Certificate Enhanced Data-Flow Analysis

TL;DR

This paper introduces DCert, a certificate-based data-flow analysis tool for Android, demonstrating that checking certificates is significantly faster than verification, enabling resource-constrained devices to efficiently verify app properties.

Contribution

We developed DCert, a novel certificate-based data-flow analysis framework for Android, showing that certificate checking is much faster than verification, suitable for mobile devices.

Findings

Checking certificates is up to 8 times faster than verification.

Certificates enable efficient verification on resource-limited devices.

Experimental results validate the effectiveness of the approach.

Abstract

Proof-carrying-code was proposed as a solution to ensure a trust relationship between two parties: a (heavyweight) analyzer and a (lightweight) checker. The analyzer verifies the conformance of a given application to a specified property and generates a certificate attesting the validity of the analysis result. It suffices then for the checker just to test the consistency of the proof instead of constructing it. We set out to study the applicability of this technique in the context of data- flow analysis. In particular, we want to know if there is a significant performance difference between the analyzer and the checker. Therefore, we developed a tool, called DCert, implementing an inter-procedural context and flow-sensitive data-flow analyzer and checker for Android. Applying our tool to real-world large applications, we found out that checking can be up to 8 times faster than verification. This important gain in time suggests a potential for equipping applications on app stores with certificates that can be checked on mobile devices which are limited in computation and storage resources. We describe our implementation and report on experimental results.