Policy based management is a very effective method to protect sensitive information

Policy administration is the key to protecting or operating information systems. Only after a legitimate policy set is designed, can the systems run correctly. This paper proposes a policy mechanism CPA under the current trust model, where a professional policy administrator or group is absent. Recently, the security of the Android platform becomes a hotspot in the field of system security. Revealed that two-thirds of the 30 randomlychosen popular third-party applications exhibited suspicious behaviors, such as disclosing sensitive information, and that half of the applications reported users’ locations to remote advertising servers. Policy based management is a very effective method to protect sensitive information. The overclaim of privileges is widespread in emerging applications, including mobile applications and social network services, because the applications’ users involved in policy administration have little knowledge of policy based management. The method of policy based management is widely used to manage complex and large scale network systems. The traditional framework of policy based management consists of four core components : PDP-Policy Decision Point, PEP-Policy Enforcement Point, PAP-Policy Administration Point and PR -Policy Repository. A well-trained policy administrator or group will specify, verify policies in PAP, and deploy the policies in PR. After a system runs, PDP will retrieve applicable policies from PR, and make decisions. PEP takes charge of the decision, such as satisfying the request where a subject wants to open a file (authorization action), or launching a logger to record system context. the developers usually declare more permissions than necessary because they are inclined to make the development of applications easier, or even misunderstand technical documents, the marketers usually tend to allow more applications regardless of the malicious permission requests; and the application users may not know what the requested permissions mean, thus approving all requests because they are eager to use the application. The same issue exists in social network services, where a user is asked to grant access to private data to third-party applications. This challenge to policy administration is increasing serious due to the explosion of these applications.