Device Security Kit provides DeviceVerify, SafetyDetect, TrustedAppService, TrustedAuthentication (digital shield), BusinessRiskIntelligentDetection, RiskControlEngine, SecurityAudit, AntifraudPicker, DlpAntiPeep, VirusProtectionServiceManager, and SuperPrivacyMode to protect apps from security threats and ensure app data security.
Use Cases
DeviceVerify: Checks and manages the status of an app on a device, including determining whether the app is installed for the first time on the device or whether the user has obtained a coupon on the device, to support new user acquisition campaigns.
SafetyDetect: Checks whether the device environment is secure, for example, whether the device environment is jailbroken or non-real. You can determine how to respond accordingly. SafetyDetect also checks whether the URL accessed by a user is malicious. If the URL is malicious, you can evaluate the risk and either warn the user of the risk or block the URL. In app risk control scenarios, SafetyDetect provides a unified risk control credential capability to obtain system risk control factor data and security credentials, helping you quickly build a reliable risk control system.
TrustedAppService: Provides the data security attestation for image security verification and location security verification, ensuring that images or location data is not tampered with.
TrustedAuthentication (digital shield): Provides TUI-based PIN authentication and TUI-based transaction confirmation to enhance financial security for finance apps in digital shield transaction scenarios. TUI is short for trusted user interface.
BusinessRiskIntelligentDetection: Provides business risk intelligent detection for anti-cheating and anti-fraud.
RiskControlEngine: Provides a risk control solution based on the on-device confidential computing space.
SecurityAudit: Enables your app to obtain audit data (such as screenshots, removable storage insertion and removal, and clipboard copy and paste) on a device for audit-related services.
AntifraudPicker: Provides anti-fraud apps with the ability to access fraudulent messages, call logs, and apps to support related businesses.
DlpAntiPeep: Enables your app to protect user privacy based on the peeping status. For example, personalized recommendations are not provided when the device is not used by the owner, and sensitive information such as browsing records, payment records, and favorites records are hidden.
VirusProtectionServiceManager: Enables your app to submit its software information to a device, query the antivirus software information list on the device, and start or stop the device's built-in security service.
SuperPrivacyMode: Enables your app to query and listen for the status of Super Privacy mode.
Basic Concepts
Device token: a token generated by Device Security Kit to identify a device and app. This token is used by the app server to communicate with the Device Security server to obtain the current device status.
nonce: generated by the developer and included in the system integrity check result. The caller verifies the nonce value to determine whether the check result has been under replay attacks.
Security attestation: a service provided by the TrustedAppService module to verify data authenticity and integrity and ensure that data is not tampered with during generation, transmission, and storage.
Attestation key: an encryption key generated in the security attestation service. It is used to generate and verify the digital signature of data. Image security verification and location security verification share the same attestation key.
Attestation session: context of the security attestation service. Before using the image security verification and location security verification functions, you need to create an attestation session to verify the validity of the attestation key.
Relationship with Other Kits
Digital shield, Universal Keystore Kit, and User Authentication Kit jointly provide the trusted UI, trusted authentication, and trusted signature capabilities for digital shield development of finance apps.
The service relationship is as follows.
[h2]Supported Countries/Regions
| Scenario | Country/Region |
|---|---|
| DeviceVerify | See Supported Countries/Regions. |
| SafetyDetect - System Integrity Check | Chinese mainland |
| SafetyDetect - URL Check | Chinese mainland |
| SafetyDetect - Local System Integrity Check | See Supported Countries/Regions. |
| SafetyDetect - Enhanced System Integrity Check | Chinese mainland |
| SafetyDetect - Unified Risk Control Credential | See Supported Countries/Regions. |
| TrustedAppService | Chinese mainland |
| TrustedAuthentication (digital shield) | Chinese mainland |
| SecurityAudit | Chinese mainland |
| BusinessRiskIntelligentDetection | Chinese mainland |
| RiskControlEngine | Chinese mainland |
| AntifraudPicker | Chinese mainland |
| DlpAntiPeep | Chinese mainland |
| VirusProtectionServiceManager | Chinese mainland |
| SuperPrivacyMode | Chinese mainland |
[h2]Supported Devices
| Scenario | Supported Device |
|---|---|
| DeviceVerify | Phones, tablets, PCs/2-in-1 devices, wearables, and TVs |
| SafetyDetect | Phones, tablets, PCs/2-in-1 devices, and wearables |
| Image security verification (TrustedAppService) | Phones and PCs/2-in-1 devices |
| Location security verification (TrustedAppService) | Phones and tablets |
| Secure image compression and cropping (TrustedAppService) | Phones and PCs/2-in-1 devices |
| TrustedAuthentication (digital shield) | Phones, tablets, and PCs/2-in-1 devices |
| SecurityAudit | PCs/2-in-1 device |
| BusinessRiskIntelligentDetection | Phones and tablets |
| RiskControlEngine | Phones, tablets, and PCs/2-in-1 devices |
| AntifraudPicker | Phones and tablets |
| DlpAntiPeep | Phones |
| VirusProtectionServiceManager | PCs/2-in-1 device |
| SuperPrivacyMode | Phones, tablets, and PCs/2-in-1 devices |