How to Encrypt Java Strings in Android SDKs

What are Java Strings?

In Java, a String is a sequence of characters used to store and manipulate text. It is a class in the Java programming language defined in the java.lang package. Importantly, Strings are immutable in Java, meaning once a String object is created, its value cannot be changed. Consequently, if you perform any operations that modify a String, such as concatenation or replacement, a new String object is created. As a result, Java Strings are widely used in programming for tasks like reading user input, displaying text, and manipulating data within applications.

Why Encrypt Java Strings in SDKs?

1. Protect Sensitive Information: SDKs often handle sensitive data such as API keys, user credentials, and configuration settings. Encrypting Strings helps protect this information from being exposed, especially in cases where the SDK might be used in less secure environments.
2. Prevent Reverse Engineering: SDKs are typically distributed as part of apps that can be reverse-engineered. By encrypting Strings, you make it more difficult for an attacker to understand the SDK’s functionality and extract valuable data.
3. Enhance Security Posture: Encrypting Strings in SDKs is a proactive security measure that contributes to the overall security posture of the mobile application using the SDK. It helps ensure that even if an application is compromised, the critical strings and data remain secure.
4. Compliance and Trust: Encrypting Strings can help SDK developers comply with regulatory requirements that mandate the protection of personal and sensitive data. It also builds trust with the developers and companies using the SDK, reassuring them that their applications are safeguarded against potential threats.

In the context of Appdome’s SDKProtect, String encryption is an essential feature that assists SDK developers in enhancing the security of their mobile SDKs, making them resistant to common threats and vulnerabilities.

Prerequisites for using Encrypt SDK Strings

Before you begin encrypting your SDK preferences, you’ll need:

• An Appdome account (create a free account here)

• A license for SDK Threat-Shielding > Encrypt SDK Strings

• A Mobile SDK (.aar format for Android)

Encrypt SDK Strings using Appdome

Follow these simple steps on Appdome to secure Android SDKs:

1. Upload the Mobile SDK to Appdome.
   • Upload Method: Choose either Appdome Console or DEV-API
   • Android Formats: .aar
2. Build the feature: Encrypt SDK Strings.
   • Building Encrypt SDK Strings using Appdome’s DEV-API:
3. Create and name the Fusion Set (security template) that will include the Encrypt SDK Strings feature.
   
   Figure 1: Fusion Set that will contain the Encrypt SDK Strings feature
   Note: Naming the Fusion Set according to the selected protections is optional and serves only for illustration purposes.
4. Follow the steps in the section Building the Encrypt SDK Strings feature via Appdome Console of this article to add the Encrypt SDK Strings feature to this Fusion Set
5. Click the “…” symbol on the far-right corner of the Fusion Set to open the Fusion Set Detail Summary and copy the Fusion Set ID from the summary.
   
   Figure 2: Fusion Set Detail Summary
   Note: Annotating the Fusion Set to identify the protections selected is optional.
6. Follow the instructions below to use the Fusion Set ID inside any standard mobile DevOps or CI/CD toolkit like Bitrise, App Center, Jenkins, Travis, Team City, or Circle CI:
   • Look for sample APIs in Appdome’s GitHub Repository
   • Build an API for the SDK – for instructions, see the tasks under Appdome API Reference Guide
7. Build the Encrypt SDK Strings feature via Appdome Console
   • Where: Inside the Appdome Console, go to Build SDKProtect™ Tab > SDK Threat-Shielding section.
   • How: Check whether SDK Threat-Shielding is active (toggled On). If necessary, enable it. By default, the Encrypt SDK Strings feature remains enabled.
     

     Figure 3: Encrypt SDK Strings option

   • When you enable SDK Threat-Shielding, the Fusion Set you created now bears the icon of the protection category that contains Encrypt SDK Strings.
     

     Figure 4: Fusion Set that displays the newly added Encrypt SDK Strings protection

8. Click Build My SDK at the bottom of the Build Workflow (shown in Figure 3).

Certify the Encrypt SDK Strings feature in Android Apps.

After building the Encrypt SDK Strings, Appdome generates a Certified Secure™ certificate to confirm the addition and protection of the Encrypt SDK Strings feature in the mobile SDK. To verify this, locate the protection in the Certified Secure™ certificate.

Figure 5: Certified Secure™ certificate
Each Certified Secure™ certificate gives DevOps and DevSecOps organizations a comprehensive workflow summary, an audit trail of each build, and evidence that the Encrypt SDK Strings feature is protecting each Android SDK.

Related Articles:

How to Encrypt Android SDK DBs

Automated SDK Protection & Appdome SDKProtect™

How to Obfuscate Mobile SDK Logic Using Appdome SDKProtect™

How Do I Learn More?

If you have any questions, please send them our way at support.appdome.com or via the chat window on the Appdome platform.

Thank you!

Thanks for visiting Appdome! Our mission is to secure every app on the planet by making mobile app security easy. We hope we’re living up to the mission with your project.