SARA: Safe Remote Authorization for Android

Abstract

Modern smartphones now come equipped with Trusted Execution Environments (TEEs), which provide robust security—even against attackers with full control over the standard operating system, such as Linux on Android. While both researchers and manufacturers have proposed using TEEs to enhance authorization security, these approaches often fall short due to practical limitations and incomplete security guarantees. To overcome these challenges, this paper introduces SARA (Secure Android Remote Authorization), an Android library that leverages existing TEE-supported Android APIs to provide secure, end-to-end remote authorization. SARA is practical because it uses pre-existing features in modern Android devices without requiring changes to the OS or the TEE's TrustZone code. As a result, it can be seamlessly integrated into current apps on existing smartphones. Additionally, SARA is designed for ease of use, enabling developers—even those without a background in security—to implement strong authorization protocols. To validate its effectiveness, we conducted a user study to evaluate SARA’s usability and formally verified its security guarantees using the ProVerif tool.