Building the First Line of Defense to Ensure Airtight Information Security - Huawei Developers

At the Security and Privacy Session for the HUAWEI Developer Conference held at Songshan Lake Research Center on September 11th, Liu Deqian, a security technology expert from the Huawei Consumer Cloud Service Dept, provided a detailed overview of the security architecture and data safeguards in HMS. Mr. Liu detailed the security mechanisms in HMS Core, which are adhered to during HMS Core integration, and in every proceeding step, as well as the security and data protection technology packed into HMS Core open capabilities.
HMS Core — Core Mobile Services for Global Developers
HMS Core further opens up standout chip-device-cloud capabilities in 1+8+N scenarios for global developers, making app development easier, more cost-effective and efficient. With these capabilities, developers can focus their attention on pursuing innovation and providing first-rate app content, services and experiences for users. In Mr. Liu's view, HMS Core serves a key role in connecting apps with the operating system, helping developers attract more users, improve user activity, and achieve unprecedented success on the market.
How to Enhance Privacy and Security with HMS Core Opened? — Five Security Technology Pillars
As Mr. Liu noted, there are only three steps that are required for integrating HMS Core open capabilities: registering with HUAWEI Developers; applying for integration and obtaining authentication credentials; then finally, integrating the HMS SDK (software development tools). Following that, HMS Core implements access authentication.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Security technology pillars:
Ø Authentication: authenticates users, accesses, and devices
Ø Data security and privacy protection: bolsters the security of data storage, data usage, data transmission, keys, and privacy safeguards
Ø Content protection: protects copyrighted content, generates digital watermarks, and provides anti-leeching functions
Ø App security: ensures app security with four-layer detection prior to app release, download and installation protections, and runtime defense mechanisms
Ø Business risk control: provides risk controls for accounts, transactions, and content, and prevents fraud in advertisements
These five technologies help defend the privacy and security of apps accessing HMS Core, and continue to do so following app release, or as Mr. Liu explained it: "They are the most powerful lines of defense safeguarding your privacy and security".
Access Authentication
Mr. Liu further noted that the process of access authentication is secured by authentication credential, access constraints, and permission controls. Before an app can access HMS Core's open capabilities, you need to create authentication credentials on HUAWEI Developers. Currently, credentials supported by HMS Core include API Key, OAuth2.0 ClientID, and Service Account Key. These credentials are generated with secure random numbers and encrypted using the AES-GCM algorithm for storage on the server, in the event of credential leakage.
In addition to protective measures on the developer side, Liu explained that app security is also heightened by AppGallery with a unique four-layer detection mechanism prior to app release, as well as protections during app downloads and installations, and safeguards when the app is running.
Data Protection for HMS Core Open Capabilities
With Account Kit integrated, a user can sign in to your app in an optimally convenient manner. During the sign-in process, the user's account data is secured by FIDO. Furthermore, potential risks are automatically detected when the user signs in to the app or resets the password, to prevent the occurrence of account theft. Risk identification methods, such as those used for identifying abnormal operations, are used in conjunction with expert rules and machine learning to identify fake accounts and prevent malicious registrations. The risk control platform of Huawei device cloud thus has proven capable of identifying risks quickly and accurately, to protect users' legitimate rights and interests more effectively.
Mr. Liu also explained how IAP provides secure and convenient payment services for apps, offering two prominent examples: payment with faces or fingerprints (powered by PKI, public key infrastructure), and liveness detection. With PKI, the security of online payment is further enhanced. The keys and certificates are properly stored, to build a secure runtime environment for apps.
Another example is Push Kit. During the push process, each app on a device is provided with a unique token, which is used to authenticate the app, and push messages are encrypted and cached, with sensitive information contained in the message reviewed automatically. This solution ensures that cross-platform messaging is more reliable and precise. As Mr. Liu noted, for enhanced transmission security, push messages are encrypted using session keys, and secured with integrity safeguards.
Detail-Oriented Approach: End-to-End Security and Privacy Protections
Security is prioritized above all else throughout the whole process, from requirement analysis and design, to code development and testing, a highly detail-oriented approach. For instance, Huawei offers elite secure encoding practice with HMS project development guides and sandboxes that cover 43 device-cloud security vulnerabilities, and supports security tests with the Huawei Consumer Cloud Service Dept and more than 40 test engineers from the Huawei Internal Cyber Security Lab (ICSL).
SilverNeedle Lab: On the Move
Toward the end of the session, Liu introduced the guardian plan for HMS Core. Faced with attacks from external blue teams, HMS Core established its own blue team, SilverNeedle Lab. Convened by the lab, 60 frontline security researchers with abundant experience in attack defense and penetration testing gathered at the Songshan Lake Research Center recently to discuss such hot topics as penetration tools, biometric authentication, OAuth2, and security attack defenses offered by HMS.
In addition to having built an independent blue team, HMS Core has also worked closely with industry-leading security testing companies, such as NCC Group. The first phase of Huawei's security test project, security crowdtesting was recently completed, and Huawei invited 13 prominent companies, including Tencent, 360, Chaitin Tech, and DBAPP Security, as well as more than 60 white hat hackers (from such countries and regions as the Chinese mainland, Europe, Singapore and Russia) invited by Bug Bounty Programs, to conduct security penetration tests for HMS Core and HMS apps.
The second phase, dedicated testing for Europe, was conducted from January to August, 2020. During this process, Huawei invited NCC Group, an expert security service provider in Europe, to implement continuous online penetration tests for 24 kits, 11 of which had been tested in the first phase.
The third phase, HMS Security Competition, is still under planning. For the competition, Huawei plans to invite global developers and security researchers to conduct penetration tests on HMS products, with lucrative bonuses worth millions of RMB in total awarded to those attendees who identify high-value vulnerabilities. The maximum reward for a single vulnerability is set at a staggering RMB 420,000.
Huawei has an unrelenting resolve to pursue more effective security measures, and will spare no effort to protect the HMS Core ecosystem against any and all challenges presented by the global market.
For more details, you can go to:
Official website
Development Documentation page, to find the documents you need
Reddit to join our developer discussion
GitHub to download demos and sample codes
Stack Overflow to solve any integration problems