Use Cases
Device Security Kit provides the capability of querying the system security mode. By calling the API provided by Device Security Kit, your app can check the current security mode (common or Secure Shield) of the device and provide differentiated services accordingly.
Common mode: This is the default mode of the operating system and applies to most users.
Secure Shield mode: This is a system-level security mode provided for users with high security requirements. This mode restricts basic device capabilities to enhance security and effectively defend against targeted attacks through the remote attack surface.
In the Secure Shield mode, the operating system prohibits apps from requesting executable anonymous memory.
Apps must adapt to the system security mode by disabling the just-in-time (JIT) compilation function or switching to interpreted execution.
Development Procedure
Import and link the shared library of the device security mode in CMakeLists.txt.
find_library(dsm-lib libdevice_security_mode.z.so) target_link_libraries(entry PUBLIC libace_napi.z.so ${dsm-lib})Import the header file of the device security mode.
#include <DeviceSecurityKit/device_security_mode.h>
Call the API to query the current security mode of a device.
int32_t IsSecureShieldModeOn(void) { DSM_DeviceSecurityMode mode = HMS_DSM_GetDeviceSecurityMode(); return mode & DSM_SECURE_SHIELD_MODE; }
If the ArkWeb component is used in your app, you need to evaluate the compatibility of web features by referring to NOTE.