https://github.com/a-sit-plus/android-attestation-demo
Fides – Unleashing the Full Potential of Remote Attestation
https://github.com/a-sit-plus/android-attestation-demo
Last synced: over 1 year ago
JSON representation
Fides – Unleashing the Full Potential of Remote Attestation
- Host: GitHub
- URL: https://github.com/a-sit-plus/android-attestation-demo
- Owner: a-sit-plus
- License: mit
- Created: 2019-06-12T11:50:53.000Z (about 7 years ago)
- Default Branch: master
- Last Pushed: 2019-07-09T14:33:05.000Z (about 7 years ago)
- Last Synced: 2025-03-31T00:23:39.298Z (over 1 year ago)
- Language: Kotlin
- Homepage:
- Size: 203 KB
- Stars: 5
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Fides – Unleashing the Full Potential of Remote Attestation
In connected mobile app settings, back-ends have no means to reliably verify the integrity of clients. For this reason, services aimed at mobile users employ (unreliable) heuristics to establish trust. We tackle the issue of mobile client trust on the Android platform by harnessing features of current Android devices and show how it is now possible to remotely verify the integrity of mobile client applications at runtime. This makes it possible to perform sensitive operations on devices outside a service operator's control.
We present Fides, which improves the security properties of typical connected applications and foregoes heuristics for determining a device's state such as SafetyNet or root checks. At its core, our work is based on the advancements of Android's key attestation capabilities, which means that it does not impose a performance penalty. Our concept is widely applicable in the real world and does not remain a purely academic thought experiment. We demonstrate this by providing a light-weight, easy-to use library that is freely available as open source software. We have verified that Fides even outperforms the security measures integrated into critical applications like Google Pay.
[Fides – Unleashing the Full Potential of Remote Attestation](https://graz.pure.elsevier.com/en/publications/fides-unleashing-the-full-potential-of-remote-attestation), paper by Bernd Prünster, Gerald Palfinger, and Christian Kollmann, presented at [SECRYPT 2019](http://www.secrypt.icete.org/?y=2019).
## Android Key Attestation Service & Library
The [service](./service) is a Spring Boot service demonstrating the binding process and evaluation of the attestation certificate. See [README.md](./service/README.md) for details.
The [android-app](./android-app) is an Android app demonstrating the key generation process and exporting of the attestation certificate. See [README.md](./android-app/README.md) for details.