Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add device id attestation

Browse Source 
This adds a new public API for attesting the device's hardware ids
(e.g. serial number and IMEI).

Bug: 34597337
Test: CTS CtsKeystoreTestCases and GTS DeviceIdAttestationHostTest

Change-Id: I2e9c1b4f8eb24afa4a09c71c137ce33a6b87eb27
This commit is contained in:
Bartosz Fabianowski
2017-01-23 17:40:47 +01:00
parent 9d3d90a22f
commit 92e8cfd21d
5 changed files with 305 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
api/system-current.txt
View File

@@ -38405,6 +38405,18 @@ package android.security {
package android.security.keystore {
public abstract class AttestationUtils {
method public static java.security.cert.X509Certificate[] attestDeviceIds(android.content.Context, int[], byte[]) throws android.security.keystore.DeviceIdAttestationException;
field public static final int ID_TYPE_IMEI = 2; // 0x2
field public static final int ID_TYPE_MEID = 3; // 0x3
field public static final int ID_TYPE_SERIAL = 1; // 0x1
}
public class DeviceIdAttestationException extends java.lang.Exception {
ctor public DeviceIdAttestationException(java.lang.String);
ctor public DeviceIdAttestationException(java.lang.String, java.lang.Throwable);
}
public class KeyExpiredException extends java.security.InvalidKeyException {
ctor public KeyExpiredException();
ctor public KeyExpiredException(java.lang.String);

12
api/test-current.txt
View File

@@ -35522,6 +35522,18 @@ package android.security {
package android.security.keystore {
public abstract class AttestationUtils {
method public static java.security.cert.X509Certificate[] attestDeviceIds(android.content.Context, int[], byte[]) throws android.security.keystore.DeviceIdAttestationException;
field public static final int ID_TYPE_IMEI = 2; // 0x2
field public static final int ID_TYPE_MEID = 3; // 0x3
field public static final int ID_TYPE_SERIAL = 1; // 0x1
}
public class DeviceIdAttestationException extends java.lang.Exception {
ctor public DeviceIdAttestationException(java.lang.String);
ctor public DeviceIdAttestationException(java.lang.String, java.lang.Throwable);
}
public class KeyExpiredException extends java.security.InvalidKeyException {
ctor public KeyExpiredException();
ctor public KeyExpiredException(java.lang.String);

8
core/java/android/security/keymaster/KeymasterDefs.java
View File

@@ -83,6 +83,12 @@ public final class KeymasterDefs {
public static final int KM_TAG_ROOT_OF_TRUST = KM_BYTES | 704;
public static final int KM_TAG_UNIQUE_ID = KM_BYTES | 707;
public static final int KM_TAG_ATTESTATION_CHALLENGE = KM_BYTES | 708;
public static final int KM_TAG_ATTESTATION_ID_BRAND = KM_BYTES | 710;
public static final int KM_TAG_ATTESTATION_ID_DEVICE = KM_BYTES | 711;
public static final int KM_TAG_ATTESTATION_ID_PRODUCT = KM_BYTES | 712;
public static final int KM_TAG_ATTESTATION_ID_SERIAL = KM_BYTES | 713;
public static final int KM_TAG_ATTESTATION_ID_IMEI = KM_BYTES | 714;
public static final int KM_TAG_ATTESTATION_ID_MEID = KM_BYTES | 715;
public static final int KM_TAG_ASSOCIATED_DATA = KM_BYTES | 1000;
public static final int KM_TAG_NONCE = KM_BYTES | 1001;
@@ -204,6 +210,7 @@ public final class KeymasterDefs {
public static final int KM_ERROR_INVALID_MAC_LENGTH = -57;
public static final int KM_ERROR_MISSING_MIN_MAC_LENGTH = -58;
public static final int KM_ERROR_UNSUPPORTED_MIN_MAC_LENGTH = -59;
public static final int KM_ERROR_CANNOT_ATTEST_IDS = -66;
public static final int KM_ERROR_UNIMPLEMENTED = -100;
public static final int KM_ERROR_VERSION_MISMATCH = -101;
public static final int KM_ERROR_UNKNOWN_ERROR = -1000;
@@ -249,6 +256,7 @@ public final class KeymasterDefs {
"Caller-provided IV not permitted");
sErrorCodeToString.put(KM_ERROR_INVALID_MAC_LENGTH,
"Invalid MAC or authentication tag length");
sErrorCodeToString.put(KM_ERROR_CANNOT_ATTEST_IDS, "Unable to attest device ids");
sErrorCodeToString.put(KM_ERROR_UNIMPLEMENTED, "Not implemented");
sErrorCodeToString.put(KM_ERROR_UNKNOWN_ERROR, "Unknown error");
}

228
keystore/java/android/security/keystore/AttestationUtils.java Normal file
View File

@@ -0,0 +1,228 @@
/*
* Copyright (C) 2017 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.security.keystore;
import android.Manifest;
import android.annotation.NonNull;
import android.annotation.RequiresPermission;
import android.annotation.SystemApi;
import android.annotation.TestApi;
import android.content.Context;
import android.os.Build;
import android.os.Process;
import android.security.KeyStore;
import android.security.KeyStoreException;
import android.security.keymaster.KeyCharacteristics;
import android.security.keymaster.KeymasterArguments;
import android.security.keymaster.KeymasterCertificateChain;
import android.security.keymaster.KeymasterDefs;
import android.telephony.TelephonyManager;
import android.util.ArraySet;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.nio.charset.StandardCharsets;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.security.spec.RSAKeyGenParameterSpec;
import java.util.Collection;
import java.util.Set;
import java.util.concurrent.atomic.AtomicInteger;
/**
* Utilities for attesting the device's hardware identifiers.
*
* @hide
*/
@SystemApi
@TestApi
public abstract class AttestationUtils {
private static AtomicInteger sSequenceNumber = new AtomicInteger(0);
private AttestationUtils() {
}
/**
* Specifies that the device should attest its serial number. For use with
* {@link #attestDeviceIds}.
*
* @see #attestDeviceIds
*/
public static final int ID_TYPE_SERIAL = 1;
/**
* Specifies that the device should attest its IMEIs. For use with {@link #attestDeviceIds}.
*
* @see #attestDeviceIds
*/
public static final int ID_TYPE_IMEI = 2;
/**
* Specifies that the device should attest its MEIDs. For use with {@link #attestDeviceIds}.
*
* @see #attestDeviceIds
*/
public static final int ID_TYPE_MEID = 3;
/**
* Performs attestation of the device's identifiers. This method returns a certificate chain
* whose first element contains the requested device identifiers in an extension. The device's
* brand, device and product are always also included in the attestation. If the device supports
* attestation in secure hardware, the chain will be rooted at a trustworthy CA key. Otherwise,
* the chain will be rooted at an untrusted certificate. See
* <a href="https://developer.android.com/training/articles/security-key-attestation.html">
* Key Attestation</a> for the format of the certificate extension.
* <p>
* Attestation will only be successful when all of the following are true:
* 1) The device has been set up to support device identifier attestation at the factory.
* 2) The user has not permanently disabled device identifier attestation.
* 3) You have permission to access the device identifiers you are requesting attestation for.
* <p>
* For privacy reasons, you cannot distinguish between (1) and (2). If attestation is
* unsuccessful, the device may not support it in general or the user may have permanently
* disabled it.
* <p>
* The caller must hold {@link android.Manifest.permission#READ_PRIVILEGED_PHONE_STATE}
* permission.
*
* @param context the context to use for retrieving device identifiers.
* @param idTypes the types of device identifiers to attest.
* @param attestationChallenge a blob to include in the certificate alongside the device
* identifiers.
*
* @return a certificate chain containing the requested device identifiers in the first element
*
* @exception SecurityException if you are not permitted to obtain an attestation of the
* device's identifiers.
* @exception DeviceIdAttestationException if the attestation operation fails.
*/
@RequiresPermission(Manifest.permission.READ_PRIVILEGED_PHONE_STATE)
@NonNull public static X509Certificate[] attestDeviceIds(Context context,
@NonNull int[] idTypes, @NonNull byte[] attestationChallenge) throws
DeviceIdAttestationException {
// Check method arguments, retrieve requested device IDs and prepare attestation arguments.
if (idTypes == null) {
throw new NullPointerException("Missing id types");
}
if (attestationChallenge == null) {
throw new NullPointerException("Missing attestation challenge");
}
final KeymasterArguments attestArgs = new KeymasterArguments();
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_CHALLENGE, attestationChallenge);
final Set<Integer> idTypesSet = new ArraySet<>(idTypes.length);
for (int idType : idTypes) {
idTypesSet.add(idType);
}
TelephonyManager telephonyService = null;
if (idTypesSet.contains(ID_TYPE_IMEI) || idTypesSet.contains(ID_TYPE_MEID)) {
telephonyService = (TelephonyManager) context.getSystemService(
Context.TELEPHONY_SERVICE);
if (telephonyService == null) {
throw new DeviceIdAttestationException("Unable to access telephony service");
}
}
for (final Integer idType : idTypesSet) {
switch (idType) {
case ID_TYPE_SERIAL:
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_SERIAL,
Build.getSerial().getBytes(StandardCharsets.UTF_8));
break;
case ID_TYPE_IMEI: {
final String imei = telephonyService.getImei(0);
if (imei == null) {
throw new DeviceIdAttestationException("Unable to retrieve IMEI");
}
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_IMEI,
imei.getBytes(StandardCharsets.UTF_8));
break;
}
case ID_TYPE_MEID: {
final String meid = telephonyService.getDeviceId();
if (meid == null) {
throw new DeviceIdAttestationException("Unable to retrieve MEID");
}
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_MEID,
meid.getBytes(StandardCharsets.UTF_8));
break;
}
default:
throw new IllegalArgumentException("Unknown device ID type " + idType);
}
}
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_BRAND,
Build.BRAND.getBytes(StandardCharsets.UTF_8));
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_DEVICE,
Build.DEVICE.getBytes(StandardCharsets.UTF_8));
attestArgs.addBytes(KeymasterDefs.KM_TAG_ATTESTATION_ID_PRODUCT,
Build.PRODUCT.getBytes(StandardCharsets.UTF_8));
final KeyStore keyStore = KeyStore.getInstance();
final String keyAlias = "android_internal_device_id_attestation-"
+ Process.myPid() + "-" + sSequenceNumber.incrementAndGet();
// Clear any leftover temporary key.
if (!keyStore.delete(keyAlias)) {
throw new DeviceIdAttestationException("Unable to remove temporary key");
}
try {
// Generate a temporary key.
final KeymasterArguments generateArgs = new KeymasterArguments();
generateArgs.addEnum(KeymasterDefs.KM_TAG_PURPOSE, KeymasterDefs.KM_PURPOSE_VERIFY);
generateArgs.addEnum(KeymasterDefs.KM_TAG_ALGORITHM, KeymasterDefs.KM_ALGORITHM_RSA);
generateArgs.addEnum(KeymasterDefs.KM_TAG_PADDING, KeymasterDefs.KM_PAD_NONE);
generateArgs.addEnum(KeymasterDefs.KM_TAG_DIGEST, KeymasterDefs.KM_DIGEST_NONE);
generateArgs.addBoolean(KeymasterDefs.KM_TAG_NO_AUTH_REQUIRED);
generateArgs.addUnsignedInt(KeymasterDefs.KM_TAG_KEY_SIZE, 2048);
generateArgs.addUnsignedLong(KeymasterDefs.KM_TAG_RSA_PUBLIC_EXPONENT,
RSAKeyGenParameterSpec.F4);
int errorCode = keyStore.generateKey(keyAlias, generateArgs, null, 0,
new KeyCharacteristics());
if (errorCode != KeyStore.NO_ERROR) {
throw new DeviceIdAttestationException("Unable to create temporary key",
KeyStore.getKeyStoreException(errorCode));
}
// Perform attestation.
final KeymasterCertificateChain outChain = new KeymasterCertificateChain();
errorCode = keyStore.attestKey(keyAlias, attestArgs, outChain);
if (errorCode != KeyStore.NO_ERROR) {
throw new DeviceIdAttestationException("Unable to perform attestation",
KeyStore.getKeyStoreException(errorCode));
}
// Extract certificate chain.
final Collection<byte[]> rawChain = outChain.getCertificates();
if (rawChain.size() < 2) {
throw new DeviceIdAttestationException("Attestation certificate chain contained "
+ rawChain.size() + " entries. At least two are required.");
}
final ByteArrayOutputStream concatenatedRawChain = new ByteArrayOutputStream();
try {
for (final byte[] cert : rawChain) {
concatenatedRawChain.write(cert);
}
return CertificateFactory.getInstance("X.509").generateCertificates(
new ByteArrayInputStream(concatenatedRawChain.toByteArray()))
.toArray(new X509Certificate[0]);
} catch (Exception e) {
throw new DeviceIdAttestationException("Unable to construct certificate chain", e);
}
} finally {
// Remove temporary key.
keyStore.delete(keyAlias);
}
}
}

45
keystore/java/android/security/keystore/DeviceIdAttestationException.java Normal file
View File

@@ -0,0 +1,45 @@
/*
* Copyright (C) 2017 The Android Open Source Project
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package android.security.keystore;
/**
* Thrown when {@link AttestationUtils} is unable to attest the given device ids.
*
* @hide
*/
public class DeviceIdAttestationException extends Exception {
/**
* Constructs a new {@code DeviceIdAttestationException} with the current stack trace and the
* specified detail message.
*
* @param detailMessage the detail message for this exception.
*/
public DeviceIdAttestationException(String detailMessage) {
super(detailMessage);
}
/**
* Constructs a new {@code DeviceIdAttestationException} with the current stack trace, the
* specified detail message and the specified cause.
*
* @param message the detail message for this exception.
* @param cause the cause of this exception, may be {@code null}.
*/
public DeviceIdAttestationException(String message, Throwable cause) {
super(message, cause);
}
}