Android Oren Laadan orenl@cellrox.com Android Builders 2014 - - PowerPoint PPT Presentation

▶
android
SMART_READER_LITE
LIVE PREVIEW

Android Oren Laadan orenl@cellrox.com Android Builders 2014 - - PowerPoint PPT Presentation

May 31, 2023 310 likes •874 views

Multi-Persona Android Oren Laadan orenl@cellrox.com Android Builders 2014 www.cellrox.com aprilzosia Mobile devices have multiple uses - - the device needs to reflect that. 2 Android Builders 2014 Security Use Case Personal Phone

slide-1
SLIDE 1

Oren Laadan

  • renl@cellrox.com

Android Builders 2014 www.cellrox.com

Multi-Persona Android

aprilzosia

slide-2
SLIDE 2

Android Builders 2014 2

Mobile devices have multiple uses -

  • the device needs to reflect that.
slide-3
SLIDE 3

Android Builders 2014 3

Personal Phone Business Phone Security Use Case

slide-4
SLIDE 4

Android Builders 2014 4

Do People Remember?

  • Only download apps from trusted sources, such as reputable app
  • markets. Remember to look at the developer name, reviews, and star

ratings.

  • Always check the permissions an app requests. Use common sense

to ensure that the permissions an app requests match the features the app provides.

  • Be alert for unusual behavior on your phone. Suspicious behavior

could be a sign that your phone is infected. These behaviors may include unusual SMS or network activity.

  • Install a mobile security app for your phone that scans every app you

download to ensure it’s safe.

slide-5
SLIDE 5

Android Builders 2014 5

No, They Don’t!

  • Only download apps from trusted sources, such as reputable app
  • markets. Remember to look at the developer name, reviews, and star

ratings.

  • Always check the permissions an app requests. Use common sense

to ensure that the permissions an app requests match the features the app provides.

  • Be alert for unusual behavior on your phone. Suspicious behavior

could be a sign that your phone is infected. These behaviors may include unusual SMS or network activity.

  • Install a mobile security app for your phone that scans every app you

download to ensure it’s safe.

slide-6
SLIDE 6

Android Builders 2014 6

More Use Cases Personal Phone Business Phone Children Phone Privacy Phone Secure Phone

slide-7
SLIDE 7

Android Builders 2014 7

Even More Use Cases Personal Phone Business Phone Children Phone Privacy Phone Secure Phone Social Phone Guest Phone Dev Phone

slide-8
SLIDE 8

Android Builders 2014 8

Multi-Persona for Mobile Devices

slide-9
SLIDE 9

Android Builders 2014 9 Android applications Android environment Linux kernel Device hardware Typical device

Mobile Device Virtualization

Android applications Android environment Linux kernel Device hardware Typical device

slide-10
SLIDE 10

Android Builders 2014 10

Nobody Will Notice? Performance Transparent

Application Transparent Platform Transparent User Transparent

slide-11
SLIDE 11

Android Builders 2014 11

Hardware Virtualization

Android applications Android environment Linux kernel Device hardware Typical device Android applications Android environment Linux kernel Device hardware Virtual Phone Hypervisor Type I Android applications Android environment Linux kernel Virtual Phone

slide-12
SLIDE 12

Android Builders 2014 12

Hardware Virtualization

Suitable for servers

  • standard hardware
  • slow server replace rate
  • strong security model

Sub-optimal for mobile devices

  • burden to support devices
  • reduced performance / battery-life
  • sub-optimal use of resources
slide-13
SLIDE 13

Android Builders 2014 19

Operating System Virtualization

Namespaces provide a group of processes with the illusion that they are the only processes

  • n the system.
slide-14
SLIDE 14

Android Builders 2014 20

Namespace (r)evolution

Kernel namespaces:

  • mount-ns:

2.4.19

  • uts-ns:

2.6.19

  • ipc-ns:

2.6.19

  • pid-ns:

2.6.24

  • net-ns:

2.6.24-2.6.29

  • user-ns:

2.6.23-3.8 System calls: clone(), unshare(), setns()

slide-15
SLIDE 15

Android Builders 2014 21 Virtual Phone Android applications Android environment Linux kernel Device hardware Typical device Virtual Phone Android applications Android environment Linux kernel Device hardware Android applications Android environment

Namespaces

Operating System Virtualization

slide-16
SLIDE 16

Android Builders 2014 22

Device Diversity

A typical collection of peripherals available

  • n a modern smartphone or tablet:

Headset Microphone Speakers (Touch) Screen Power Buttons Telephony Bluetooth GPS WiFi Framebuffer GPU Compass Camera(s) Accelerometer RTC/Alarms

slide-17
SLIDE 17

Android Builders 2014 23

Device Interactivity

Users interact with a device one application at a time, expect consistent user experience: Split the “attention” of resources between the multiple persona, depending on context.

slide-18
SLIDE 18

Android Builders 2014 24 Android applications Android environment Linux kernel Device hardware Framebuf

slide-19
SLIDE 19

Android Builders 2014 25 Android applications Android environment Linux kernel Device hardware Framebuf Android applications Android environment

slide-20
SLIDE 20

Android Builders 2014 26 Android applications Android environment Linux kernel Device hardware Framebuf Input

slide-21
SLIDE 21

Android Builders 2014 27 Android applications Android environment Linux kernel Device hardware Framebuf Android applications Android environment Input

slide-22
SLIDE 22

Android Builders 2014 28 Android applications Android environment Linux kernel Device hardware

Device Namespace

Framebuf Android applications Android environment Input

slide-23
SLIDE 23

Android Builders 2014 29 Android applications Android environment Linux kernel Device hardware

Device Namespace

Framebuf Android applications Android environment Input Touch Proximty

slide-24
SLIDE 24

Android Builders 2014 30 Android applications Android environment Linux kernel Device hardware

Device Namespace

Framebuf Android applications Android environment Input Touch Buttons Proximty LED GPS

slide-25
SLIDE 25

Android Builders 2014 32

Mobile Virtualization Challenges

Challenge 1: device diversity

  • plethora of peripherals not virtualized
  • key logical devices not virtualized

 virtualize physical & logical devices

slide-26
SLIDE 26

Android Builders 2014 34

Mobile Virtualization Challenges

Challenge 1: device diversity

  • plethora of peripherals not virtualized
  • key logical devices not virtualized

 virtualize physical & logical devices Challenge 2: interactive usage

  • users interact with one app at a time
  • foreground vs. background apps

 multiplex access based on context

slide-27
SLIDE 27

Android Builders 2014 35

Device Namespaces

Device diversity: traditional virtualization

  • create the illusion that processes interact

exclusively with a set of devices

  • hide the fact that other processes interact

with the same set of devices

  • Device major/minor (e.g. loop, dm), and

device setup and internal state

slide-28
SLIDE 28

Android Builders 2014 36

“Traditional” virtualization

Examples:

  • alarm-dev
  • binder
  • logger
  • wakelocks
  • …
slide-29
SLIDE 29

Android Builders 2014 37

“Traditional” virtualization

Typical driver: Virtualized driver?

  • global driver state
  • per open fd state
  • open() is special
  • read/write/ioctl etc

use per open fd state (and global state)

slide-30
SLIDE 30

Android Builders 2014 38

“Traditional” virtualization

Typical driver: Virtualized driver:

  • global driver state

 - per-devns state

  • per open fd state
  • open() is special
  • read/write/ioctl etc

use per open fd state (and global state)

slide-31
SLIDE 31

Android Builders 2014 39

“Traditional” virtualization

Typical driver: Virtualized driver:

  • global driver state

 - per-devns state

  • per open fd state

 - per open fd state points to per-devns state

  • open() is special
  • read/write/ioctl etc

use per open fd state (and global state)

slide-32
SLIDE 32

Android Builders 2014 40

“Traditional” virtualization

Typical driver: Virtualized driver:

  • global driver state

 - per-devns state

  • per open fd state

 - per open fd state points to per-devns state

  • open() is special

 - obtain per-devns state and perform in context

  • read/write/ioctl etc

use per open fd state (and global state)

slide-33
SLIDE 33

Android Builders 2014 41

“Traditional” virtualization

Typical driver: Virtualized driver:

  • global driver state

 - per-devns state

  • per open fd state

 - per open fd state points to per-devns state

  • open() is special

 - obtain per-devns state and perform in context

  • read/write/ioctl etc

 - read/write/ioctl etc use per open fd state use per open fd state (and global state) and per-devns state (and global state)

slide-34
SLIDE 34

Android Builders 2014 42

“Traditional” virtualization

A peek at the code:

  • alarm-dev
  • binder
  • …
slide-35
SLIDE 35

Android Builders 2014 43

Device Namespaces

Interactivity: context-aware virtualization

  • concept of an active namespace, with

which the user actually interacts

  • ability to switch namespaces, to allow

interacting with multi-namespaces

  • users really interact with one namespace

at a time

slide-36
SLIDE 36

Android Builders 2014 44

Device Namespaces

Android applications Android environment Android applications Android environment Linux kernel Device hardware

(Device) Namespaces

Framebuf Input Touch Buttons Proximty LED GPS

slide-37
SLIDE 37

Android Builders 2014 45

Framebuffer ?

Android applications Android environment Linux kernel Framebuffer Android applications Android environment Android applications Android environment VP VP VP

slide-38
SLIDE 38

Android Builders 2014 47

Framebuffer: device namespaces

Android applications Android environment Linux kernel Android applications Android environment Android applications Android environment Background Foreground Background RAM Framebuffer Virtualized Framebuffer

slide-39
SLIDE 39

Android Builders 2014 48

Framebuffer: device namespaces

Android applications Android environment Linux kernel Android applications Android environment Android applications Android environment Background Foreground Background RAM Framebuffer Virtualized Framebuffer

slide-40
SLIDE 40

Android Builders 2014 49

Framebuffer: device namespaces

Android applications Android environment Linux kernel Android applications Android environment Android applications Android environment Background Background RAM Framebuffer Foreground Virtualized Framebuffer

slide-41
SLIDE 41

Android Builders 2014 50

Input ?

Android applications Android environment Linux kernel input Android applications Android environment Android applications Android environment VP VP VP

slide-42
SLIDE 42

Android Builders 2014 51

Input: device namespaces

Android applications Android environment Linux kernel Android applications Android environment Android applications Android environment Background Foreground Background Input Virtualized Input

slide-43
SLIDE 43

Android Builders 2014 52

Input: device namespaces

Android applications Android environment Linux kernel Android applications Android environment Android applications Android environment Input Background Background Foreground Virtualized Input

slide-44
SLIDE 44

Android Builders 2014 53

“Context-aware” virtualization

Typical driver: Virtualized driver:

  • global driver state

  • per-devns state
  • per open fd state

  • per open fd state points

to per-devns state

  • open() is special

  • obtain per-devns state

and perform in context

  • read/write/ioctl etc

  • read/write/ioctl etc

use per open fd state use per open fd state (and global state) and per-devns state (and global state)

slide-45
SLIDE 45

Android Builders 2014 54

“Context-aware” virtualization

Typical driver: Virtualized driver:

  • global driver state

  • per-devns state
  • per open fd state

  • per open fd state points

to per-devns state

  • open() is special

  • obtain per-devns state

and perform in context

  • read/write/ioctl etc

  • read/write/ioctl etc

use per open fd state use per open fd state (and global state) and per-devns state (and global state)

per devns state:

  • active flag (foreground/background)
  • callbacks (create, destroy, switch)
slide-46
SLIDE 46

Android Builders 2014 55

“Context-aware” virtualization

A peek at the code:

  • input layer
  • backlight
  • LED
  • …
slide-47
SLIDE 47

Android Builders 2014 59

Device namespaces in action

A quick hands on with the Android emulator

slide-48
SLIDE 48

Android Builders 2014 60

User-experience ?

slide-49
SLIDE 49

Android Builders 2014 64

User-experience Identity Awareness Switching Sharing

slide-50
SLIDE 50

Android Builders 2014 65

Unique UX

Background persona tab Foreground persona tab Background persona icon Foreground persona icon

slide-51
SLIDE 51

Android Builders 2014 66

Experimental Benchmarks

  • CPU (Linpack)
  • Graphics (Neocore)
  • Storage (Quadrant)
  • Web browsing (SunSpider)
  • Networking (custom)
slide-52
SLIDE 52

Android Builders 2014 67

Runtime Overhead (Idle)

0.00 0.20 0.40 0.60 0.80 1.00 1.20 1.40 Linpack NeoCore Quadrant I/O Sun Spider Network Baseline 1-VP 2-VP 3-VP 4-VP 5-VP

slide-53
SLIDE 53

Android Builders 2014 68

Runtime Overhead (load)

0.00 0.20 0.40 0.60 0.80 1.00 1.20 1.40 Linpack NeoCore Quadrant I/O Sun Spider Network Baseline 1-VP 2-VP 3-VP 4-VP 5-VP

slide-54
SLIDE 54

Android Builders 2014 69

Power Consumption Overhead

0.00 0.20 0.40 0.60 0.80 1.00 1.20 1.40

After 4hrs Music After 12hrs Idle

Baseline 1-VP 2-VP 3-VP 4-VP 5-VP

slide-55
SLIDE 55

Android Builders 2014 70

Summary

  • Multi-persona Android
  • Device namespaces (?!)

More info:

https://github.com/Cellrox/devns-patches/wiki

  • renl@cellrox.com