c239db4114
This change adds support for specifying that an AuthKey should be replaced if it's going to expire within a certain amount of time configurable by the application. This also adds a way for the application to learn about the expiration time of currently configured AuthKeys. Combined these two changes allow an application to get a perfect picture of which AuthKeys are available, when they expire, and allows the application to refresh AuthKeys well ahead of expiration dates. Also remove checking storeStaticAuthenticationDataWithExpiration() is only available on HAL version 3 and later (feature version 202101 and later). This works on any HAL version. Bug: 241912421 Test: atest VtsHalIdentityTargetTest Test: atest android.security.identity.cts Change-Id: Ic8274088035c31f73ad61645ee5e0281b3460837
88 lines
3 KiB
C++
88 lines
3 KiB
C++
/*
|
|
* Copyright (c) 2019, The Android Open Source Project
|
|
*
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
* you may not use this file except in compliance with the License.
|
|
* You may obtain a copy of the License at
|
|
*
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
*
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
* See the License for the specific language governing permissions and
|
|
* limitations under the License.
|
|
*/
|
|
|
|
#ifndef SYSTEM_SECURITY_WRITABLE_CREDENTIAL_H_
|
|
#define SYSTEM_SECURITY_WRITABLE_CREDENTIAL_H_
|
|
|
|
#include <string>
|
|
#include <vector>
|
|
|
|
#include <android/security/identity/BnWritableCredential.h>
|
|
|
|
#include <android/hardware/identity/IIdentityCredentialStore.h>
|
|
|
|
#include "Credential.h"
|
|
|
|
namespace android {
|
|
namespace security {
|
|
namespace identity {
|
|
|
|
using ::android::binder::Status;
|
|
using ::android::hardware::identity::HardwareInformation;
|
|
using ::android::hardware::identity::IWritableIdentityCredential;
|
|
using ::std::string;
|
|
using ::std::vector;
|
|
|
|
class WritableCredential : public BnWritableCredential {
|
|
public:
|
|
WritableCredential(const string& dataPath, const string& credentialName, const string& docType,
|
|
bool isUpdate, HardwareInformation hwInfo,
|
|
sp<IWritableIdentityCredential> halBinder);
|
|
~WritableCredential();
|
|
|
|
// Used when updating a credential
|
|
void setAttestationCertificate(const vector<uint8_t>& attestationCertificate);
|
|
void setAvailableAuthenticationKeys(int keyCount, int maxUsesPerKey,
|
|
int64_t minValidTimeMillis);
|
|
|
|
// Used by Credential::update()
|
|
void setCredentialToReloadWhenUpdated(sp<Credential> credential);
|
|
|
|
// IWritableCredential overrides
|
|
Status getCredentialKeyCertificateChain(const vector<uint8_t>& challenge,
|
|
vector<uint8_t>* _aidl_return) override;
|
|
|
|
Status personalize(const vector<AccessControlProfileParcel>& accessControlProfiles,
|
|
const vector<EntryNamespaceParcel>& entryNamespaces, int64_t secureUserId,
|
|
vector<uint8_t>* _aidl_return) override;
|
|
|
|
private:
|
|
string dataPath_;
|
|
string credentialName_;
|
|
string docType_;
|
|
bool isUpdate_;
|
|
HardwareInformation hwInfo_;
|
|
sp<IWritableIdentityCredential> halBinder_;
|
|
|
|
vector<uint8_t> attestationCertificate_;
|
|
int keyCount_ = 0;
|
|
int maxUsesPerKey_ = 1;
|
|
int64_t minValidTimeMillis_ = 0;
|
|
|
|
sp<Credential> credentialToReloadWhenUpdated_;
|
|
|
|
ssize_t calcExpectedProofOfProvisioningSize(
|
|
const vector<AccessControlProfileParcel>& accessControlProfiles,
|
|
const vector<EntryNamespaceParcel>& entryNamespaces);
|
|
|
|
Status ensureAttestationCertificateExists(const vector<uint8_t>& challenge);
|
|
};
|
|
|
|
} // namespace identity
|
|
} // namespace security
|
|
} // namespace android
|
|
|
|
#endif // SYSTEM_SECURITY_WRITABLE_CREDENTIAL_H_
|