Protect sensitive data using EncryptifyAndroid

Matt Bishop

Get the source on Github

Applications that deal with sensitive data (e.g. data covered by HIPAA, corporate secrets, etc) can increase the level of protection they provide by using the capabilities of the Android Device Administration API. Once the user has given your application Admin status, you have significant control over the devices various security features, including:

  • Length and composition of the user’s device password
  • How frequently the password needs to be changed
  • When the device locks
  • How many times a password can be entered incorrectly
  • Performing remote wipes of all data from a lost or stolen device
  • Require encryption of the storage area to view or handle your sensitive data.

Cloning the library project

git clone https://github.com/bishopmatthew/EncryptifyAndroid.git the repository to the directory you’re working from. In Eclipse, Import -> Android -> Existing Android Code Into Workspace. Check the box next to “DeviceEncryptify” and click finish.

For whichever application you want to use the library with, right click on the application name in Package Explore and select Properties -> Android -> (under “Library”) Add -> and select “DeviceEncryptify”.

Adding DeviceEncryptifyActivity to manifest

You’ll need to add this activity and the DeviceAdminReceiver to your manifest. In the “Application” tag, add

Running the encryption check

Simply call EncryptifyAndroid.verifyEncryption(activity); in the onCreate() method of any activities that can receive intents (including your main activity). If we detect that the device is not encrypted, another activity will start that walks the user through the process of encrypting the device. After the device has been encrypted, the user will be able to use your app normally. But now your data is protected!

Extending PerformEncryptionActivity and EADeviceAdminReceiver

If you require further control over your user’s security settings, you can add EADeviceAdminReceiver to your activity manifest:

You can control which policies affect your app by adding / removing them from /xml/device_admin_sample. You can then use the method EncryptifyAndroid.enableAdmin(context) to get the user to grant admin status to your app. Then you’ll extend the methods in EADeviceAdminReceiver to do the necessary checks. For example, if you want to wipe all data from your app if the user disables your applications admin status (and thus its ability to ensure that sensitive data is protected), override onDisableRequested(Context context, Intent intent) to tell them that you’re going to wipe the data, and in onDisabled(Context context, Intent intent) delete any files stored in your applications /data directory.

More information can be found in the Android developer document for the Device Administration API