How to Encrypt Android SDK Preferences

What are SDK Preferences?

SDK Preferences, also known as SharedPreferences in the Android ecosystem, are settings within a software development kit (SDK) that dictate how the SDK operates within an app. These preferences store key-value pairs of data and are typically used for configurations, user settings, and other information that needs to persist across app sessions. This simple yet effective mechanism ensures that important data is maintained consistently within the application environment.

Here are some typical use cases for SDK Preferences in Android:

• User Preferences: Store user choices such as notification settings, language selection, and theme preferences that customize the user interface.
• Application Settings: Maintain configurations like API keys, server URLs, or feature flags that dictate how the application communicates with backend services or toggles certain features on or off.
• Session Data: Save session-specific data such as login tokens, user IDs, or other identifiers that are essential for maintaining user sessions without requiring re-authentication.
• Behavioral Parameters: Configure operational aspects of the SDK, such as caching mechanisms, data refresh rates, or error logging preferences, to optimize performance and user experience.

However, by default, SharedPreferences store data in plain text, making them vulnerable to unauthorized access and potential exploitation if the device is compromised.

How Does Encrypting SDK Preferences Protect Your SDK?

Encrypting SDK preferences is a vital security measure that directly protects the integrity and functionality of your SDK by ensuring that its configurations are kept secure from unauthorized access and manipulation. Here’s how it benefits your SDK:

• Secures Configuration Data: SDK preferences often contain configuration settings that dictate how the SDK operates within an app. These settings can include operational parameters like network configurations, API endpoints, and performance tuning options. Encrypting these preferences ensures that sensitive configuration data cannot be read or altered by unauthorized parties, thus maintaining the intended functionality and security posture of the SDK.
• Prevents Tampering: Encrypting SDK preferences ensures that any changes to the configuration data are detectable. This level of integrity checking helps prevent attackers from subtly altering SDK behavior in a way that could facilitate data breaches or other malicious activities.
• Enhances Reliability and Trust: Developers and clients using your SDK need assurance that the integrated components they rely on are not only functional but also secure. Encrypting the SDK preferences helps enhance the SDK’s overall reliability.
• Compliance with Security Standards: As with app data, SDK data often needs to comply with industry-specific security standards and regulations. Encryption of SDK preferences helps meet these standards, demonstrating a commitment to security and data protection. This compliance is crucial not just for legal adherence but also for maintaining market reputation and user trust.

By implementing encryption on SDK preferences, you protect against potential security threats and ensure that the SDK remains a reliable and trusted component in the app development ecosystem. This protection is crucial for maintaining the overall security and integrity of the apps that rely on your SDK.

Prerequisites for Using Encrypt SDK Preferences:

Before you encrypt your SDK preferences, you’ll need:

• Appdome account (create a free Appdome account here)

• A license for Encrypt SDK Preferences

• Mobile SDK (.aar for Android)

Disclaimer and Licensing

Appdome utilizes the SQLCipher open-source library for data encryption, which is licensed for redistribution. Ensure that this license is incorporated into your SDK’s documentation and compliance strategy.

• SQLCipher License Details:  SQL Cipher Licence

Gradle Dependency Requirement

Include the following Gradle dependency in your SDK documentation to support SDK Preference encryption:

androidx.security:security-crypto-ktx:1.1.0-alpha02