题目：A Smart Framework for Fine-Grained Microphone Acoustic Permission Management
期刊：IEEE Transactions on Dependable and Secure Computing (TDSC) （CCF A类）
作者：Weili Han, Chang Cao, Zhe Zhou, Shize Chen, Lingqi Huang, X. Sean Wang
简介：为移动终端麦克风收集的语音设计了细粒度访问控制机制，并支持麦克风与喇叭的动态职责分离，可抵御当前绝大部分在软件层针对智能手机语音功能的攻击。
Fig. 2. The design of FMCframework with the interface of modified Package Installer(right) to check and confirm new sub-permissions. The recommended sub-permissions would be checked first and the user can reselect as his or her preferences.
Abstract
Microphones attracted a lot of attentions from attackers due to the sensitivity of voice data: attackers may control devices through abusing their microphones, fingerprint devices by measuring their microphones, or directly monitor the microphone readings to steal users’ private data. Nevertheless, OS developers failed to address the severe consequences. While the current security mechanism only offers a coarse-grained access control over the usage of microphones: recording all sound or shutting off, it is necessary to redesign the microphone security mechanism to enforce fine-grained restrictions over the usage of microphones. In this article, we propose a fine-grained microphone access control scheme on Android platform, referred to as FMC (Finer Microphone Controller). In our scheme, microphone acoustic permissions are granted with three finer policies: treble policy, timbre policy and exclusion policy, with which most of the attacks mentioned above can be defended against. In addition, to ease user’s policy management, we employ a smart policy recommendation method, avoiding additional manual policy approvals. The results in our experiments show that a negligible 1.06 percent performance overhead is incurred during policy enforcement. Besides, the policy recommendation system in FMC promises an accuracy of 82.82 percent averagely. We believe that our work is a practical defense scheme against attacks exploiting microphone acoustic permissions and should be employed by OS developers.