Abstract: In order to protect the data of Android operating system, we present a system called FlowMonitor to monitor and protect privacy flow based on Android. FlowMonitor adds taint marks and identity tags onto data. Moreover, it is a real-time, dynamic monitoring system. In order to avoid leaking private data by collusion attack, it uses the mechanism of taint's identity authentication based on the idea of RBAC, and finds all probable malicious applications. Based on open and closed policies, labels were designed for each data to control the use of private data. The user can control applications using private data based on their choices. Evaluation results show that Flowmonitor out performs taint Droid. It can not only find out all probable malicious applications which steal private data by collusion attack, but also control applications using each private data. Extensive experimental results demonstrate that FlowMonitor effectively protects the user privacy.

Key words: Android, identity authentication, collusion attack, privacy protection