TPAM: Timed-Permission based Access Control Analysis and Modeling Method for Android Apps
Xinwen Hu · 2024
Managing access control for Android applications (apps) in the early stage of development can reduce testing and maintenance costs in the code stage. Following the guidelines of current international access management standards to implement secure access control during the modeling phase of Android apps. We propose an Android app access management method, which includes two parts: access context construction and access control management analysis. We extend UML-MARTE and propose a Timed-Permission based access control Analysis and Modeling (TPAM) package to construct semi-formal access contexts that include time-related attributes. On this basis, we extend the Z expression to add formal semantics to the TPAM-based access context to form the TPAMZ specification (TPAM-based Z specification), which includes the TPAMZContext formal model and the TPAMZACM formal algorithm. The TPAMZACM algorithm analyzes the access behavior of the TPAMZContext model based on the standard access control management activities of ISO/IEC 29146:2016. We summarize the proposed method in a Timed-Permission Access Management framework for Android apps (TiPAMA), and implement a prototype of the framework, Tipama. Finally, its effectiveness is illustrated by a case study. The proposed methodology not only allows accurate access context modeling of Android apps based on time-related attributes at their modeling stage, but also accurately analyzes Android app security contexts based on the main activities of the ISO/IEC 29146:2016 access management standard.