ANDROID ILOVALARINI XAVFSIZLIK XUSUSIYATLARI TAHLILI: SSO PROTOKOLI MISOLIDA

Nuriddin Jabbarov

doi:10.5281/

Pdf

Published: 2024-05-18

DOI: https://doi.org/10.5281/

Keywords:

Yagona kelib chiqish siyosati (SOP), Yagona tizimga kirish (SSO), Android operatsion tizimi, identifikatsiya provayderida (IdP), xizmat koʻrsatuvchi provayder (SP), Facebook SDK, Droidsafe, Proverif tajovuzkor modellar

Jabbarov Nuriddin Akbarovich

Toshkent axborot texnologiyalari universiteti

Abstract

Uyali telefonlar odamlarning internetga kirishlari uchun asosiy yondashuvga aylanib borayotganligi sababli, odamlar o‘z mobil telefonlaridan foydalanayotganda xavfsizlik asosiy muammo hisoblanadi. Foydalanuvchilarning cookie-fayllari va hisobga olish maʼlumotlari kabi axborotlarni himoya qilish uchun samarali izolyatsiya mexanizmlariga ega boʻlgan veb-brauzerdan farqli oʻlaroq, Yagona kelib chiqish siyosati (SOP) Android ilovalarini ishlab chiquvchilar izolyatsiya mexanizmini oʻzlari amalga oshirishlari kerak. Ushbu maqolada Facebook SDK yordamida Yagona tizimga kirish (SSO) xizmatini taqdim etuvchi ilova tahlil qilingan. Ilovadan olingan tarmoq trafigi rasmiy modellarni yaratadi va rasmiy modellarning belgilangan xususiyatlarini tekshirish uchun Proverif tekshirgichidan foydalaniladi. Tahlildan so‘ng SOPni buzadigan bitta zaiflik aniqlanadi.

Downloads

Download data is not yet available.

Issue

Vol. 1 No. 1 (2024): ZAMONAVIY INNOVATSION TADQIQOTLARNING DOLZARB MUAMMOLARI VA RIVOJLANISH TENDENSIYALARI: YECHIMLAR VA ISTIQBOLLAR mavzusidagi Respublika ilmiy-texnik anjuman (2024-yil 17-18-may) (1-qism)

Section

Articles

This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License.

How to Cite

Jabbarov, N. (2024). ANDROID ILOVALARINI XAVFSIZLIK XUSUSIYATLARI TAHLILI: SSO PROTOKOLI MISOLIDA. Konferensiyalar, 1(1), 180-184. https://doi.org/10.5281/

References

S. Steiner, “The dangers of identity theft,” Aug 2013. [Online]. Available: http://goo.gl/ONKbLm

P. Oliver, “What’s most dangerous kind of identity theft?” Mar 2015. [Online]. Available: http://goo.gl/BXtoUP

R. Wang, S. Chen, and X. Wang, “Signing me onto your accounts through facebook and google: A trafﬁc-guided security study of commercially deployed singlesign-on web services,” in S&P, 2012.

E. Y. Chen, Y. Pei, S. Chen, Y. Tian, R. Kotcher, and P. Tague, “Oauth demystiﬁed for mobile application developers,” in CCS, 2014.

R. Wang, Y. Zhou, S. Chen, S. Qadeer, D. Evans, and Y. Gurevich, “Explicating sdks: Uncovering assumptions underlying secure authentication and authorization.” in USENIX Security, 2013.

H. Bagheri, E. Kang, S. Malek, and D. Jackson, “Detection of design ﬂaws in the android permission protocol through bounded veriﬁcation,” in FM, 2015.

G. Bai, J. Sun, J. Wu, Q. Ye, L. Li, J. S. Dong, and S. Guo, “All your sessions are belong to us: Investigating authenticator leakage through backup channels on android,” in ICECCS, 2015.

C. Bansal, K. Bhargavan, and S. Maffeis, “Discovering concrete attacks on website authorization by formal analysis,” in CSF, 2012.

B. Blanchet, B. Smyth, and V. Cheval, “Proverif 1.86: Automatic cryptographic protocol veriﬁer, user manual and tutorial,” INRIA Paris-Rocquencourt, LSV, ENS Cachan & CNRS & INRIA Saclay IIle-de-France, Paris, France, 2013.

M. Zelwski, “Browser security handbook, part 2,” 2011. [Online]. Available: https://goo.gl/Vi3dGO