AI-generated Key Takeaways
-
Android provides various device signals to assess device security posture in a Zero Trust model.
-
Device Trust from Android Enterprise is an API solution offering these signals for evaluating Android device security.
-
These signals can be used on devices with work profiles on company-owned or personally-owned devices, and some signals are also available on unmanaged devices.
Android provides a variety of device signals that administrators can use to determine the security posture of a device. In a Zero Trust security model, these signals are used to assess whether a device should be allowed to access corporate information.
1 With user consent
2 Work profile only
3 Access limited to work profile information
Retrieve Mainline version
A Trust broker can access the PackageInfo
for the com.google.android.modulemetadata
module and retrieve from there the versionName
:
private
fun
mainlineVersion
(
context
:
Context
):
String?
{
val
moduleProvider
=
"com.google.android.modulemetadata"
return
try
{
val
pm
=
context
.
packageManager
val
packageInfo
=
pm
.
getPackageInfo
(
moduleProvider
,
0
)
packageInfo
.
versionName
}
catch
(
e
:
PackageManager
.
NameNotFoundException
)
{
null
}
}
You can parse the returned string into a Date
object using the SimpleDateFormat
class:
private
val
VERSION_NAME_DATE_PATTERNS
=
Arrays
.
asList
(
"yyyy-MM-dd"
,
"yyyy-MM"
)
private
fun
parseDateFromVersionName
(
text
:
String
):
Date?
{
for
(
pattern
in
VERSION_NAME_DATE_PATTERNS
)
{
try
{
val
simpleDateFormat
=
SimpleDateFormat
(
pattern
,
Locale
.
getDefault
()
)
simpleDateFormat
.
timeZone
=
TimeZone
.
getDefault
()
return
simpleDateFormat
.
parse
(
text
)
}
catch
(
e
:
ParseException
)
{
// ignore and try next pattern
}
}
return
null
}
Remember that for Android 11 and newer you have to add a query declaration in
you AndroidManifest.xml
file to satisfy Android's package visibility
:
<manifest package="com.example.game"> <queries> <package android:name="com.google.android.modulemetadata" /> </queries> ... </manifest>
Retrieve management state
A Trust broker can use these methods to verify if a device is under management mode and which management mode is active.
Check for device management
Use getActiveAdmins()
to check if a device is under management. If this
method returns null
the device is unmanaged.
Check for fully managed device
Use isDeviceOwnerApp()
to check if the device is fully managed.
Check for work profile on a company-owned device
Use isOrganizationOwnedDeviceWithManagedProfile()
to check if a device
is using a work profile management mode for corporate-owned devices
Check for work profile on a personally-owned device
Use isProfileOwnerApp()
to check if an app is running inside a work
profile and verify that isOrganizationOwnedDeviceWithManagedProfile()
returns false
.
