Merge "[1/N] Skeleton for watch ranging for Identity Check" into main (d20f2fdc) · Commits · e / os / android_frameworks_base

core/java/android/hardware/biometrics/flags.aconfig

+7 −0

Original line number	Diff line number	Diff line
		@@ -93,3 +93,10 @@ flag {
		description: "This flag applies Identity Check to all biometric prompt requests"
		bug: "402534668"
		}

		flag {
		name: "identity_check_watch"
		namespace: "biometrics_framework"
		description: "This flag is for the integration of Identity Check with Watch"
		bug: "397954948"
		}

core/java/android/security/authenticationpolicy/AuthenticationPolicyManager.java

+27 −0

Original line number	Diff line number	Diff line
		@@ -16,6 +16,8 @@
		package android.security.authenticationpolicy;

		import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;
		import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;
		import static android.hardware.biometrics.Flags.FLAG_IDENTITY_CHECK_WATCH;
		import static android.security.Flags.FLAG_SECURE_LOCKDOWN;
		import static android.security.Flags.FLAG_SECURE_LOCK_DEVICE;

		@@ -29,7 +31,9 @@ import android.annotation.SystemService;
		import android.content.Context;
		import android.os.Binder;
		import android.os.Build;
		import android.os.Handler;
		import android.os.RemoteException;
		import android.proximity.IProximityResultCallback;
		import android.util.Log;

		import java.lang.annotation.Retention;
		@@ -495,4 +499,27 @@ public final class AuthenticationPolicyManager {
		throw e.rethrowFromSystemServer();
		}
		}

		/**
		* This function will start watch ranging for Identity Check. We will remove specific
		* Identity Check implementation when this is generalized.
		*
		* @param resultCallback callback used to return the ranging result
		* @param handler handler to start the ranging request
		*
		* @hide
		*/
		@RequiresPermission(USE_BIOMETRIC_INTERNAL)
		@FlaggedApi(FLAG_IDENTITY_CHECK_WATCH)
		public void startWatchRangingForIdentityCheck(
		@NonNull IProximityResultCallback resultCallback, Handler handler) {
		//TODO (b/397954948) : Update callback results to trigger in the handler
		handler.post(() -> {
		try {
		mAuthenticationPolicyService.startWatchRangingForIdentityCheck(resultCallback);
		} catch (RemoteException e) {
		throw e.rethrowFromSystemServer();
		}
		});
		}
		}

core/java/android/security/authenticationpolicy/IAuthenticationPolicyService.aidl

+4 −0

Original line number	Diff line number	Diff line
		@@ -17,6 +17,7 @@
		package android.security.authenticationpolicy;

		import android.os.UserHandle;
		import android.proximity.IProximityResultCallback;
		import android.security.authenticationpolicy.EnableSecureLockDeviceParams;
		import android.security.authenticationpolicy.DisableSecureLockDeviceParams;
		import android.security.authenticationpolicy.ISecureLockDeviceStatusListener;
		@@ -44,4 +45,7 @@ interface IAuthenticationPolicyService {

		@EnforcePermission("MANAGE_SECURE_LOCK_DEVICE")
		void unregisterSecureLockDeviceStatusListener(in ISecureLockDeviceStatusListener listener);

		@EnforcePermission("USE_BIOMETRIC_INTERNAL")
		void startWatchRangingForIdentityCheck(in IProximityResultCallback resultCallback);
		}
		No newline at end of file

services/core/java/com/android/server/biometrics/BiometricService.java

+48 −0

Original line number	Diff line number	Diff line
		@@ -28,6 +28,7 @@ import static com.android.server.biometrics.BiometricServiceStateProto.STATE_AUT

		import android.annotation.NonNull;
		import android.annotation.Nullable;
		import android.annotation.SuppressLint;
		import android.app.ActivityManager;
		import android.app.IActivityManager;
		import android.app.UserSwitchObserver;
		@@ -75,8 +76,10 @@ import android.os.ServiceManager;
		import android.os.UserHandle;
		import android.os.UserManager;
		import android.provider.Settings;
		import android.proximity.IProximityResultCallback;
		import android.security.GateKeeper;
		import android.security.KeyStoreAuthorization;
		import android.security.authenticationpolicy.AuthenticationPolicyManager;
		import android.service.gatekeeper.IGateKeeperService;
		import android.text.TextUtils;
		import android.util.ArraySet;
		@@ -124,6 +127,7 @@ public class BiometricService extends SystemService {
		@NonNull private final Supplier<Long> mRequestCounter;
		@NonNull private final BiometricContext mBiometricContext;
		private final UserManager mUserManager;
		private final AuthenticationPolicyManager mAuthenticationPolicyManager;

		@VisibleForTesting
		IStatusBarService mStatusBarService;
		@@ -1434,6 +1438,11 @@ public class BiometricService extends SystemService {
		public BiometricNotificationLogger getNotificationLogger() {
		return new BiometricNotificationLogger();
		}

		public AuthenticationPolicyManager getAuthenticationPolicyManager(Context context) {
		return (AuthenticationPolicyManager)
		context.getSystemService(Context.AUTHENTICATION_POLICY_SERVICE);
		}
		}

		/**
		@@ -1468,6 +1477,7 @@ public class BiometricService extends SystemService {
		mKeyStoreAuthorization = injector.getKeyStoreAuthorization();
		mGateKeeper = injector.getGateKeeperService();
		mBiometricNotificationLogger = injector.getNotificationLogger();
		mAuthenticationPolicyManager = mInjector.getAuthenticationPolicyManager(context);

		try {
		injector.getActivityManagerService().registerUserSwitchObserver(
		@@ -1820,6 +1830,8 @@ public class BiometricService extends SystemService {
		operationId, userId, createBiometricSensorReceiver(requestId), receiver,
		opPackageName, promptInfo, debugEnabled,
		mInjector.getFingerprintSensorProperties(getContext()));
		startWatchRangingIfIdentityCheckActive(promptInfo);

		try {
		mAuthSession.goToInitialState();
		} catch (RemoteException e) {
		@@ -1827,6 +1839,42 @@ public class BiometricService extends SystemService {
		}
		}

		/**
		* This is invoked only if Identity Check is active and the device is considered at risk. If the
		* watch is in range, it will re-enable device credential if it was originally requested.
		*
		* @param promptInfo biometric prompt info
		*/
		@SuppressLint("MissingPermission")
		private void startWatchRangingIfIdentityCheckActive(PromptInfo promptInfo) {
		if (android.hardware.biometrics.Flags.identityCheckWatch()
		&& promptInfo.isIdentityCheckActive() && promptInfo.isDeviceCredentialAllowed()) {
		if (mAuthenticationPolicyManager == null) {
		Slog.e(TAG, "Authentication policy manager is null. Skipping watch ranging");
		return;
		}

		//TODO (b/397954948) : Update callback results to handle System UI changes
		mAuthenticationPolicyManager.startWatchRangingForIdentityCheck(
		new IProximityResultCallback() {
		@Override
		public void onError(int error) throws RemoteException {

		}

		@Override
		public void onSuccess(int result) throws RemoteException {

		}

		@Override
		public IBinder asBinder() {
		return null;
		}
		}, mHandler);
		}
		}

		private void handleCancelAuthentication(long requestId) {
		final AuthSession session = getAuthSessionIfCurrent(requestId);
		if (session == null) {

services/core/java/com/android/server/security/authenticationpolicy/AuthenticationPolicyService.java

+11 −0

Original line number	Diff line number	Diff line
		@@ -18,6 +18,7 @@ package com.android.server.security.authenticationpolicy;

		import static android.Manifest.permission.INTERACT_ACROSS_USERS_FULL;
		import static android.Manifest.permission.MANAGE_SECURE_LOCK_DEVICE;
		import static android.Manifest.permission.USE_BIOMETRIC_INTERNAL;
		import static android.security.Flags.disableAdaptiveAuthCounterLock;

		import static com.android.internal.widget.LockPatternUtils.StrongAuthTracker.SOME_AUTH_REQUIRED_AFTER_ADAPTIVE_AUTH_REQUEST;
		@@ -44,6 +45,7 @@ import android.os.Message;
		import android.os.SystemClock;
		import android.os.UserHandle;
		import android.provider.Settings;
		import android.proximity.IProximityResultCallback;
		import android.security.authenticationpolicy.AuthenticationPolicyManager;
		import android.security.authenticationpolicy.AuthenticationPolicyManager.DisableSecureLockDeviceRequestStatus;
		import android.security.authenticationpolicy.AuthenticationPolicyManager.EnableSecureLockDeviceRequestStatus;
		@@ -482,5 +484,14 @@ public class AuthenticationPolicyService extends SystemService {
		Binder.restoreCallingIdentity(identity);
		}
		}

		@Override
		@EnforcePermission(USE_BIOMETRIC_INTERNAL)
		public void startWatchRangingForIdentityCheck(
		IProximityResultCallback resultCallback) {
		startWatchRangingForIdentityCheck_enforcePermission();
		Slog.d(TAG, "startWatchRangingForIdentityCheck");
		//TODO (b/397954948) : Bind to IProximityProviderService and start ranging
		}
		};
		}
		No newline at end of file