Multi-Signature Based Tamper Detection Scheme of Android Applications

초록

Recently, Google's Android operating system, which has the highest market share in the smartphone market, has encountered various security problems. One major issue is that it is possible to decompile Android applications, which means that they can easily be modified; the modified applications may then be distributed as regular Android applications in the Android market. To solve this problem, an enhanced app-signing mechanism is necessary in order to provide verification of the integrity of Android applications. Therefore, in this paper, we propose a multi-signature based integrity verification scheme to minimize the vulnerability of Android application distribution methods. The proposed signature scheme is based on Schnorr's signature, and includes a self-signature from the application developer and the signature of the developer center. Moreover, it is designed to be compatible with an Android self-signature policy. In addition, we propose signature schemes based on both finite fields and elliptic curves over prime fields, and we implement each of these experimentally on Android smartphones.

키워드