PROJECT TITLE :

SchrodinText: Strong Protection of Sensitive Textual Content of Mobile Applications

ABSTRACT:

A large number of mobile applications deliver and display sensitive and private textual content to users. Examples of this type of content include messages, social network posts, account information, and verification codes. It is required that all of this textual content be displayed to users, but mobile devices must have a robust protection mechanism against unauthorized access. Sadly, this is not the case with mobile devices in today's world; malware that is capable of corrupting the operating system can easily access the textual content of other applications. We present SchrodinText, a system solution for protecting the confidentiality of an application's selected user interface (UI) textual content against an operating system that has been completely breached. Virtualization hardware and TrustZone are two of the hardware features that are available on ARM processors, and SchrodinText takes advantage of both of these to create an innovative security monitor. Our most important contribution is a group of innovative methods that enable the operating system to perform text rendering without requiring direct access to the text itself, thereby reducing the amount of computing that must be trusted (TCB). The operating system is able to rasterize and lay out all of the characters without having access to the text because of these techniques, which are collectively known as oblivious rendering. The monitor is responsible for resolving the correct character glyphs onto the framebuffer that the user observes and protecting them from the OS. We demonstrate with our prototypes that SchrodinText has a noticable amount of overhead, but that its performance is sufficient for practical applications.