Securing mobile phones in the evolving mobile ecosystem

The revolution of mobile phone industry has been altering our life and business practices over the past few decades. Driven by user demands and technological advancement, we now experience rich mobile phone applications and sophisticated cellular services ranging from mobile payment, stock trading, to social networking, vehicle tracking to in-car control. As more players joining the community, this mobile phone environment has transformed into a complex network of interacting companies, known as mobile ecosystem. Unfortunately, this opening and converging mobile ecosystem has brought in more opportunities for more attacks on mobile phones, a key element of the system.This dissertation aims to achieve mobile phone security. We reveal two main challenges that we need to overcome, namely developing a clear definition of secure phones, and building security infrastructure that imposes such definition on the phones. We also identify three key elements that contribute to the fidelity of mobile phones, namely, mobile phone platforms, mobile phone applications, and mobile content. Throughout this dissertation, we explore the application of security requirements engineering discipline in developing security policies that frame security phones from the perspectives of the above three elements. Accordingly, we develop appropriate security infrastructure on the Android platform to enforce such security policies. Through security analysis and performance evaluation, we demonstrate the effectiveness and the efficiency of our approach, and suggest possible further improvement.