Security Blog
The latest news and insights from Google on security and safety on the Internet
Google and Android have your back by protecting your backups
12. Oktober 2018
Posted by Troy Kensinger, Technical Program Manager, Android Security and Privacy
Android is all about choice. As such, Android strives to provide users many options to protect their data. By combining
Android’s Backup Service
and
Google Cloud’s Titan Technology
, Android has taken additional steps to securing users' data while maintaining their privacy.
Starting in Android Pie, devices can take advantage of a new capability where backed-up application data can only be decrypted by a key that is randomly generated at the client. This decryption key is encrypted using the user's lockscreen PIN/pattern/passcode, which isn’t known by Google. Then, this passcode-protected key material is encrypted to a
Titan security chip
on our datacenter floor. The Titan chip is configured to only release the backup decryption key when presented with a correct claim derived from the user's passcode. Because the Titan chip must authorize every access to the decryption key, it can permanently block access after too many incorrect attempts at guessing the user’s passcode, thus mitigating brute force attacks. The limited number of incorrect attempts is strictly enforced by a custom Titan firmware that cannot be updated without erasing the contents of the chip. By design, this means that no one (including Google) can access a user's backed-up application data without specifically knowing their passcode.
To increase our confidence that this new technology securely prevents anyone from accessing users' backed-up application data, the Android Security & Privacy team hired global cyber security and risk mitigation expert NCC Group to complete a security audit. Some of the outcomes included positives around Google’s security design processes, validation of code quality, and that mitigations for known attack vectors were already taken into account prior to launching the service. While there were some issues discovered during this audit, engineers corrected them quickly. For more details on how the end-to-end service works and a detailed report of
NCC Group’s
findings, click
here
.
Getting external reviews of our security efforts is one of many ways that Google and Android maintain transparency and openness which in turn helps users feel safe when it comes to their data. Whether it’s 100s of hours of gaming data or your personalized preferences in your favorite Google apps, our users' information is protected.
We want to acknowledge contributions from Shabsi Walfish, Software Engineering Lead, Identity and Authentication to this effort
Keine Kommentare :
Kommentar posten
Labels
android
android security
android tr
app security
big data
biometrics
blackhat
chrome
chrome security
federated learning
Gboard
google play
google play protect
pha family highlights
privacy
Security
spyware
targeted spyware
vulnerabilities
Archive
2021
Feb
Jan
2020
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2019
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2018
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2017
Dez
Nov
Okt
Sep
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2016
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2015
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
Jan
2014
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Apr
Mär
Feb
Jan
2013
Dez
Nov
Okt
Aug
Jun
Mai
Apr
Mär
Feb
Jan
2012
Dez
Sep
Aug
Jun
Mai
Apr
Mär
Feb
Jan
2011
Dez
Nov
Okt
Sep
Aug
Jul
Jun
Mai
Apr
Mär
Feb
2010
Nov
Okt
Sep
Aug
Jul
Mai
Apr
Mär
2009
Nov
Okt
Aug
Jul
Jun
Mär
2008
Dez
Nov
Okt
Aug
Jul
Mai
Feb
2007
Nov
Okt
Sep
Jul
Jun
Mai
Feed
Follow @google
Follow
Give us feedback in our
Product Forums
.
Follow
Keine Kommentare :
Kommentar posten