Security Analysis And Enhancement Of Third-Party Android Push Services

Push services are being used more and more widely in mobile applications.In addition to the major mobile phone platform,many companies have also released their own push service to facilitate the development for developers.However,the openness of Android ecosystem and problems caused by push service providers,coupled with the improper use of push service by developers,result in the current mobile applications that integrated with push service privacy issues such as leakage,bring security risk to the user.This paper pointed out that developers use API provided by third-party push services incorrectly and store registration information in plaintext when integrating push service and made the actual analysis of the application notification reception,also the first to analyze the problems between application server and push server.3057 applications were analyzed and found when integrating push service,there were improper usages for application developers,like writing registration information in AndroidManifest file in plaintext.The analysis of applications' real usage of push service,found that the application received a small amount of notifications and the interval of received time is large.Then analyzed security problems in applications when integrating push services and carried out attack tests,and realized the forgery and stealing of push data attack.In view of security problem above and its causes,based on mpush,a push service enhancing scheme SPush is proposed.SPush uses asymmetric encryption and signature verification algorithms as well as Android NDK,to protect the security of data transmission and data storage in smartphones.Results of the experiments show that SPush effectively protects the data transimission and storage security.Time consuming as well as performance consumption increase by about 4% compared to mpush.