I have an idea: Android data protection with eCryptfs
Data protection on mobile devices cares for everyone. Users, creators of operating systems, application developers. For many, the smartphone has become the center of a personal digital universe. Here, personal life and work. Correspondence and telephone numbers, social networking clients and bank account information. The phone is convenient to store passwords, keep diaries, take notes. On personal photos and videos can not speak, as well as about the materials that bear the stamp of trade secrets. The more important the data, the more interesting they are for outsiders, the more serious the forces that can be thrown into trying to get what they want.
Today we will talk about the new approach to creating a system of data protection on Android, which is based on the eCryptfs file system.
Let's start with what has already been done in the field of information security on Android. Existing solutions work at different levels of the system.
')
Android levels that can run secure storage solutions
Let's start with the Linux kernel level, the first in our scheme. This includes the method of full disk encryption (Full Disc Encryption, FDE). Android OS supports FDE, starting with version 3.0. Full disk encryption is the encoding of all user data on the device using an encrypted key. After the data is encrypted, everything that the user creates is also encrypted before writing to the disk. When reading, before transferring data to the process that requested them, they are decrypted. The average developer can not know about this mechanism. If users use it, in particular, use a lock screen with a password, it protects their data from unauthorized copying.
Under the second number in our scheme is the level of the Android Framework. In order to implement a data encryption system that will be located at this level, you need root-rights. Such a system will operate on the basis of a control interception mechanism. An application that is planned to be protected in this way can transmit, read, write data using standard tools whose calls go through the security system.
Application level, the third number in our scheme. Most of the existing solutions in the field of encryption and security can be attributed here. This is a considerable number of libraries for application developers. Among them, for example, OpenSSL, secureSqlite and others.
eCryptfs is a POSIX-compatible multi-level cryptographic file system for Linux. It stores cryptographic metadata in file headers, so encrypted files can be copied from one system to another. The copied file will be encrypted using the appropriate key from the key set of the Linux kernel. There is no need to store and process any additional data, besides those already stored in the file.
The eCryptfs file system is widely distributed and time tested. For example, it is based on encryption of the home directory in Ubuntu, it is also used in ChromeOS and is built into some network storage systems.
When using eCryptfs, encryption and decryption of data is performed automatically. Here is the architecture of the proposed solution.
ECryptfs Solution Architecture
Please note that if the Linux kernel has an eCryptfs module, you can interact with it using the Service. The service accepts commands from applications that use encryption, and sends requests to VOLD (Volume Daemon), which, in turn, performs actions on data.
Here are the requests for working with secure directories performed by VOLD:
The proposed data protection subsystem can be added to the above scheme as an additional layer above the data storage device driver.
The place of the proposed solution in the structure of Android
If you like the idea of ​​using eCryptfs, we want to suggest a scheme for its implementation.
Changes to be made to the system
The red boxes in the figure are new blocks that need to be added to the system in order to securely store data using eCryptfs. The light gray color of the block indicates that the corresponding component needs adjustment. Namely, the general scheme for integrating eCryptfs into Android is as follows:
Patches for integrating eCryptfs into the Linux kernel on Android can be found here .
The encryption subsystem based on eCryptfs is good because it works at the Linux kernel level. After its implementation and integration into Android, any applications will be able to use it, while the kernel will be responsible for encryption.
Security does not happen much. If you, for example, are working on the firmware for an Android device with a high level of data protection, on this “digital fortress”, it is quite possible that eCryptfs could become one of the inaccessible walls of this fortress itself.
Today we will talk about the new approach to creating a system of data protection on Android, which is based on the eCryptfs file system.
Existing solutions
Let's start with what has already been done in the field of information security on Android. Existing solutions work at different levels of the system.
')
Android levels that can run secure storage solutions
Let's start with the Linux kernel level, the first in our scheme. This includes the method of full disk encryption (Full Disc Encryption, FDE). Android OS supports FDE, starting with version 3.0. Full disk encryption is the encoding of all user data on the device using an encrypted key. After the data is encrypted, everything that the user creates is also encrypted before writing to the disk. When reading, before transferring data to the process that requested them, they are decrypted. The average developer can not know about this mechanism. If users use it, in particular, use a lock screen with a password, it protects their data from unauthorized copying.
Under the second number in our scheme is the level of the Android Framework. In order to implement a data encryption system that will be located at this level, you need root-rights. Such a system will operate on the basis of a control interception mechanism. An application that is planned to be protected in this way can transmit, read, write data using standard tools whose calls go through the security system.
Application level, the third number in our scheme. Most of the existing solutions in the field of encryption and security can be attributed here. This is a considerable number of libraries for application developers. Among them, for example, OpenSSL, secureSqlite and others.
Meet eCryptfs
eCryptfs is a POSIX-compatible multi-level cryptographic file system for Linux. It stores cryptographic metadata in file headers, so encrypted files can be copied from one system to another. The copied file will be encrypted using the appropriate key from the key set of the Linux kernel. There is no need to store and process any additional data, besides those already stored in the file.
The eCryptfs file system is widely distributed and time tested. For example, it is based on encryption of the home directory in Ubuntu, it is also used in ChromeOS and is built into some network storage systems.
ECryptfs based solution architecture
When using eCryptfs, encryption and decryption of data is performed automatically. Here is the architecture of the proposed solution.
ECryptfs Solution Architecture
Please note that if the Linux kernel has an eCryptfs module, you can interact with it using the Service. The service accepts commands from applications that use encryption, and sends requests to VOLD (Volume Daemon), which, in turn, performs actions on data.
Here are the requests for working with secure directories performed by VOLD:
- Create.
- To block In this case, VOLD unmounts the folder.
- Unlock. VOLD will mount the folder, then the application can work with the data at the mount point. The kernel will automatically encrypt and decrypt information.
- Delete.
- Restore.
- Change passwords.
The proposed data protection subsystem can be added to the above scheme as an additional layer above the data storage device driver.
The place of the proposed solution in the structure of Android
Do it yourself
If you like the idea of ​​using eCryptfs, we want to suggest a scheme for its implementation.
Changes to be made to the system
The red boxes in the figure are new blocks that need to be added to the system in order to securely store data using eCryptfs. The light gray color of the block indicates that the corresponding component needs adjustment. Namely, the general scheme for integrating eCryptfs into Android is as follows:
- Provide eCryptfs support for the Linux kernel.
- Add utilities to VOLD to support eCryptfs and eCryptfs interface.
- Add a basic service, including a library that applications can use.
- Add SELinux policies that allow the solution to work in a new system.
Patches for integrating eCryptfs into the Linux kernel on Android can be found here .
findings
The encryption subsystem based on eCryptfs is good because it works at the Linux kernel level. After its implementation and integration into Android, any applications will be able to use it, while the kernel will be responsible for encryption.
Security does not happen much. If you, for example, are working on the firmware for an Android device with a high level of data protection, on this “digital fortress”, it is quite possible that eCryptfs could become one of the inaccessible walls of this fortress itself.
Source: https://habr.com/ru/post/277411/
All Articles