arXiv subjects

Sebastian Rehms

Publications and source records attributed to Sebastian Rehms.

4 recordsLinked to original sources

arXiv2026

mopri - An Analysis Framework for Unveiling Privacy Violations in Mobile Apps

Everyday services of society increasingly rely on mobile applications, resulting in a conflicting situation between the possibility of participation on the one side and user privacy and digital freedom on the other. In order to protect users' rights to informational self-determination, regulatory approaches for the collection and processing of personal data have been developed, such as the EU's GDPR. However, inspecting the compliance of mobile apps with privacy regulations remains difficult. Thus, in order to enable end users and enforcement bodies to verify and enforce data protection compliance, we propose mopri, a conceptual framework designed for analyzing the behavior of mobile apps through a comprehensive, adaptable, and user-centered approach. Recognizing the gaps in existing frameworks, mopri serves as a foundation for integrating various analysis tools into a streamlined, modular pipeline that employs static and dynamic analysis methods. Building on this concept, a prototype has been developed which effectively extracts permissions and tracking libraries while employing robust methods for dynamic traffic recording and decryption. Additionally, it incorporates result enrichment and reporting features that enhance the clarity and usability of the analysis outcomes. The prototype showcases the feasibility of a holistic and modular approach to privacy analysis, emphasizing the importance of continuous adaptation to the evolving challenges presented by the mobile app ecosystem.

cs.CR↗

arXiv2025

PermRust: A Token-based Permission System for Rust

Permission systems which restrict access to system resources are a well-established technology in operating systems, especially for smartphones. However, as such systems are implemented in the operating system they can at most manage access on the process-level. Since moderns software often (re)uses code from third-parties libraries, a permission system for libraries can be desirable to enhance security. In this short-paper, we adapt concepts from capability systems building a novel theoretical foundation for permission system at the level of the programming language. This leads to PermRust, a token-based permission system for the Rust programming language as a zero cost abstraction on top of its type-system. With it access to system resources can be managed per library.

cs.PL↗

arXiv2024

Information Inference Diagrams: Complementing Privacy and Security Analyses Beyond Data Flows

This work introduces Information Inference Diagrams (I2Ds), a modeling framework aiming to complement existing approaches for privacy and security analysis of distributed systems. It is intended to support established threat modeling processes. Our approach is designed to be compatible with Data Flow Diagrams~(DFDs), which form the basis of many established techniques and tools. Unlike DFDs, I2Ds represent information propagation, going beyond mere data flows to enable more formal reasoning in threat modeling while remaining practical. They define inference and sharing (flow) relations on information items to model how information moves through a system. To this end, we provide formal definitions for information items, entities, and flows. By introducing classes as a type system, our formal rules are both generic and allow conformance to existing vocabularies. We demonstrate the applicability of I2Ds through examples, that showcase their versatility in system analysis.

cs.CR↗

arXiv2022

Secure and Efficient Tunneling of MACsec for Modern Industrial Use Cases

Trends like Industry 4.0 will pose new challenges for future industrial networks. Greater interconnectedness, higher data volumes as well as new requirements for speeds as well as security will make new approaches necessary. Performanceoptimized networking techniques will be demanded to implement new use cases, like network separation and isolation, in a secure fashion. A new and highly efficient protocol, that will be vital for that purpose, is MACsec. It is a Layer 2 encryption protocol that was previously extended specifically for industrial environments. Yet, it lacks the ability to bridge local networks. Therefore, in this work, we propose a secure and efficient Layer 3 tunneling scheme for MACsec. We design and implement two approaches, that are equally secure and considerably outperform comparable state-of-the-art techniques.

cs.CR↗