Ensuring Sustainable Safety in Fine-Grained Android Permission Model: Decidability through Finite Attribute Range Constraints

When Android was first introduced, it permitted unrestricted access to all installed applications, posing significant security risks. In one of our previous works, we proposed, implemented, and demonstrated a comprehensive model capable of restricting access to sensitive permissions based on granular constraints. This model was partially adopted by Android and is now a standard feature in all modern Android-based systems. However, the flexibility of this model introduces a critical issue: the safety of the model. A model’s safety determines whether the policies enforced by the model achieve the desired security goals. In this paper, we investigate the safety and undecidability problems associated with the model and demonstrate that, in its full form, the model is undecidable. To ensure creation and maintenance of sustainable security policies at both the individual and enterprise level, we propose the addition of a Finite Attribute Range Constraint, which renders the model both decidable and safe.