SLIDE 1 SeMA: A Design Methodology for Building Secure Android Apps
Joydeep Mitra Venkatesh-Prasad Ranganath Department of Computer Science Kansas State University, USA
Internatjonal Workshop on Advances in Mobile App Analysis (A-Mobile 2019) San Diego, USA November 11, 2019
SLIDE 2 Context
- Storyboards are used to capture the UI+UX of an app
- Security is crucial to the UX of a mobile app
- Current UX design process of an app is limited in terms of security
reasoning
- Can reasoning about security be baked into the design process of
an app?
SLIDE 3 What is mobile app storyboarding?
A storyboard is a sequence
- f images that serves as a
specifjcatjon of the user
- bserved behavior in terms
- f screens and transitjons
between screens
SLIDE 4 Limitatjons of Current Mobile App Storyboarding Approaches/Tools
- Inability to specify of non-UI behavior
- Inability to enable collaboratjon between app designers and app
developers
- Inability to reason about non functjonal propertjes such as
security
We propose a methodology (SeMA) based on storyboarding to enable the specifjcatjon and verifjcatjon of security propertjes
- f Android apps at design tjme.
SLIDE 5 Proposed Methodology
- App designer specifjes the app’s storyboard
- App designer and developer collaborate to iteratjvely refjne the
storyboard by adding non-UI related behavior (e.g., constraints on when transitjons will be triggered)
- Afuer every iteratjon verify if the storyboard satjsfjes pre-defjned
security propertjes
- Finally, generate property preserving code
- Developer extends generated code with business logic
SLIDE 6
Illustratjve Example: Initjal Storyboard
SLIDE 7
Illustratjve Example: Storyboard with UI Constraints
SLIDE 8
Illustratjve Example: Storyboard with Non- UI Constraints
SLIDE 9
Illustratjve Example: Security Analysis of the Storyboard
SLIDE 10 Realizing SeMA for Android [PoC/Ongoing]
- Extend existjng Storyboard tools (e.g. Navigatjon graphs) to
enable the specifjcatjon of non-UI behavior
- Defjne security propertjes based on known vulnerabilitjes
- Build the analysis framework to verify pre-defjned security
propertjes on the storyboard
- Build the code generatjon algorithm to translate storyboards to
Java/Kotlin
- Enable the methodology in Android Studio
SLIDE 11
Realizing SeMA for Android Platgorm
Use JetPack’s Navigatjon Graph for storyboarding
SLIDE 12
Realizing SeMA for Android Platgorm
SLIDE 13
Realizing SeMA for Android Platgorm Extend navigatjon graph with UI constraints
SLIDE 14
Extending navigatjon graph with non-UI constraints Realizing SeMA for Android Platgorm
SLIDE 15
Realizing SeMA for Android Platgorm Extend navigatjon graph with Security Analysis
SLIDE 16
Realizing SeMA for Android Platgorm Extend navigatjon graph with Security Analysis
SLIDE 17 Challenges
- Enabling storyboards to capture non-UI behavioral constraints in a non-
intrusive way [PoC/Ongoing]
- Making the analysis context-aware [Future Work]
- Checking richer security propertjes (e.g. temporality) [Future Work]
- Ensuring preservatjon of security propertjes [Future Work]
SLIDE 18 Takeaways
A design methodology to enable automated reasoning and verifjcatjon of security propertjes of Android apps
- Builds on storyboarding
- Tackles difgerent classes of security propertjes
- Can be realized with existjng Android app development tools
- Facilitates automated reasoning and verifjcatjon
