HM-SAF: Cross-Layer Static Analysis Framework For HarmonyOS

HarmonyOS is a new operating system that is compatible with Android and widely used in various Internet of Things (IoT) applications. However, like the Android system, HarmonyOS is also susceptible to privacy risks due to numerous applications in the Android ecosystem. Given the unique architecture of HarmonyOS, the conventional Android analysis framework cannot be directly applied. Consequently, there is an urgent need to develop a security analysis tool specifically designed for reviewing HarmonyOS applications. This paper proposes a static analysis approach for analyzing HarmonyOS applications and addresses the challenge of cross-layer analysis in the existing framework. The approach introduces a bottom-up data flow analysis algorithm based on summarized memory to achieve more accurate taint analysis capabilities. Additionally, the paper introduces benchmark suites, HMICCBench, and HMNativeFlowBench, to evaluate the effectiveness and accuracy of taint analysis tools for HarmonyOS.The experimental results presented in this paper demonstrate that Static Analysis Framework for HarmonyOS (HM-SAF) can effectively detect data leakage within and across components, as well as in Native layers, with a high degree of analysis accuracy. On the above three benchmark sets, HM-SAF achieves 93.6% accuracy, which is 4.1% higher than the FlowDroid framework in the Android world, and 4.0% higher than the JN-SAF framework. At the same time, HM-SAF also detected data leakage in real applications, indicating that HM-SAF has practical value.