Assumptions and Restrictions. In addition to the assumptions and restrictions, which are defined in Section 3.1, there are some Level 1 specific limitations. These limitations will be explained and justified in the following paragraphs. Intents To switch from one component of an Application to another component, explicit and implicit intents can be used. That is why intents become an important part to an analysis of the information flow of an Application. Therefore, the tool will be able to handle intents of both types. But on the first level of analysis, looking at a single Application and without information about the information flow, the analysis of intents will be further limited than described in Section 3.1. Every explicit intent is used to start another component of the same Application. If this targeted component requires one or more permissions the intent will be considered as requiring the same permissions. In case of an explicit intent the analysis itself will gather the information about the targeted component. The targeted component will be identified by e.g. the class name which is used in the source code. Which permissions are used in the targeted component will be determined by the level 1 analysis itself. Once the result for a component is computed the permissions will be assigned to the intent. A result is complete if all permissions that could be mapped by the data storage are mapped to the according statements. This means that the statements used for the definition of the intent will be mapped to the permissions used by the targeted component. Figure 2 shows an example regarding this case. The analyzed component Analyzed component Targeted component uses A targets Uses permission A Explicit intent definition
Assumptions and Restrictions. For this analysis level there are also some additional limitations, which will be listed in the following. In addition to computing the control flow model for components, the tool also decides what permissions are required by what components. The permissions are already processed in Level 1 by analyzing the manifest file and a intermediate representation of the source code. Therefore we can reuse some parts of the Level 1 analysis to get a mapping from statement to permissions. Based on the Android source code of the Application, we are not able to compute the control flow between components. The reason is that Android Applications are not sequentially programmed and most of the components are launched based on events. So to make sure the model is precise, we are considering the following aspects: Starting an Application As Android is not having a single main method to start an Ap- plication, we have to construct a mock-up main method for starting anyone of the starting components to run the Application for analysis purpose in our tool. The mock-up method was modeled to support all the below mentioned aspects, too. Lifecycle of Components In general, Android Applications consist of multiple entry points, which are the methods called implicitly by the Android framework in the component. Entry point methods are called as lifecycle methods of the component, which are used to start or stop or pause or resume the same. All the components will have their complete lifecycle defined by Android, as they are implemented by overwriting the lifecycle methods. So we are considering this aspect to exactly analyze how a component behaves and what events are triggered during the different transition of the lifecycle methods. Execution of Components In most cases Applications consist of multiple components and the order of execution of the components from an Application perspective cannot be pre- determined. It often depends on the event which got triggered based on some user input. 3cf. Xxxxxx and Xxxxxxxx, Information Flow Analysis in Logical Form, Department of Computing and Information Sciences Kansas State University, Manhattan KS 66506 USA 4cf. Xxxxxx, Xxxxxx and Xxxxx, A Theorem Proving Approach to Analysis Secure Information Flow, Swiss Federal Institute of Technology, Chalmers University of Technology Sweden Services can also be executed in parallel with other components. Our tool will not detect such parallel or interleaved executions but we will assume that t...
Assumptions and Restrictions. Since the computation for Level 2b is an extended version of the computation in Level 1, Level 2b will stick to the same assumptions as Level 0.Xx addition, we assume that the set of given .apk files might be incomplete, meaning that there might be implicit intents for which no intent filter exists. Like above, Level 2b will also inherit most of the restrictions of Level 1. But in contrast to Level 1, Level 2b will not ignore inter-App intents to foreign, non-native Apps since detecting inter-App resource usage is the main feature of Level 2b. These foreign, non-native Apps are all the Apps that are not provided by the Android system and by that are not supported by our data storage. On level 2b now all Apps specifying intent filters will be taken into account and not only the Applications which are provided by the Android system itself. According to the additional assumption for Level 2b, our tool will give a warning if no matching intent filter is available. Furthermore, a restriction for the opposite case is needed: If there are multiple intent filters for an action string in the given set of Apps we will consider all of them since we will not model default application settings.
Assumptions and Restrictions. All partners in the Consortium will undertake the tasks assigned to them in a timely way. In the first instance, it is the responsibility of the partner concerned to take action to rectify any slippage in tasks assigned to them. If such action is not forthcoming, or is ineffective, the Project Manager may re-allocate tasks to other partners, with a consequent effect on allocation of funding; such action will require the approval of the Project Steering Committee.
