IGateKeeperService.aidl revision cfb61601fa4e92445655de7b82d2bc0ea9000824
18fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales/* 28fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * Copyright (C) 2015 The Android Open Source Project 38fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * 48fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * Licensed under the Apache License, Version 2.0 (the "License"); 58fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * you may not use this file except in compliance with the License. 68fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * You may obtain a copy of the License at 78fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * 88fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * http://www.apache.org/licenses/LICENSE-2.0 98fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * 108fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * Unless required by applicable law or agreed to in writing, software 118fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * distributed under the License is distributed on an "AS IS" BASIS, 128fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 138fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * See the License for the specific language governing permissions and 148fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * limitations under the License. 158fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales */ 168fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales 178fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Moralespackage android.service.gatekeeper; 188fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales 198fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales/** 208fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * Interface for communication with GateKeeper, the 218fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * secure password storage daemon. 228fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * 238fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * This must be kept manually in sync with system/core/gatekeeperd 248fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * until AIDL can generate both C++ and Java bindings. 258fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * 268fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @hide 278fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales */ 288fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Moralesinterface IGateKeeperService { 298fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales /** 308fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * Enrolls a password, returning the handle to the enrollment to be stored locally. 318fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param uid The Android user ID associated to this enrollment 328fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param currentPasswordHandle The previously enrolled handle, or null if none 338fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param currentPassword The previously enrolled plaintext password, or null if none. 348fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * If provided, must verify against the currentPasswordHandle. 358fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param desiredPassword The new desired password, for which a handle will be returned 368fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * upon success. 378fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @return the handle corresponding to desiredPassword, or null 388fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales */ 398fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales byte[] enroll(int uid, in byte[] currentPasswordHandle, in byte[] currentPassword, 408fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales in byte[] desiredPassword); 418fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales 428fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales /** 438fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * Verifies an enrolled handle against a provided, plaintext blob. 448fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param uid The Android user ID associated to this enrollment 458fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param enrolledPasswordHandle The handle against which the provided password will be 468fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * verified. 478fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales * @param The plaintext blob to verify against enrolledPassword. 48d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * @return True if the authentication was successful 498fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales */ 50d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales boolean verify(int uid, in byte[] enrolledPasswordHandle, 51d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales in byte[] providedPassword); 52d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales /** 53d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * Verifies an enrolled handle against a provided, plaintext blob. 54d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * @param uid The Android user ID associated to this enrollment 55d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * @param challenge a challenge to authenticate agaisnt the device credential. If successful 56ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales * authentication occurs, this value will be written to the returned 57d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * authentication attestation. 58d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * @param enrolledPasswordHandle The handle against which the provided password will be 59d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * verified. 60d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * @param The plaintext blob to verify against enrolledPassword. 61d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales * @return an opaque attestation of authentication on success, or null. 62d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales */ 63ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales byte[] verifyChallenge(int uid, long challenge, in byte[] enrolledPasswordHandle, 64d9fc85ac27742adbe89e54fd35f3cb2469e94b91Andres Morales in byte[] providedPassword); 65ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales 66ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales /** 67ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales * Retrieves the secure identifier for the user with the provided Android ID, 68ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales * or 0 if none is found. 69ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales * @param uid the Android user id 70ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales */ 71ca38add3ea7ac7e28bd915a52a861261a944f2bdAndres Morales long getSecureUserId(int uid); 72cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales 73cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales /** 74cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales * Clears secure user id associated with the provided Android ID. 75cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales * Must be called when password is set to NONE. 76cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales * @param uid the Android user id. 77cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales */ 78cfb61601fa4e92445655de7b82d2bc0ea9000824Andres Morales void clearSecureUserId(int uid); 798fa5665f0e757cec0063fb4cf1354f1596f93a91Andres Morales} 80