APP隐私泄露风险评估与保护方案  

Risk assessing and privacy-preserving scheme for privacy leakage in APP

作　　者：王新宇[1,2] 牛犇 李凤华[1,2] 贺坤[1,2] WANG Xinyu;NIU Ben;LI Fenghua;HE Kun(Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China;School of Cyber Security, University of Chinese Academy of Sciences,Beijing 100049,China)

机构地区：[1]中国科学院信息工程研究所,北京100093 [2]中国科学院大学网络空间安全学院,北京100049

出　　处：《通信学报》2019年第5期13-23,共11页Journal on Communications

基　　金：国家重点研发计划基金资助项目(No.2017YFB0802203);国家自然科学基金资助项目(No.U1401251;No.61672515;No.61872441);中国科学院青年创新促进会人才基金资助项目;工业和信息化部2018工业互联网创新发展工程基金资助项目:工业互联网标识解析数据管理技术标准制定与试验验证~~

摘　　要：针对APP中第三方服务提供商非法采集用户隐私信息的问题,提出了一种APP隐私信息泄露风险评估方案PRAS。该方案通过统计第三方服务提供商从不同APP获取的权限,并考虑权限组合对隐私泄露风险带来的非线性影响,构建模型来评估隐私泄露风险。基于风险评估结果,在服务质量与隐私保护之间进行均衡分析,最终给出系统整体的权限管理方案,在保证服务质量的同时,降低隐私信息泄露风险。实验结果表明,PRAS将APP整体的隐私泄露风险平均降低了18.5%。The APP in smartphone contain various third-party services. However, the service providers illegally read the user’s private information. To address this problem, a privacy risk assessing scheme called PRAS was proposed. Firstly, a model was built to assess the risk of privacy leakage, by counting all the permissions acquired by each service providers and considering the non-linear impact of the permissions combination on privacy leakage. Then, by analyzing the balance between service quality and privacy-preserving, an optimal model was used to minimized the risk of private information leakage, and a permission management method was given to protect the privacy information among APP. The experiment results show that PRAS reduces the risk of privacy leakage by an average of 18.5%.

关 键 词：安卓 隐私保护 风险评估 权限管理 

分 类 号：TN929[电子电信—通信与信息系统]