Merge "Biometric time-based resetLockout for multi-biometric devices" into sc-dev am: f8ec6f3881 (6303bb31) · Commits · e / os / android_frameworks_base

core/java/android/hardware/biometrics/BiometricManager.java

+31 −0

Original line number	Diff line number	Diff line
		@@ -29,6 +29,7 @@ import android.annotation.SystemApi;
		import android.annotation.SystemService;
		import android.annotation.TestApi;
		import android.content.Context;
		import android.os.IBinder;
		import android.os.RemoteException;
		import android.security.keystore.KeyProperties;
		import android.util.Slog;
		@@ -409,6 +410,36 @@ public class BiometricManager {
		}
		}

		/**
		* Requests all other biometric sensors to resetLockout. Note that this is a "time bound"
		* See the {@link android.hardware.biometrics.fingerprint.ISession#resetLockout(int,
		* HardwareAuthToken)} and {@link android.hardware.biometrics.face.ISession#resetLockout(int,
		* HardwareAuthToken)} documentation for complete details.
		*
		* @param token A binder from the caller, for the service to linkToDeath
		* @param opPackageName Caller's package name
		* @param fromSensorId The originating sensor that just authenticated. Note that this MUST
		* be a sensor that meets {@link Authenticators#BIOMETRIC_STRONG} strength.
		* The strength will also be enforced on the BiometricService side.
		* @param userId The user that authentication succeeded for, and also the user that resetLockout
		* should be applied to.
		* @param hardwareAuthToken A valid HAT generated upon successful biometric authentication. Note
		* that it is not necessary for the HAT to contain a challenge.
		* @hide
		*/
		@RequiresPermission(USE_BIOMETRIC_INTERNAL)
		public void resetLockoutTimeBound(IBinder token, String opPackageName, int fromSensorId,
		int userId, byte[] hardwareAuthToken) {
		if (mService != null) {
		try {
		mService.resetLockoutTimeBound(token, opPackageName, fromSensorId, userId,
		hardwareAuthToken);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		}
		}

		/**
		* Provides a localized string that may be used as the label for a button that invokes
		* {@link BiometricPrompt}.

core/java/android/hardware/biometrics/IAuthService.aidl

+4 −0

Original line number	Diff line number	Diff line
		@@ -69,6 +69,10 @@ interface IAuthService {
		// land as SIDs, and are used during key generation.
		long[] getAuthenticatorIds();

		// See documentation in BiometricManager.
		void resetLockoutTimeBound(IBinder token, String opPackageName, int fromSensorId, int userId,
		in byte[] hardwareAuthToken);

		// Provides a localized string that may be used as the label for a button that invokes
		// BiometricPrompt.
		CharSequence getButtonLabel(int userId, String opPackageName, int authenticators);

core/java/android/hardware/biometrics/IBiometricAuthenticator.aidl

+4 −0

Original line number	Diff line number	Diff line
		@@ -70,4 +70,8 @@ interface IBiometricAuthenticator {

		// Gets the authenticator ID representing the current set of enrolled templates
		long getAuthenticatorId(int callingUserId);

		// Requests the sensor to reset its lockout state
		void resetLockout(IBinder token, String opPackageName, int userId,
		in byte[] hardwareAuthToken);
		}

core/java/android/hardware/biometrics/IBiometricService.aidl

+4 −0

Original line number	Diff line number	Diff line
		@@ -74,6 +74,10 @@ interface IBiometricService {
		// land as SIDs, and are used during key generation.
		long[] getAuthenticatorIds(int callingUserId);

		// See documentation in BiometricManager.
		void resetLockoutTimeBound(IBinder token, String opPackageName, int fromSensorId, int userId,
		in byte[] hardwareAuthToken);

		int getCurrentStrength(int sensorId);

		// Returns a bit field of the modality (or modalities) that are will be used for authentication.

core/proto/android/server/biometrics.proto

+7 −0

Original line number	Diff line number	Diff line
		@@ -125,6 +125,13 @@ message SensorStateProto {

		// User states for this sensor.
		repeated UserStateProto user_states = 4;

		// True if resetLockout requires a HAT to be verified in the TEE or equivalent.
		optional bool reset_lockout_requires_hardware_auth_token = 5;

		// True if a HAT is required (field above) AND a challenge needs to be generated by the
		// biometric TEE (or equivalent), and wrapped within the HAT.
		optional bool reset_lockout_requires_challenge = 6;
		}

		// State of a specific user for a specific sensor.