PII-DETRI-2021-06: Mejora de las técnicas de evaluación de la integridad contextual de la privacidad de las aplicaciones móviles : desarrollo de microservicios para la extracción de políticas de privacidad desde artefactos de una aplicación móvil android.

Abstract

This work presents the development of microservices that contribute to the compliance assessment of mobile applications with privacy and data protection requirements. Specifically, it developed a component consisting of three microservices that allow improving certain assessment modules, which have been previously developed as part of the research project PII-DETRI-2021-03 in the Escuela Politécnica Nacional. The component consists of 3 microservices, which were developed in a PyCharm development environment and the Python programming language along with several libraries to support the analysis: Microservice 1 automatically determines whether the application should disclose a privacy policy, based on application permissions. • Microservice 2 extracts strings embedded in an APK and detects document URL’s related to privacy policies. • Microservice 3 retrieves the content of a web page containing the app’s privacy policy. • The 3 microservices have been contained in Docker images for ease of deployment. This document is organized as follows: Chapter 1 presents the theoretical framework required to understand this work, including a brief description of privacy and personal data protection, the "Ley Orgánica de Protección de Datos” (LOPDP) and privacy policies. In addition, it describes the technologies employed in this work, including microservices, the Android operating system and its Android permissions model, and the relevant Python tolos and libraries. Chapter 2 presents the methodology used in the development of the microservices, based on the agile methodology, Scrum. The development process was carried out through 3 phases: analysis, design and implementation. In addition, the results and discussion are presented. Finally, Chapter 3 presents the conclusions of this work, as well as recommendations as per the development of future work.