Enabling BYOD through secure meta-market

Mobile security is a hot research topic. Yet most of available techniques focus on securing individual applications and therefore cannot possibly tackle security weaknesses stemming from the combined use of one or more applications (e.g. confused deputy attacks). Preventing these types of attacks is crucial in many important application scenarios. For instance, their prevention is a prerequisite for the widespread adoption of the BYOD paradigm in the corporate setting. To this aim, in this paper we propose a secure meta-market which supports the specification and enforcement of security policies spanning multiple applications. Moreover, the metamarket keeps track of the security state of devices and— through a functional combination of static analysis and code instrumentation techniques—supervises the installation of new applications thereby ensuring the enforcement of the security policies. Also, we developed a prototype implementation of the secure meta-market and we used it for validating a wide range of popular Android applications against a security policy drawn from the US Government BYOD Security Guidelines. Experimental results obtained by running the prototype confirm the effectiveness of the approach.