobile applications:
1.Secure Network Connection
2.Encryption of Sensitive Data
3.User Authentication
Almost all the applications need to pay attention to the above-mentioned points so that they can protect the sensitive data.
Thank You!