Enhanced Simulated Click Detection

Use Cases

Starting from version 6.0.2(22), enhanced simulated click detection is supported.

An app calls the detectSimulatedClickRiskEnhanced API of Device Security Kit to obtain the enhanced simulated click detection result for detecting cheating behaviors like automated clicks and device farming.

The app can evaluate how to perform service operations based on the detection result.

Constraints

Each app can call the API for up to 10 times every 30 seconds and up to 20 times per day on each device.

Service Process

Process description:

Your app obtains the nonce value.

When calling the detectSimulatedClickRiskEnhanced API, you must pass a randomly generated nonce value, which will be contained in the check result. You can check the nonce value to verify that the returned result corresponds to your request and does not encounter replay attacks.
- A nonce value must contain 24 to 80 bytes.
- It is recommended that a new nonce value be randomly generated by the app server for each request.
Your app calls the detectSimulatedClickRiskEnhanced API to initiate an enhanced simulated click detection request.

After receiving the request, Device Security Kit collects the simulated click clue data of the current device, sends the clue data and nonce value to the Device Security server for detection, and passes the detection result to your app through the return value of the detectSimulatedClickRiskEnhanced API.
When your app initiates a service request, your app server verifies the integrity of the enhanced simulated click detection result.

API Description

The following table lists the enhanced simulated click detection API. For more information about the API, please refer to API Reference.

API	Description
detectSimulatedClickRiskEnhanced(params:SimulatedClickDetectionEnhancedRequest):Promise<string>	Enhanced Simulated Click Detection

Development Procedure

Import the Device Security Kit module and related public modules.

import { hilog } from '@kit.PerformanceAnalysisKit';
import { businessRiskIntelligentDetection } from '@kit.DeviceSecurityKit';
import { BusinessError } from '@kit.BasicServicesKit';
import { cryptoFramework } from '@kit.CryptoArchitectureKit';

Call the detectSimulatedClickRiskEnhanced API to obtain the enhanced simulated click detection result.

const TAG: string = '[SimulatedClickRiskEnhancedDetectModel]';

function simulatedClickRiskEnhancedDetectPromise(): Promise<String> {
  let rand = cryptoFramework.createRandom();
  let len = 48;
  let randData = rand.generateRandomSync(len);

  return new Promise(async (resolve: Function, reject: Function) => {

    let params = {
      nonce: randData.data,
      version: 1,
      algorithm: businessRiskIntelligentDetection.SigningAlgorithm.ES256
    } as businessRiskIntelligentDetection.SimulatedClickDetectionEnhancedRequest;

    try {
      hilog.info(0x0000, TAG, 'Detect simulated click risk enhanced begin.');
      businessRiskIntelligentDetection.detectSimulatedClickRiskEnhanced(params).then((result: string) => {
        hilog.info(0x0000, TAG, 'Detect simulated click risk enhanced success: %{public}s', result);
        resolve(result);
      }).catch((error: Error) => {
        let e: BusinessError = error as BusinessError;
        hilog.error(0x0000, TAG, 'Detect simulated click risk enhanced failed: %{public}d %{public}s', e.code, e.message);
        reject(error);
      });
    } catch (error) {
      let e: BusinessError = error as BusinessError;
      hilog.error(0x0000, TAG, 'Detect simulated click risk enhanced failed: %{public}d %{public}s', e.code, e.message);
      reject(error);
    }
  });
}

Verify the enhanced simulated click detection result on your app server.

The result returned by the enhanced simulated click detection API is a JWS string. For details about how to verify the detection result, see the Java sample code. The procedure is as follows:

Parse the JWS-format result to obtain header, payload, and signature.
Obtain the certificate chain from header and use Huawei CBG Device Attestation Root CA certificate pair to verify it.
Check whether Common Name of the x5c[0] certificate in the certificate chain is Harmony OS Device Attestation Service.
Obtain the signature from signature and verify it.

Obtain the enhanced simulated click detection result from payload. The format and example are as follows:

Header fields:

{
  "alg": "ES256",
  "x5c": ["",""],
  "nonce": "R2Rra24fVm5xa2Mg",
  "appId": "xxxxxxxxx",
  "typ": "JWT"
}

alg: digital signature algorithm. The value ES256 indicates SHA256withECDSA.
x5c: certificate chain used by the Huawei signature server for JWS signing. x5c[0] indicates the certificate for JWS signing and x5c[1] indicates the level-2 CA certificate.
nonce: Base64-encoded nonce value in the SimulatedClickDetectionEnhancedRequest parameter.
appId: app ID obtained from HUAWEI Developers.
typ: indicates that the result is in JWT format.

Payload fields:

{
  "timestampMs": 9860437986543,
  "version": 1,
  "riskDecision": "fake",
  "tags": ["AbnormalTap"]
}

timestampMs: timestamp generated by the Huawei signature server.
riskDecision: risk detection result.
version: version number of the detection result message format. The default value is 1. Currently, the value can only be 1.
tags: key features of simulated clicks. If this field is empty, no key feature is found. If this field is not empty, key features are found.

Value of Tags	Meaning
AbnormalDeviceIntegrity	The device integrity is compromised.
AbnormalDeviceBehavior	Abnormal device behavior, such as device connection error and incorrect sensor status.
AbnormalTap	Abnormal clicks, such as click event injection and automated clicks.