Towards permission-based attestation for the android platform (Short paper)

Abstract

We propose a new attestation approach for the Android platform that integrates Trusted Computing concepts and Android's permission-based access control features. Recent research in the field of mobile security has shown that malware is a real threat. Trusted Computing in general and especially the concept of remote attestation can be leveraged to counter both the dissemination and the potential impact of such malware. However, current attestation approaches are not well suited for mobile platforms and crucial Trusted Computing components are still missing for them. Our approach introduces the necessary Trusted Computing building blocks for the Android platform. Furthermore, we detail how the permissions that are used by an Android phone's installed apps can be attested to a remote party at runtime. Additionally, we highlight areas that are subject of future work. © 2011 Springer-Verlag.