Securing Bring Your Own Device (BYOD) Policies With Android Security Techniques.pdf

A Formal Approach for Android

Background: The widespread adoption of Android, coupled with the BYOD (Bring Your Own Device) trend, presents security challenges. While Android offers flexibility, its native security framework struggles to manage complex organizational policies across diverse personal devices.

Problem Statement: Organizations need a system to enforce security policies on employee-owned devices accessing their networks and resources. This involves verifying device configurations against policies, handling application installations, and preventing policy violations.

Proposed Solution: The authors propose a formal framework for securing BYOD environments on Android using type and effect analysis of applications.

Key Components:

1. Behavioral Modeling: A programming framework is introduced to model the behavior of Android apps, capturing their interactions with system components (e.g., file systems, network access).

2. Type and Effect System: This system infers behavioral models from app implementations, allowing for static analysis against security policies. It determines if an app's behavior aligns with defined policy constraints.

3. Policy Language: A dedicated language is used to express security policies, specifying allowed/prohibited actions (e.g., network access after file system usage within a session).

4. Partial Model Checking: This technique efficiently evaluates policy compliance by considering only relevant parts of the device configuration rather than performing a complete re-evaluation for every change.

Prototype Implementation (BYODroid):

The authors have developed a prototype, BYODroid, that implements these techniques within an application market wrapper. BYODroid:

Checks policy compliance against registered devices' configurations upon registration and after app installations.
Provides on-device enforcement mechanisms without requiring OS modifications.
Supports dynamic policy updates and changes in device configuration.

Benefits:

Enhanced Security: Reduces the risk of insider and outsider threats by enforcing organizational security policies on personal devices.
Scalability: Handles large numbers of devices and applications, suitable for enterprise deployments.
Flexibility: Accommodates evolving security requirements through policy updates and dynamic analysis.