Intellectual Merit: The focus of this award was to study the fundamental changes to access control that have emerged in modern computing platforms such as Android and iOS, and to identify new opportunities to enhance data protections for end users.

The past decade witnessed a fundamental change in how operating systems define access control to protect end users from malicious and undesired behavior by software. When Android and iOS emerged in the late '00s, they rescoped the most basic access control entity (called a security principal) from capturing all actions of a user to capturing only the actions of individual application. This change followed the advice of decades of research proposals and was viewed as a significant step forward for the security of commodity operating systems. However, the incorporation of this concept into a commodity platform used by millions of users subsequently unearthed an unforeseen challenge: how should the OS control sharing of data between a user's applications?

Our research conceptualized this challenge as the data intermediary problem, which captures the notion that whenever the user shares data from one application to another and to yet another, each receiving application must be completely trusted. This is not always desirable. For example, the user may wish for an application to only view a document and not send it off the device. As a solution, we turned to the classic concept of information flow control (IFC), and its recent variant, decentralized information flow control (DIFC). While IFC provides valuable flow-based access control semantics (e.g., control not just who can access data, but what can be done with the data once it is accessed), it has practical limitations that prevent its incorporation into commodity systems. Our research studied DIFC in the context of the Android platform. We proposed a novel DIFC policy logic tailored towards Android's runtime user interface workflow between application components. We further identified how Android's runtime itself is particularly amenable DIFC due to the way in which application logic is naturally partitioned. To make DIFC practical in Android, we proposed a novel label propagation model called lazy polyinstantiation, which spawns new instances of application components based on the runtime requirements.

While studying the access control designs of Android and iOS, we also built several tools to help validate the correctness of their access control policies and the enforcement of those policies. Our tools for Android studied both the underlying SEAndroid policy (which is based on SELinux, but re-written for Android), as well as the hard-coded checks within Android's core services. Our tools for iOS reverse engineered and formally modeled sandbox policies on iOS. These efforts identified many vulnerabilities that were reported to Google and Apple and have been fixed in subsequent releases of Android and iOS.

Broader Impact: The security of Android and iOS impacts billions of users worldwide. We have identified and reported many access control vulnerabilities in these platforms, which have been fixed in subsequent OS releases. PI Enck regularly interacted with the Raleigh Chapter of the Information Systems Security Association (ISSA), whose attendees typically include both security professionals and students attending technical schools such as Wake Technical Community College. These interactions included teaching multiple "Back-to-Basics" sessions on Android application programming and application security.

The work has also led to a number of open source tools and proposed enhancements to the Android platform. It has had a positive impact on graduate students at North Carolina State University, contributing to the research of five PhD students advised or co-advised by PI Enck. The advancements in mobile platforms and OS access control were also directly incorporated both undergraduate and graduate courses.

Last Modified: 04/25/2019
Modified by: William H Enck