Lockscreen and authentication improvements in Android 11 -

We may earn money or products from the companies mentioned in this post.

Posted by Haining Chen, Vishwath Mohan, Kevin Chyn and Liz Louis, Android Security Team

As phones become faster and smarter, they play increasingly important roles in “peoples lives”, functioning as our extended recollection, our connection to the world at large, and often the primary interface for communication with friends, kinfolk, and wider societies. It is only natural that as part of this evolution, we’ve come to entrust our telephones with our most private knowledge, and in many ways treat them as increases of our digital and physical names.

This cartel is paramount to the Android Security unit. The squad focuses on ensuring that Android designs respect the privacy and sensitivity of user data. A fundamental side of the present working centers around the lockscreen, which acts as the proverbial breast opening to our manoeuvres. After all, the lockscreen ensures that exclusively the intended user( s) of a manoeuvre can access their private data.

This blog pole delineates recent increases around how useds interact with the lockscreen on Android manoeuvres and more generally with authentication. In special, we focus on two categories of authentication that present both stupendou capability as well as potentially prodigiou likelihood if not designed well: biometrics and environmental modalities.

The tiered authentication sit

Before getting into the details of lockscreen and authentication progress, we firstly want to establish some context to help relate these improvements to each other. A good way to imagine these changes is to fit them into the framework of the tiered authentication model, a conceptual classification of all the different authentication modalities on Android, how they relate to each other, and how they are constrained based on this classification.

The framework itself is fairly simple, classifying authentication modalities into three barrels of weakening levels of security and commensurately increasing limitations. The primary rank is the least constrained in the sense that users only need to re-enter a primary modality under certain situations( for example, after each boot or every 72 hours) when using its capability. The secondary and tertiary ranks are more held because they cannot be set up and used without having a primary modality enrolled first and the government has more limitations further restricting their capabilities.

Primary Tier – Knowledge Factor: The first rank consists of modalities that rely on knowledge influences, or something the user knows, for example, a PIN, pattern, or password. Good high-entropy knowledge ingredients, such as complex passwords that are hard to guess, offering the highest potential guarantee of name.

Knowledge influences are especially helpful on Android becauses inventions volunteer hardware backed brute-force protection with exponential-backoff, representing Android maneuvers thwart intruders from frequently suspecting a PIN, motif, or password by having hardware backed timeouts after every 5 incorrect struggles. Knowledge factors likewise discuss additional benefits to all users that use them, such as File Based Encryption( FBE) and encrypted device backup.

Secondary Tier – Biometrics: The second tier consists primarily of biometrics, or something the user is. Face or fingerprint based authentications are examples of secondary authentication modalities. Biometrics offer a more accessible but potentially less secure way of substantiating your identity with a design.

We will delve into Android biometrics in the next section.

The Tertiary Tier – Environmental: The last tier includes modalities that rely on something the user has. This could either has become a physical sign, such as with Smart Lock’s Trusted Devices where a phone can be opened when working together with a safelisted bluetooth invention. Or it could be something inherent to the physical environment around the device, such as with Smart Lock’s Trusted Places where a phone can be opened when it is taken to a safelisted orientation.

Betterments to tertiary authentication

While both Trusted Places and Trusted Devices( and tertiary modalities in general) present accessible ways and means to get access to the contents of your invention, the fundamental question they share is that they are ultimately a poverty-stricken agent for user identity. For example, an attacker could unlock a misplaced phone that uses Trusted Place simply by driving it past the user’s home, or with moderate amount of exertion, spoofing a GPS signal consuming off-the-shelf Software Defined Radios and some mild scripting. Similarly with Trusted Device, access to a safelisted bluetooth maneuver also sacrifices access to all data on the user’s phone.

Because of this, a great improvement has been made to the environmental tier in Android 10. The Tertiary tier was switched from an active unlock mechanism into an extending open mechanism instead. In this new mode, a tertiary tier modality can no longer unlock a locked invention. Instead, if the device is first opened squandering either a primary or secondary modality, it can continue to keep it in the unlocked state for a maximum of four hours.

A closer look at Android biometrics

Biometric implementations come with a wide variety of security characteristics, so we rely on the following two key factors to determine the security of a particular implementation:

Architectural security: The resilience of a biometric pipeline against grain or pulpit jeopardize. A grapevine is considered secure if seed and programme endangers don’t grant the ability to either read raw biometric data, or inject synthetic data into the pipeline to affect an authentication decision.

Spoofability: Is measured using the Spoof Acceptance Rate( SAR ). SAR is a metric first introduced in Android P, and is intended to measure how resilient a biometric is against a dedicated intruder. Read more about SAR and its evaluation in Measuring Biometric Unlock Security.

We use these two factors to group biometrics into one of three different categories in decreasing order of security:

Class 3( formerly Strong)

Class 2( formerly Weak)

Class 1( formerly Convenience)

Each class comes with an associated placed of limitations that aim to balance their ease of use with the level of safety they offer.

These constraints reflect the length of time before a biometric precipitates back to primary authentication, and the allowed lotion amalgamation. For example, a Class 3 biometric enjoys a long time timeouts and offers all integration options for apps, while a Class 1 biometric has the shortest timeouts and no options for app integration. You can see a summary of the details in the table below, or the full details in the Android Android Compatibility Definition Document( CDD ).

1 App integration implies uncovering an API to apps( e.g ., via integration with BiometricPrompt/ BiometricManager, androidx.biometric, or FIDO2 APIs)

2 Keystore consolidation entails integrating Keystore, e.g ., to exhaust app auth-bound keys

Benefits and caveats

Biometrics accommodate accessibility to useds while maintaining a high level of security. Because users need to set up a primary authentication modality when using biometrics, it helps boost the lockscreen following( we find an average of 20% higher lockscreen support on manoeuvres that present biometrics versus those that do not ). This allows more users to benefit from the security pieces that the lockscreen requires: barriers unauthorized access to sensitive user data and likewise consults other advantages of a primary authentication modality to these users, such as encrypted backups. Lastly, biometrics also help reduce shoulder surfing onslaughts in which an attacker tries to reproduce a PIN, decoration, or password after mentioning a customer entering the credential.

However, it is important that users understand the trade-offs involved with the use of biometrics. Primary among these is that no biometric system is foolproof. This is true not just on Android, but across all operating systems, form-factors, and technologies. For example, a face biometric implementation might be fooled by family members who resemble the user or a 3D mask of the user. A fingerprint biometric implementation could potentially be bypassed by a spoof made from latent fingerprints of the subscribers. Although anti-spoofing or Presentation Attack Detection( PAD) technologies have been actively developed to mitigate such spoofing affects, they are mitigations , not avoidances.

One effort that Android has made to mitigate the potential risk of using biometrics is the lockdown mode introduced in Android P. Android users can use this peculiarity to temporarily disable biometrics, along with Smart Lock( for example, Trusted Places and Trusted Devices) as well as notifications on the lock screen, when they feel the it is necessary do so.

To use the lockdown mode, customers first need to set up a primary authentication modality and then enable it in lays. The precise position where the lockdown procedure can be enabled varies by device mannequins, and on a Google Pixel 4 design it is under Settings> Display> Lock screen> Show lockdown option. Once enabled, users can trigger the lockdown procedure by holding the influence button and then clicking the Lockdown icon on the influence menu. A invention in lockdown procedure will return to the non-lockdown state after a primary authentication modality( such as a PIN, pattern, or password) is used to unlock the manoeuvre.

BiometricPrompt – New APIs

In dictate for makes to benefit from the security guarantee to be submitted by Android biometrics and to easily integrate biometric authentication into their apps to better protect feelings user data, we introduced the BiometricPrompt APIs in Android P.

The report contains various benefits of using the BiometricPrompt APIs. Most importantly, these APIs tolerate app makes to target biometrics in a modality-agnostic way across different Android machines( that is, BiometricPrompt can be used as a single integration item for various biometric modalities reinforced on maneuvers ), while controlling the security guarantees that the authentication needs to provide( such as requiring Class 3 or Class 2 biometrics, with design credential as a fallback ). In this behavior, it helps protect app data with a second layer of securities( in addition to the lockscreen) and in turn respects the sensitivity of user data. Furthermore, BiometricPrompt adds a prolonged UI with customization options for certain information( for example, designation and description ), provide a consistent user event across biometric modalities and across Android maneuvers.

As shown in the following architecture sketch, apps can integrate with biometrics on Android manoeuvres through either the framework API or the supporting library( that is, androidx.biometric for backward conformity ). One thing to note is that FingerprintManager is deprecated because makes are encouraged to migrate to BiometricPrompt for modality-agnostic authentications. Improvements to BiometricPrompt

Android 10 introduced the BiometricManager class that developers can use to query the availability of biometric authentication and included fingerprint and face authentication integration for BiometricPrompt.

In Android 11, we feed brand-new boasts such as the BiometricManager.Authenticators interface which allows developers to specify the authentication types accepted by their apps, as well as added support for auth-per-use keys within the BiometricPrompt class.

More items was located in the Android 11 preview and Android Biometrics documentation. Read more about BiometricPrompt API usage in our blog post Using BiometricPrompt with CryptoObject: How and Why and our codelab Login with Biometrics on Android.