Post-Compromise Security for Autonomous Mobile Agents: Deterministic Runtime Enforcement of Mobile Execution Authority / 自主行動端Agent 攻陷後安全:行動執行權限之確定性運行時強制執行

Abstract

Autonomous mobile agents combine an untrusted or potentially compromised decision process with actions that can produce effects through mobile application interfaces. Existing mobile access-control mechanisms and agent-level controls operate at different enforcement layers. This paper studies a narrower and operationally testable question: whether a runtime execution-authority boundary can prevent an unauthorized agent request from producing a bounded application effect after compromise.We present DROS-Mobile, an execution-governance design that separates an agent request from the authorization decision and from the subsequent bounded action boundary. We define an execution-boundary invariant for unauthorized execution, together with positive-path and revocation contracts for the declared application-runtime boundary. We then evaluate a declared Android application-runtime target: a Pixel_7 Android Virtual Device running Android 34 on x86_64. The evaluation uses an app-side ingress receiver, a deterministic dispatcher, a bounded fixture, raw event records, and immutable evidenceclosure artifacts. Three security-semantics units establish a grant--enforce--revoke lifecycle. Two decisionpath measurements provide an allow/deny comparison. Finally, an accounting-backed 2/4/8-concurrency series characterizes observed decision latency and hostobserved throughput.The evidence supports a bounded conclusion. On the declared Pixel_7 AVD application-runtime path, unauthorized requests were denied before the bounded fixture started, authorized requests produced the expected bounded effect, and a revoked authority produced no subsequent effect. Under the declared measurement protocol, the 2/4/8 runs provide a reproducibledescriptive performance series. Separate framework-baseline slices show authority-dependent outcomes for native permission, AppOps, and a protected Binder-service path, while SELinux enforcing mode and application context are observed without causal denial attribution. The results do not establish Android-wide security, framework-wide enforcement, physical-device energy behavior, scalability laws, or causal explanations for the observed latency tails.自主行動代理人將可能不受信任或已遭受陷的決策程序,與能透過行動應用程式介面產生效果的行動結合。本研究聚焦一個較窄且可操作驗證的問題:在代理人控制器遭受攻陷後,執行權能邊界是否仍能阻止未授權請求產生受界定的應用程式效果。我們提出DROS-Mobile, 一種將代理人請求、授權決策與後續受界定action boundary 分離的執行治理設計。我們針對未授權執行定義執行邊界invariant, 並為宣告的application-runtime boundary 定義positive-path 與revocation contract。實驗目標固定為Pixel_7 Android Virtual Device、Android 34、x86_64。評測使用app-side ingress receiver、deterministic dispatcher、bounded fixture、原始事件記錄與不可變evidence-closure artifacts。三個security-semantics units建立grant--enforce--revoke lifecycle;兩個decision-path measurements 提供allow/deny 比較;最後以accountingbacked的2/4/8 concurrency series 描述觀測到decision latency 與host-observed throughput。在明確邊界下, 證據支持以下結論: 於宣告的Pixel_7 AVDapplication-runtime path,未授權請求在bounded fixture 開始前被拒絕;有效授權產生預期的bounded effect;撤銷後的authority不再產生後續effect。在宣告的measurement protocol 下,2/4/8 runs 提供可重現的descriptive performance series。獨立framework-baseline slices 另觀測到native permission、AppOps protected Binder-service path 的authoritydependent outcomes;SELinux enforcing mode 與application context 則被觀測到,但沒有causal denial attribution。本研究不建立Android-wide security、framework-wide enforcement、實體裝置能耗、scalability law,亦不對latency tail作因果歸因。