CryptMTD: Cryptography Based Moving Target Defense System for Mobile Application

Mobile applications are vulnerable to attacks and information leakage due to various unknown vulnerabilities in mobile channels, terminals, and programs. Moving target defense (MTD) has emerged as a proactive defense technology against unknown attacks. Previous work mainly focused on server-side protection, while ignoring information leakage due to mobile terminal vulnerabilities. In this paper, we construct an MTD system that applies to both servers and terminals. The proposed system uses cryptography to dynamically mask various resources of the system. Interactive supports are provided between those masked resources and the server or the users, thus allowing resources to remain masked during the whole trip. The status and information of the system can be effectively shielded, preventing the mobile application from being sniffed and information leakage. Evaluation is conducted on a DingTalk-based mobile office automation (OA) application. Application results show that the proposed system can thwarts attacks from both the server and the terminal. The response time of the protected system increases by less than 5.8%, compared with the original system, which is applicable for mobile applications.