Skip to main content

Security Recommendations

DRM security relies on the application's authorization system to ensure that the license token can not be shared by the end-user. This means that the registration and login system should ensure correct access control. Apart from this, below are some changes that can help with improving security.

Flag secure in Android​

FLAG_SECURE is a flag that can be added to the Android activity window. Adding this flag prevents the end-user from capturing the screen of the Android app. It indicates that the display has a secure video output.

You will find that Android is already blocking screenshots when DRM video is playing. We still recommend having this in your app. This is because the implementation can vary between devices. Adding this flag helps in some specific devices where Android is not preventing screen capture. On some other devices, it can increase compatibility by enforcing the use of secure surface from Android.

Device attestation to prevent tampering (Play integrity & DeviceCheck)​

Mobile apps can be modified by changing the files present in the application bundle and re-packaged into a new installable file. This can change the behaviour of the app by skipping some checks. It can add custom actions within the app to break the security processes within the app. Because of simpler distribution methods, this is much more popular with Android as compared with iOS.

The solution is Play integrity on Android. Play integrity uses Google play services to confirm that the application is not tampered with and is installed from Play Store. We recommend that you use this API with some important API calls such as login.

Play integrity is time expensive on the device and it has a limited quota. Google recommends not to use it too often.

... you should call the API to protect high-value, infrequent actions that are an integral part of your user experience, such as logging in to a service or joining a multiplayer server. You shouldn't call the API on high-frequency or low-value actions.

Google has enforced a quota on this API. You should set up monitoring on this API. If there is a chance that this API is going to call more than the default quota, you should apply to Google to increase it.

iOS has its mechanism for device attestation. Learn more from their official docs on DeviceCheck

IP address in the license URL​

As part of the license URL generation, you can add an IP address as a constraint. This means that the generated license URL will only succeed if accessed from that specific IP address. We recommend this to improve security. For example, one end-user can generate many license URLs and share them with other non-logged-in devices. Having IP address verification prevents such cases.

Details and sample code for adding IP to license URL

SSL Cert Pinning on Android and iOS​

SSL is the security behind https:// URL. It uses asymmetric encryption to ensure that any middware network actors are not able to read the data getting transmitted. It relies on a system of trusted certificate authorities to verify the ownership of a domain.

It is possible to inject custom certificate authority on the device so that the network traffic can be read in plain text. This is called a man-in-the-midle (MITM) attack.

SSL certificate can be pinned on both Android and iOS apps.