Field Notes

source

The Android Platform Security Model (2023)

StatusStableUpdatedStands on1 sourceSupportsnotes

“The Android Platform Security Model (2023)” is a peer-reviewed systemization by René Mayrhofer and seven Google Android security engineers, published in ACM Transactions on Privacy and Security (2021) and substantially revised in its third arXiv version (January 2024) to cover the platform as of 2023. The saved copy is the v3 arXiv PDF. It is the authoritative primary statement of Android’s own documented threat model and of how the sandbox, permission, verified-boot, and hardware-keystore mechanisms are intended to compose.

What it is evidence for

  • The mobile threat model explicitly includes loss, theft, and physical access by adversaries, not only remote attacks, which is why the platform assumes kernel compromise and pushes secrets into tamper-resistant hardware.
  • The multi-party authorization model: unlike desktop operating systems, Android gives apps, developers, users, and the platform veto rights over actions, which is what makes whole malware classes such as file-encrypting ransomware impractical against the stock security model.
  • The chain from Verified Boot through Keymint and StrongBox in tamper-resistant hardware to Weaver-style throttled key derivation and Insider Attack Resistance (IAR), where TRH wipes encryption secrets rather than accept a firmware update that would weaken authentication.
  • Sideloading’s formal place in the model: an app signing key is trusted on first use, so replacing or modifying an app in transit at initial sideload is outside the platform security model. The paper also acknowledges, in a footnote, the exception where app stores hold signing keys and sign the final APK “in the name of the developer” — the exact configuration Android app distribution trust models analyzes for F-Droid’s traditional builds.

Limitations

It documents the model as designed by its own designers, not an independent evaluation; deviations, implementation bugs, and OEM-specific weakenings are largely out of scope. The 2023 cutoff predates Android 15 and 16 features such as the inactivity reboot, Advanced Protection, and wider memory-tagging deployment. The authors are Google staff, so the framing of deliberate deviations (“special cases”) deserves cross-checking against independent analyses such as GrapheneOS’s documentation and forensic-vendor capability leaks.

Built on 1 source (1 external).

Working out connections…