Secure Input Overlays : increasing security for sensitive data on Android
Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2015.
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Language: | eng |
| Published: |
Massachusetts Institute of Technology
2016
|
| Subjects: | |
| Online Access: | http://hdl.handle.net/1721.1/100624 |
| _version_ | 1811074036089749504 |
|---|---|
| author | Sobel, Louis (Louis A.) |
| author2 | Srini Devadas. |
| author_facet | Srini Devadas. Sobel, Louis (Louis A.) |
| author_sort | Sobel, Louis (Louis A.) |
| collection | MIT |
| description | Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2015. |
| first_indexed | 2024-09-23T09:42:06Z |
| format | Thesis |
| id | mit-1721.1/100624 |
| institution | Massachusetts Institute of Technology |
| language | eng |
| last_indexed | 2024-09-23T09:42:06Z |
| publishDate | 2016 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/1006242019-04-12T21:41:02Z Secure Input Overlays : increasing security for sensitive data on Android Increasing security for sensitive data on Android Sobel, Louis (Louis A.) Srini Devadas. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science. Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science. Electrical Engineering and Computer Science. Thesis: M. Eng., Massachusetts Institute of Technology, Department of Electrical Engineering and Computer Science, 2015. This electronic version was submitted by the student author. The certified thesis is available in the Institute Archives and Special Collections. Cataloged from student-submitted PDF version of thesis. Includes bibliographical references (pages 44-47). Mobile devices and the applications that run on them are an important part of people's lives. Often, an untrusted mobile application will need to obtain sensitive inputs, such as credit card information or passwords, from the user. The application needs these sensitive inputs in order to send them to a trusted service provider that enables the application to implement some useful functionality such as authentication or payment. In order for the inputs to be secure, there needs to be a trusted path from the user, through a trusted base on the mobile device, and to the remote service provider. In addition, remote attestation is necessary to convince the service provider that the inputs it receives traveled through the trusted path. There are two orthogonal parts to establishing the trusted path: local attestation and data protection. Local attestation is the user being convinced that they are interacting with the trusted base. Data protection is ensuring that inputs remain isolated from untrusted applications until they reach the trusted service provider. This paper categorizes previous research solutions to these two components of a trusted path. I then introduce a new solution addressing data protection: Secure Input Overlays. They keep input safe from untrusted applications by completely isolating the inputs from the untrusted mobile application. However, the untrusted application is still able to perform a limited set of queries for validation purposes. These queries are logged. When the application wants to send the inputs to a remote service provider, it declaratively describes the request. The trusted base sends the contents and the log of queries. An attestation generated by trusted hardware verifies that the request is coming from an Android device. The remote service provider can use this attestation to verify the request, then check the log of queries against a whitelist to make a trust decision about the supplied data. by Louis Sobel. M. Eng. 2016-01-04T19:59:48Z 2016-01-04T19:59:48Z 2015 2015 Thesis http://hdl.handle.net/1721.1/100624 932733122 eng M.I.T. theses are protected by copyright. They may be viewed from this source for any purpose, but reproduction or distribution in any format is prohibited without written permission. See provided URL for inquiries about permission. http://dspace.mit.edu/handle/1721.1/7582 47 pages application/pdf Massachusetts Institute of Technology |
| spellingShingle | Electrical Engineering and Computer Science. Sobel, Louis (Louis A.) Secure Input Overlays : increasing security for sensitive data on Android |
| title | Secure Input Overlays : increasing security for sensitive data on Android |
| title_full | Secure Input Overlays : increasing security for sensitive data on Android |
| title_fullStr | Secure Input Overlays : increasing security for sensitive data on Android |
| title_full_unstemmed | Secure Input Overlays : increasing security for sensitive data on Android |
| title_short | Secure Input Overlays : increasing security for sensitive data on Android |
| title_sort | secure input overlays increasing security for sensitive data on android |
| topic | Electrical Engineering and Computer Science. |
| url | http://hdl.handle.net/1721.1/100624 |
| work_keys_str_mv | AT sobellouislouisa secureinputoverlaysincreasingsecurityforsensitivedataonandroid AT sobellouislouisa increasingsecurityforsensitivedataonandroid |