We use essential cookies for the website to function, as well as analytics cookies for analyzing and creating statistics of the website performance. To agree to the use of analytics cookies, click "Accept All". You can manage your preferences at any time by clicking "Cookie Settings" on the footer. More Information.

Cookie Settings
Only Essential Cookies
Accept All
MaterialsConsole

HarmonyOS

输入关键字搜索
HMS Core
AppGallery Connect
HUAWEI HiAI
CTRL+K

Image Security Verification

Last updated: 2026-06-18 10:31
Content overview

Use Cases

Image data captured by a camera in secure mode is signed by creating an attestation key and initializing an attestation session, to ensure authenticity and integrity of the image data.

Constraints

This feature requires that the device supports the secure camera mode.

You can call the getSupportedSceneModes method to check whether the current device supports the secure camera mode. If the return value is camera.SceneMode.SECURE_PHOTO, the device supports the secure camera mode. If other values are returned, the device does not support the secure camera mode. The following is an example:

Collapse
Word wrap
Dark theme
Copy code
  1. import { camera } from '@kit.CameraKit';
  2. import { BusinessError } from '@kit.BasicServicesKit';
  3. // Obtain the secure camera.
  4. function getSecureCameraDevice(cameraManager: camera.CameraManager): camera.CameraDevice {
  5.     // Obtain the list of cameras supported by the device.
  6.     const cameraDevices = cameraManager.getSupportedCameras();
  7.     if (cameraDevices.length < 1) {
  8.       throw new Error('no camera devices');
  9.     }
  10.     // Obtain the front camera object. Currently, the secure camera must be a front camera.
  11.     const frontCamera: camera.CameraDevice | undefined = cameraDevices.find((profile: camera.CameraDevice) => {
  12.       return profile.cameraPosition != camera.CameraPosition.CAMERA_POSITION_BACK;
  13.     });
  14.     if (frontCamera === undefined) {
  15.       throw new Error('no front cameras');
  16.     }
  17.     // Check whether the front camera supports the secure camera mode. If yes, the front camera can be used for subsequent secure camera operations.
  18.     const modes = cameraManager.getSupportedSceneModes(frontCamera);
  19.     if (modes.indexOf(camera.SceneMode.SECURE_PHOTO) === -1) {
  20.       throw new Error('current device not support secure camera');
  21.     }
  22.     return frontCamera;
  23.   }

Service Process

API Description

For details about the APIs and their usage, see API Reference.

Expand
API Description
createAttestKey(options: AttestOptions): Promise<void> Creates an attestation key.
initializeAttestContext(userData: string, options: AttestOptions): Promise<AttestReturnResult> Initializes an attestation session.
finalizeAttestContext(options: AttestOptions): Promise<void> Ends an attestation session.
destroyAttestKey(): Promise<void> Destroys an attestation key.

Development Procedure

  1. Import the camera module, trustedAppService module, and dependent modules.

    Collapse
    Word wrap
    Dark theme
    Copy code
    1. import { camera } from '@kit.CameraKit';
    2. import { trustedAppService } from '@kit.DeviceSecurityKit';
    3. import { BusinessError } from '@kit.BasicServicesKit';

  2. Initialize the secure camera by referring to the secure camera development guide.

    You need to:

    • Select a camera that supports the secure mode.
    • Check the output capability supported by the camera in secure mode.
    • Create the input and output streams.
    • Turn on the camera in secure mode and obtain the device serial number.

  3. Create an attestation key and initialize an attestation session.

    NOTE

    • An attestation session can be initialized only after an attestation key is successfully created.

    • An attestation key is valid for seven days. To avoid repeated creation of attestation keys, you are advised to call the attestation session initialization API first. If the initialization fails, destroy and create the attestation key, and initialize the attestation key again.

    • The device serial number needs to be obtained each time the secure mode is enabled for a camera, and passed for initializing an attestation session for the camera in secure mode. In other scenarios, the value 0 can be passed.

    • When initializeAttestContext is called to initialize an attestation session, the value of userData must contain 16 to 127 bytes.

    Collapse
    Word wrap
    Dark theme
    Copy code
    1. // Parameters for creating an attestation key.
    2. const createProperties: Array<trustedAppService.AttestParam> = [
    3.   {
    4.     tag: trustedAppService.AttestTag.ATTEST_TAG_ALGORITHM,
    5.     value: trustedAppService.AttestKeyAlg.ATTEST_ALG_ECC
    6.   },
    7.   {
    8.     tag: trustedAppService.AttestTag.ATTEST_TAG_KEY_SIZE,
    9.     value: trustedAppService.AttestKeySize.ATTEST_ECC_KEY_SIZE_256
    10.   }
    11. ];
    12. const createOptions: trustedAppService.AttestOptions = {
    13.   properties: createProperties
    14. };
    15. // Parameters for initializing an attestation session.
    16. const userData = "trusted_app_service_demo"; // Example value. Generate a value on your own, which contains 16 to 127 bytes.
    17. const deviceId = 7483679320805398131; // Example value. Obtain the value from Camera Engine.
    18. const initProperties: Array<trustedAppService.AttestParam> = [
    19.   {
    20.     tag: trustedAppService.AttestTag.ATTEST_TAG_DEVICE_TYPE,
    21.     value: trustedAppService.AttestType.ATTEST_TYPE_CAMERA
    22.   },
    23.   {
    24.     tag: trustedAppService.AttestTag.ATTEST_TAG_DEVICE_ID,
    25.     value: BigInt(deviceId)
    26.   }
    27. ];
    28. const initOptions: trustedAppService.AttestOptions = {
    29.   properties: initProperties
    30. };
    31. // Create an attestation key and initialize an attestation session.
    32. let certChainList: Array<string>;
    33. try {
    34.   await trustedAppService.createAttestKey(createOptions);
    35.   const result = await trustedAppService.initializeAttestContext(userData, initOptions);
    36.   certChainList = result.certChains;
    37. } catch (err) {
    38.   const error = err as BusinessError;
    39.   console.error(`Failed to initialize attest context, message:${error.message}, code:${error.code}`);
    40. }

  4. Create a secure camera session, configure the input and output streams, and start the preview stream and secure data stream by referring to the secure camera development guide.

  5. Ends an attestation session.

    Collapse
    Word wrap
    Dark theme
    Copy code
    1. // Parameters for ending the attestation session.
    2. const finalProperties: Array<trustedAppService.AttestParam> = [
    3.   {
    4.     tag: trustedAppService.AttestTag.ATTEST_TAG_DEVICE_TYPE,
    5.     value: trustedAppService.AttestType.ATTEST_TYPE_CAMERA
    6.   }
    7. ];
    8. const finalOptions: trustedAppService.AttestOptions = {
    9.   properties: finalProperties,
    10. };
    11. // End the attestation session.
    12. try {
    13.   await trustedAppService.finalizeAttestContext(finalOptions);
    14. } catch (err) {
    15.   const error = err as BusinessError;
    16.   console.error(`Failed to finalize attest context, message:${error.message}, code:${error.code}`);
    17. }

    To destroy an attestation key, call the destroyAttestKey API after the attestation session ends. Image security verification, location security verification, and secure image compression and cropping share the same attestation key. Before destroying an attestation key, ensure that the location security verification function is not using the attestation key.

English
©2026 HUAWEI Developers. All rights reserved.
Terms of Use
Statement About HUAWEI Developers and Privacy
Cookies
Cookie Settings
Open-Source Software Notice
Search in Guides
Enter a keyword.