Enhancing the Security of Mobile Device Management with Seccomp

Abstract

Mobile devices today have been increasingly used to store and process sensitive information, and Mobile Device Management (MDM) solution is provided in Android systems to manage the mobile devices. MDM solution enforces device policies through calling Device Administration APIs provided in Android system. However, these APIs are usually implemented in user space, thus make the system more vulnerable to be attacked. Potential adversary may bypass these secure policies by breaking through the isolation between processes. In this paper, we propose an approach based on the seccomp mechanism of Linux kernel to enforce device management policies on Android. Seccomp can restrict the system calls of Android process to enforce device management policies in a more secure way. Experiments results demonstrate that our work may work well and incur negligible overhead.