Integrate System Integrity Check to Protect Your Apps from Unsafe Devices - Huawei Developers

Easy-to-Integrate Huawei System Integrity Check – Helping You Protect Your Apps from Unsafe Devices
Running apps on an unsafe device, for example, a rooted or unlocked device, can pose serious security risks. On an unsafe device, viruses, Trojan horses, and other malicious software may exploit the root permission to implant viruses, tamper with device information, and damage the system. Therefore, there is a real need to protect your apps from being run on unsafe devices. To meet such a need, Huawei offers Safety Detect, which provides the SysIntegrity API for system integrity check. This API can check whether a device running your app is unsafe, for example, due to the device being rooted or unlocked.
I. Service Introduction
The SysIntegrity API has the following features:
1. TEE-based system integrity check results: The API evaluates the integrity of a system during its secure boot in the Trusted Execution Environment (TEE) and will dynamically evaluate the system integrity. The check results are highly reliable.
2. Secure and reliable system integrity check results: The system integrity check results are signed using the signing certificate and cannot be tampered with.
(1) The Safety Detect SDK integrated with your app calls the SysIntegrity API.
(2) Safety Detect requests the signed check results from the Trusted Security Management Service (TSMS) server.
(3) Your app requests the check results.
II. Scenarios
Currently, developers of apps in the finance, entertainment, lifestyle, news, and other categories have integrated the SysIntegrity API into their apps.
A financial app can integrate SysIntegrity to improve transaction security. For example, the app can check whether the device is secure when a user enters the Card Verification Code (CVC) of their credit card. If the device is unsafe, the app will be stopped on the device to ensure no unsafe transactions can occur.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
A lifestyle or news app can integrate SysIntegrity to prevent malicious attacks, ensuring security of in-app operations such as payment.
A video entertainment app can integrate SysIntegrity to help protect copyrighted content. When a user registers an account on the app and watches or downloads video content, SysIntegrity can help ensure that this being done on a device that is trusted by the content provider.
III. Code Development
1 Configuring App Information in AppGallery Connect
Before you start developing an app, configure app information in AppGallery Connect.
For details, please visit https://developer.huawei.com/consumer/en/doc/HMSCore-Guides-V5/config-agc-0000001050416303-V5?ha_source=hms1
2 Configuring the Maven Repository Address for the HMS Core SDK
2.1 Open the build.gradle file in the root directory of your Android Studio project.
2.2 Add the AppGallery connect plug-in and the Maven repository.
Go to allprojects > repositories and configure the Maven repository address for the HMS Core SDK.
Code:
allprojects {
repositories {
google()
jcenter()
maven {url 'https://developer.huawei.com/repo/'}
}
}
Go to buildscript > repositories and configure the Maven repository address for the HMS Core SDK.
Code:
buildscript {
repositories {
google()
jcenter()
maven {url 'https://developer.huawei.com/repo/'}
}
}
Go to buildscript > dependencies and add dependency configurations.
Code:
buildscript{
dependencies {
classpath 'com.huawei.agconnect:agcp:1.3.1.300'
}
}
3 Creating a SafetyDetectClient Instance and Generating a Nonce Value
Code:
// Create a SafetyDetectClient instance.
SafetyDetectClient mClient = SafetyDetect.getClient(MainActivity.this);
// Generate a nonce value.
byte[] nonce = new byte[24];
try {
SecureRandom random;
if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
random = SecureRandom.getInstanceStrong();
} else {
random = SecureRandom.getInstance("SHA1PRNG");
}
random.nextBytes(nonce);
} catch (NoSuchAlgorithmException e) {
Log.e(TAG, e.getMessage());
}
4 Creating a Check Result Listener
Code:
// Implement the OnSuccessListener API and obtain the check result from onSuccess
protected class SysIntegrityOnSuccessListener implements OnSuccessListener<SysIntegrityResp> {
// Obtain the system integrity check result.
@Override
public void onSuccess(SysIntegrityResp sysIntegrityResp) {
}
}
// Implement the OnFailureListener API and obtain the failure details from onFailure.
protected class SysIntegrityOnFailureListener implements OnFailureListener {
// Obtain the result code and description.
@Override
public void onFailure(Exception e) {
}
}
5 Calling the SysIntegrity API
Code:
// Call the SysIntegrity API. Replace ******** in the following code with your app ID.
Task task = mClient.sysIntegrity(nonce,"********");
task.addOnSuccessListener(new SysIntegrityOnSuccessListener()).addOnFailureListener(new SysIntegrityOnFailureListener());
6 Verifying the Check Results
For details about how to verify the check results on the server, please refer to relevant documents on the HUAWEI Developers website.
To find out more, visit the following links:
SysIntegrity API:
https://developer.huawei.com/consumer/en/doc/development/HMSCore-Guides/dysintegritydevelopment-0000001050156331?ha_source=hms1
Safety Detect development guide:
https://developer.huawei.com/consumer/en/doc/development/HMSCore-Guides/introduction-0000001050156325?ha_source=hms1
Demo and sample code on GitHub:
https://github.com/HMS-Core/hms-safetydetect-demo-android
Stack Overflow (for technical discussions):
https://stackoverflow.com/questions/tagged/huawei-mobile-services?tab=Newest