Device Check - Securing your App’s Communication

In this talk we take a closer look at the DeviceCheck framework and the services it provides to make our apps and backend services more resilient against unauthorised use. We will compare device identification and app attestation and show how we can validate the integrity of our app.

The DeviceCheck Framework has been around since iOS11 but nobody has ever really heard about it. At least not me… I stumbled opon this when playing around with some new Firebase Service. They enforce their own version of this called AppCheck for some services by now. So I wanted to find out how it works and dug deeper.

In this talk I take a look at the two services the framework provides: DeviceIdentification and AppAttestation. I will show client and server implementation for iOS and Vapor and show how to make your network communication more secure.

It’s not a silver bullet, but an alternative or addition to certificate pinning and another tool in our iOS Dev tool belt.

Transcript

1. Device Check Securing your App’s Communication
2. Device Check
3. Device Check Device Identification
4. Device Check Device Identification App Attest
5. Device Check Framework Device Identification App Attest
6. Device Check Framework Device Identification Identify devices without revealing personally identifiable information App Attest
7. Device Check Framework Device Identification Identify devices without revealing personally identifiable information App Attest Verify the integrity of your app
8. Device Check Framework Device Identification Identify devices without revealing personally identifiable information App Attest Verify the integrity of your app App Check Firebase Service
9. Why?
10. Why?
11. Why?
12. Device Identification
13. Device Identification 00 01 11 10 W W D C 2017
14. Device Identification Two bits as device state stored by Apple 00 01 11 10 W W D C 2017
15. Device Identification Two bits as device state stored by Apple Per device, per developer 00 01 11 10 W W D C 2017
16. Device Identification Two bits as device state stored by Apple Per device, per developer Persistent across device resets 00 01 11 10 W W D C 2017
17. Device Identification Two bits as device state stored by Apple Per device, per developer Persistent across device resets Query 00 01 11 10 W W D C 2017
18. Device Identification Two bits as device state stored by Apple Per device, per developer Persistent across device resets Query Update 00 01 11 10 W W D C 2017
19. Device Identification Two bits as device state stored by Apple Per device, per developer Persistent across device resets Query Update Validate Device 00 01 11 10 W W D C 2017
20. Device Check Device Identification DeviceCheck Service ! Your Service ! Your App
21. Device Check Device Identification DeviceCheck Service ! Your Service ! Your App
22. Device Check Device Identification DeviceCheck Service ! Your Service ! Device Token Your App
23. Device Check Device Identification DeviceCheck Service ! Your Service ! Device Token Request incl. DeviceToken Your App
24. Device Check Device Identification DeviceCheck Service ! Your Service ! Device Token Request incl. DeviceToken Your App Token Validation Request
25. Device Check Device Identification DeviceCheck Service ! Your Service ! Device Token Request incl. DeviceToken Your App Token Validation Request 200 OK
26. Device Check Device Identification DeviceCheck Service ! Your Service ! Device Token Request incl. DeviceToken Your App Token Validation Request 200 OK
27. Device Check Device Identification iO S
28. Device Check Device Identification import DeviceCheck iO S
29. Device Check Device Identification import DeviceCheck iO S guard DCDevice.current.isSupported else { // fail gracefully return }
30. Device Check Device Identification import DeviceCheck iO S let token = try await DCDevice.current.generateToken() guard DCDevice.current.isSupported else { // fail gracefully return }
31. Device Check Device Identification import DeviceCheck iO S let token = try await DCDevice.current.generateToken() guard DCDevice.current.isSupported else { // fail gracefully return } var request = URLRequest(url: url) request.setValue(apiKey, forHTTPHeaderField: "apiKey") request.setValue(token.base64EncodedString(), forHTTPHeaderField: "deviceToken")
32. Device Check Device Identification Vapor
33. Device Check Device Identification Vapor import Vapor
34. Device Check Device Identification public func configure(_ app: Application) async throws { app.middleware.use(TokenAuthenticator()) … } Vapor import Vapor
35. struct TokenAuthenticator: AsyncRequestAuthenticator { func authenticate(request: Vapor.Request) async throws { } } Device Check Device Identification public func configure(_ app: Application) async throws { app.middleware.use(TokenAuthenticator()) … } Vapor import Vapor
36. struct TokenAuthenticator: AsyncRequestAuthenticator { func authenticate(request: Vapor.Request) async throws { } } Device Check Device Identification public func configure(_ app: Application) async throws { app.middleware.use(TokenAuthenticator()) … } Vapor guard request.hasValidApiToken else { throw Abort(.unauthorized) } import Vapor
37. struct TokenAuthenticator: AsyncRequestAuthenticator { func authenticate(request: Vapor.Request) async throws { } } Device Check Device Identification public func configure(_ app: Application) async throws { app.middleware.use(TokenAuthenticator()) … } Vapor guard request.hasValidApiToken else { throw Abort(.unauthorized) } import Vapor guard try await request.hasValidDeviceToken else { throw Abort(.unauthorized) }
38. Device Check Device Identification Vapor
39. Device Check Device Identification extension Vapor.Request { } Vapor
40. Device Check Device Identification extension Vapor.Request { } Vapor var hasValidApiToken: Bool { headers.first(name: "apiKey") == "HighlySecretAPIKey" }
41. Device Check Device Identification extension Vapor.Request { } Vapor var hasValidApiToken: Bool { headers.first(name: "apiKey") == "HighlySecretAPIKey" } var hasValidDeviceToken: Bool { get async throws { guard let deviceToken = headers.first(name: "deviceToken") else { return false } return try await validateToken(deviceToken) } }
42. Device Check Device Identification Vapor
43. Device Check Device Identification Vapor func validateToken(_ token: String) async throws -> Bool { }
44. Device Check Device Identification Vapor func validateToken(_ token: String) async throws -> Bool { } let jwtToken = try await generateJWT()
45. Device Check Device Identification Vapor func validateToken(_ token: String) async throws -> Bool { } let jwtToken = try await generateJWT() let response = try await client.post(„https://api.development.devicecheck.apple.com/v1/ validate_device_token") { req in }
46. Device Check Device Identification Vapor func validateToken(_ token: String) async throws -> Bool { } let jwtToken = try await generateJWT() let response = try await client.post(„https://api.development.devicecheck.apple.com/v1/ validate_device_token") { req in } try req.content.encode(DeviceValidationRequest(deviceToken: token)) req.headers.add(name: "Authorization", value: "Bearer \(jwtToken)")
47. Device Check Device Identification Vapor func validateToken(_ token: String) async throws -> Bool { } let jwtToken = try await generateJWT() return response.status == .ok let response = try await client.post(„https://api.development.devicecheck.apple.com/v1/ validate_device_token") { req in } try req.content.encode(DeviceValidationRequest(deviceToken: token)) req.headers.add(name: "Authorization", value: "Bearer \(jwtToken)")
52. Device Identification Usecases W W D C 2017
53. App Attestation W W D C 2021
54. App Attestation Establishing your app’s integrity W W D C 2021
55. App Attestation Establishing your app’s integrity Ensure that requests your server receives come from legitimate instances of your app. W W D C 2021
56. Device Check App Attest Your App Secure Enclave Device Check
57. Device Check App Attest Your App Secure Enclave Device Check Generate Key
58. Device Check App Attest Your App Secure Enclave ! Device Check Generate Key
59. Device Check App Attest Your App Secure Enclave !! Device Check Generate Key
60. Device Check App Attest Your App Secure Enclave !! KeyId Device Check Generate Key
61. Device Check App Attest Your App Keychain
62. Device Check App Attest Your App Keychain Persist KeyId
63. Device Check App Attest iO S
64. Device Check App Attest iO S import DeviceCheck
65. Device Check App Attest private func generateKey() async throws { } iO S import DeviceCheck
66. Device Check App Attest private func generateKey() async throws { } iO S guard DCAppAttestService.shared.isSupported else { // Fail gracefully return } import DeviceCheck
67. Device Check App Attest private func generateKey() async throws { } iO S let keyId = try await DCAppAttestService.shared.generateKey() guard DCAppAttestService.shared.isSupported else { // Fail gracefully return } import DeviceCheck
68. Device Check App Attest private func generateKey() async throws { } iO S let keyId = try await DCAppAttestService.shared.generateKey() guard DCAppAttestService.shared.isSupported else { // Fail gracefully return } keychain.attestationKeyId = keyId import DeviceCheck
69. Device Check App Attest Your App App Attest Service ! Your Service !
70. Device Check App Attest Your App App Attest Service ! Your Service ! Challenge Request
71. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge Challenge Request
72. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Challenge Request
73. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" Challenge Request
74. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" # Challenge Request
75. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" # Challenge Request # " Post Attestation
76. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" Validate and Persist Attestation # Challenge Request # " Post Attestation
78. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" Validate and Persist Attestation # Challenge Request # " Post Attestation
79. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" Validate and Persist Attestation # Challenge Request # " Post Attestation
80. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" Validate and Persist Attestation # Challenge Request # " Post Attestation
81. Device Check App Attest Your App App Attest Service ! Your Service ! Persist Challenge " Attest Key !" Validate and Persist Attestation # Challenge Request # " Post Attestation
82. Device Check App Attest iO S
83. Device Check App Attest let keyId = keychain.attestationKeyId iO S
84. Device Check App Attest let keyId = keychain.attestationKeyId iO S let challenge = await fetchChallenge()
85. Device Check App Attest let keyId = keychain.attestationKeyId iO S let hash = Data(SHA256.hash(data: challenge)) let challenge = await fetchChallenge()
86. Device Check App Attest let keyId = keychain.attestationKeyId iO S let attestation = try await DCAppAttestService.shared.attestKey(keyId, clientDataHash: hash) let hash = Data(SHA256.hash(data: challenge)) let challenge = await fetchChallenge()
87. Device Check App Attest Vapor
88. Device Check App Attest Vapor import Crypto
89. Device Check App Attest Vapor import Crypto var challengeStorage: [UUID: Data] = [:]
90. Device Check App Attest Vapor import Crypto let challenge = Data(AES.GCM.Nonce()) var challengeStorage: [UUID: Data] = [:]
91. Device Check App Attest Vapor import Crypto let challengeID = UUID() challengeStorage[challengeID] = challenge let challenge = Data(AES.GCM.Nonce()) var challengeStorage: [UUID: Data] = [:]
92. Device Check App Attest Vapor
93. Device Check App Attest Vapor
94. Device Check App Attest Vapor
95. Device Check App Attest Vapor
96. Device Check App Attest Vapor
97. Device Check App Attest Vapor
98. Device Check App Attest Vapor import AppAttest
99. Device Check App Attest Vapor import AppAttest let attestation: Data = ... let keyID: Data = ... let challengeID: UUID = ...
100. Device Check App Attest Vapor import AppAttest let attestation: Data = ... let keyID: Data = ... let challengeID: UUID = ... let challenge = challengeStorage[challengeID]
101. Device Check App Attest Vapor import AppAttest let attestation: Data = ... let keyID: Data = ... let challengeID: UUID = ... let challenge = challengeStorage[challengeID] let request = AttestationRequest(attestation: attestation, keyID: keyID) let appID = AppID(teamID: "83Z139DVZ2", bundleID: "com.example.myapp")
102. Device Check App Attest Vapor import AppAttest let attestation: Data = ... let keyID: Data = ... let challengeID: UUID = ... let challenge = challengeStorage[challengeID] let request = AttestationRequest(attestation: attestation, keyID: keyID) let appID = AppID(teamID: "83Z139DVZ2", bundleID: "com.example.myapp") let result = try AppAttest.verifyAttestation(challenge: challenge, request: request, appID: appID) attestationStorage[keyID] = result
103. Attestation vs. Assertion
104. Attestation vs. Assertion After successfully verifying a key’s attestation, your server can require the app to assert its legitimacy for any or all future server requests.
105. Device Check Assertions Your App Your Service ! App Attest Service
106. Device Check Assertions Your App App Attest Service ! Your Service !
107. Device Check Assertions Your App App Attest Service ! Your Service !
108. Device Check Assertions Your App App Attest Service ! Your Service ! Challenge Request
109. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge Challenge Request
110. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Challenge Request
111. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Generate Assertion !" Challenge Request
112. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Generate Assertion !" # Challenge Request
113. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Generate Assertion !" # Challenge Request # " Request including Assertion
114. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Generate Assertion !" # Challenge Request # " Request including Assertion
115. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Generate Assertion !" Validate and Persist Assertion # Challenge Request # " Request including Assertion
116. Device Check Assertions Your App App Attest Service ! Your Service ! Persist Challenge " Generate Assertion !" Validate and Persist Assertion # Challenge Request # " Request including Assertion
117. Device Check Assertions iO S
118. Device Check Assertions iO S let keyId = keychain.attestationKeyId let challenge = await fetchChallenge()
119. Device Check Assertions iO S let keyId = keychain.attestationKeyId let challenge = await fetchChallenge() let request = [ "action": "getGameLevel", "levelId": "1234", "challenge": challenge ]
120. Device Check Assertions iO S let keyId = keychain.attestationKeyId let challenge = await fetchChallenge() let request = [ "action": "getGameLevel", "levelId": "1234", "challenge": challenge ] guard let clientData = try? JSONEncoder().encode(request) else { return } let hash = Data(SHA256.hash(data: clientData))
121. Device Check Assertions iO S let assertion = try await DCAppAttestService.shared.generateAssertion(keyId, clientDataHash: hash) let keyId = keychain.attestationKeyId let challenge = await fetchChallenge() let request = [ "action": "getGameLevel", "levelId": "1234", "challenge": challenge ] guard let clientData = try? JSONEncoder().encode(request) else { return } let hash = Data(SHA256.hash(data: clientData))
122. Device Check Assertion Vapor
123. Device Check Assertion Vapor let assertion: Data = ... let keyID: Data = ... let challengeID: UUID = ...
124. Device Check Assertion Vapor let assertion: Data = ... let keyID: Data = ... let challengeID: UUID = ... let challenge = challengeStorage[challengeID] let attestation = attestationStorage[keyID] let previousAssertion = assertionStorage[keyID]
125. Device Check Assertion Vapor let assertion: Data = ... let keyID: Data = ... let challengeID: UUID = ... let challenge = challengeStorage[challengeID] let attestation = attestationStorage[keyID] let previousAssertion = assertionStorage[keyID] let request = AppAttest.AssertionRequest( assertion: assertion, clientData: clientData, challenge: challenge )
126. Device Check Assertion Vapor let assertion: Data = ... let keyID: Data = ... let challengeID: UUID = ... let challenge = challengeStorage[challengeID] let attestation = attestationStorage[keyID] let previousAssertion = assertionStorage[keyID] let request = AppAttest.AssertionRequest( assertion: assertion, clientData: clientData, challenge: challenge ) let appID = AppAttest.AppID( teamID: "99ED34GJ9X", bundleID: "com.peterkurzok.AppAttestationClient" )
127. Device Check Assertion Vapor let assertion: Data = ... let keyID: Data = ... let challengeID: UUID = ... let result = try AppAttest.verifyAssertion( challenge: challenge, request: request, previousResult: previousAssertion, publicKey: attestation.publicKey, appID: appID ) appAttestStorage.store(assertion: result, for: keyID) let challenge = challengeStorage[challengeID] let attestation = attestationStorage[keyID] let previousAssertion = assertionStorage[keyID] let request = AppAttest.AssertionRequest( assertion: assertion, clientData: clientData, challenge: challenge ) let appID = AppAttest.AppID( teamID: "99ED34GJ9X", bundleID: "com.peterkurzok.AppAttestationClient" )
131. Device Check When to use App Attest Your App Secure Enclave App Attest Your Service ! ! !!
132. Device Check When to use App Attest Your App Secure Enclave App Attest Your Service ! ! !! ! Establish sessions
133. Device Check When to use App Attest Your App Secure Enclave App Attest Your Service ! ! !! ! Establish sessions ! State synchronisation
134. Device Check When to use App Attest Your App Secure Enclave App Attest Your Service ! ! !! ! Establish sessions ! State synchronisation ! Valuable state transitions
135. Device Check When to use App Attest Your App Secure Enclave App Attest Your Service ! ! !! ! Establish sessions ! State synchronisation ! Valuable state transitions ! Real time operations
136. Device Check When to use App Attest Your App Secure Enclave App Attest Your Service ! ! !! ! Establish sessions ! State synchronisation ! Valuable state transitions ! Real time operations ! Low latency operations
137. Device Check Gotchas ⚠ Attestation protects your tokens not your payload
138. Device Check Gotchas ⚠ If your server fails to verify the attestation object, discard the key identifier!
139. Device Check Gotchas
140. Conclusion ✅ Prevents replay attacks or bot abuse ⚠ Protects your tokens not your payload # This is not the silver bullet ⚒ Another tool in your tool belt % Use it wisely (not for every request)
141. Resources Where to go from here