# mPrivacy: A Privacy Policy Engine and Safeguard Mechanism in Mobile Devices
## 3 Problem Formulation
### Attack Model  
Although the mobile device's system restricts the application's access to information sources, the user's private information may still be leaked without the user's authorization. Figure 1: System model. In this case, many studies have discussed privilege escalation attacks. However, we found that escalation is not limited to permissions, as information can also be escalated. Information escalation attacks are when an attacker accesses more information without permission or obtains information with higher accuracy than allowed. Privilege escalation is part of information escalation. If privilege escalation occurs, the user's private information is leaked. Therefore, this concept is always within the scope of information escalation. * **Privilege escalation:** This type of attack is also known as a permission escalation attack. Malicious applications are designed to access protected resources in mobile devices. Through this attack, malicious applications can gain more permissions than expected and leak sensitive information without user authorization [19]. Privilege escalation can be achieved by the confused deputy or colluding [33]. The original sensitive information can be leaked without going through the inference process, or it can be used to infer other information. * **Non-privilege information escalation:** When information escalation occurs, the attacker may not need to violate any permissions. The information that the attacker wants to obtain may be information that is not included in the access control, or it may be information of higher quality. Non-privilege information escalation can also be accomplished by the confused deputy and colluding. Sensitive information can be leaked directly without inference, or it can be leaked indirectly through inference. In the following text, we explain some examples. The confused deputy is an attack in which an attacker can control malicious and infected applications to violate permissions or access resources. For example, an attacker can let the system browser download files or use the system scripting environment to send text messages without user authorization [33]. In the case of a non-privileged information attack, application A has the user's health status information, while application B does not. If application B uses the vulnerability of A to obtain health status information, this attack is a non-privilege information attack by confused deputy. The system has no permission control over the user's health status information, so this situation is not a privilege escalation attack. A colluding attack is when a group of malicious applications cooperate to access more resources than one of them can access. If these applications are developed by the same developer and have the same certificate, they can share their permissions and resources. In other words, if one application in a group of applications can access permission or resource, all other applications in the same group can share its permission or resource [17]. In the example of the confused deputy in the previous paragraph, if A and B are developed by the same attacker, A can send information to B. In this case, A and B collude to conduct a non-privileged information escalation attack. Information escalation attacks not only mean that the malicious application directly accesses disallowed information from another application, but also that the malicious application infers some other information that is different from the information used as input for the reasoning process, or that enhances the information accuracy. The inference attack is an attack method used by attackers to obtain sensitive information through data analysis. The attacker can access the information without direct permission [34; 35]. Combining inference with colluding or confused deputy attacks, attackers can carry out more complex attacks. In the aforementioned example, application B can use the user's health status information and behavior information to infer the user's disease information.