TRUSTORE: IMPLEMENTING A TRUSTED STORE FOR ANDROID
Yury Zhauniarovich, Olga Gadyatskaya, Bruno Crispo · Iris (University of Trento) · 2013
University of Trento, Trento, 38100, Italyzhauniarovich, gadyatskaya, [email protected]. In the Android ecosystem, the process of verifying the in-tegrity of downloaded apps is left to the user. Di erent from other sys-tems, e.g., Apple App Store, Google does not provide any certi ed vettingprocess for the Android apps. This choice has a lot of advantages butit is also the open door to possible attacks as the recent one shown byBluebox [35]. To address this issue, we present how to enable the de-ployment of application certi cation service, we called TruStores, for theAndroid platform. In our approach, the TruStore client enabled on theend-user device ensures that only the applications, which have been cer-ti ed by the TruStore server, are installed on the user smartphone. Weenvisage trusted markets (TruStore servers, which can be, e.g., corporateapplication markets) that guarantee security by enabling an applicationvetting process. The TruStore infrastructure maintains the open natureof the Android ecosystem and requires minor modi cations to Androidstack. Moreover, it is backward-compatible and transparent for devel-opers, and does not change the application management process on adevice. In the paper we present the TruStore architecture and report theimplementation details of the client part.