Part 9: Zero Trust - Device Binding & Risk Signals

 Prevent account takeovers by binding session tokens to hardware-backed keys and implementing DPoP-inspired proof of possession.

Zero Trust - Device Binding & Risk Signals

In Part 8, we hardened the network pipe. But what if an attacker steals a valid session token directly from a compromised device or via a sophisticated phishing attack?

In a Zero Trust architecture, we stop trusting the session token as a standalone proof of identity. Instead, we treat every request as potentially hostile until it passes a multi-factor “Risk Check.” Today, we implement the ultimate defense against Account Takeover (ATO): Device Binding & Intelligent Risk Signals.

🔐 The Core Concept: Session ≠ Device

The traditional approach is binary: If the request has a valid Bearer token, let it through.

The Senior Approach is rigorous: A token is only valid if it is presented by the exact hardware to which it was originally issued.

⚡ TL;DR

  • The Problem: Token theft (Sidejacking), where an attacker uses a stolen access_token on a different machine.
  • The Solution: Device Binding using Android Keystore keys (preferably hardware-backed) and Refresh Token Rotation.
  • The “Staff” Twist: A DPoP-inspired model binding the signature to the HTTP method, path, and body hash.
  • Risk Signals: Detecting GeoIP, ASN (ISP), and Geo-velocity anomalies in real-time.

🔍 Threat Model: What Device Binding Stops

Before we code, let’s look at the “Kill Chain” this architecture disrupts:

  • Stolen Bearer Tokens: Prevents replay from exported tokens because the original non-exportable signing key cannot be moved to an attacker’s machine.
  • Endpoint Swapping: By signing the URL and Method, an attacker cannot “reuse” a signature for a GET /balance request to authorize a POST /transfer.
  • Phishing Session Reuse: Detects when a session is opened in a new, unrecognized “Persona.”
  • Impossible Travel Fraud: Flags sessions that appear in geographically distant locations too quickly.

🏛️ Android Device Binding with Keystore

We implement a Proof-of-Possession model using secure hardware. When a user logs in, the app generates a unique key pair in the Android Keystore.

🔐 Android Key Attestation Backend Validation

For high-risk flows, simply receiving a public key isn’t enough. The backend validates the Google attestation certificate chain and inspects the attestation extension to confirm:

  • Verified Boot State: Is the OS untampered?
  • Patch Levels: Is the device running current security updates?
  • Security Level: Does the key live in the TEE or StrongBox?

🛠️ Implementation: DPoP-Inspired Proof of Possession (Kotlin)

/**
 * Generates a bank-grade signature binding the request to the hardware.
 * We sign the Method, Path, Nonce, Timestamp, and Body Hash.
 */
fun signRequest(
    method: String, 
    path: String, 
    nonce: String, 
    timestamp: Long, 
    bodyHash: String
): String {
    val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
    val privateKey = keyStore.getKey("device_binding_key", null) as PrivateKey

    // Binding the signature to the specific request context
    // Format: "METHOD|PATH|NONCE|TIMESTAMP|BODY_HASH"
    val signaturePayload = "$method|$path|$nonce|$timestamp|$bodyHash"

    val signatureBytes = Signature.getInstance("SHA256withECDSA").run {
        initSign(privateKey)
        update(signaturePayload.toByteArray())
        sign()
    }
    
    return Base64.encodeToString(signatureBytes, Base64.NO_WRAP)
}

🚨 GeoIP Risk Engine for Session Hijacking

A Zero Trust backend doesn’t just “Allow” or “Block.” It adapts based on the severity of the signal:

Press enter or click to view image in full size
GeoIP Risk Engine for Session Hijacking

Timestamp Validation: Reject proofs older than 60 seconds and allow a maximum ±30 second clock skew to prevent delayed replay attacks.

🛡️ Refresh Token Rotation with Reuse Detection

If a refresh_token is stolen, the attacker has long-term access.

Refined Logic: Every time a refresh_token is exchanged, the server invalidates the old token and issues a new one.

  • Hashed Storage: Store refresh tokens as hashed server-side records. This ensures that even if your database is leaked, the raw tokens remain protected.
  • Detection: If both the user and an attacker try to use the same refresh_token, the server detects the "double-use" and kills the entire session for safety.

🏁 Key Takeaways

  • Tokens are transferable; hardware is not. Bind your identity to the TEE/StrongBox.
  • Context Matters. Sign the Method, Path, and Body Hash to prevent request manipulation.
  • Rotate and Hash. A leaked refresh token should be single-use and unreadable in your logs.

🙋‍♂️ Frequently Asked Questions (FAQs)

Doesn’t signing every request add massive latency?

Hardware-backed ECDSA signing is highly efficient, typically taking 10–30ms. For standard API calls, this is a negligible price for bank-grade security.

How do you handle IP changes on mobile data?

Don’t block on simple IP changes. Look at the ASN (Provider). Switching from T-Mobile to home Wi-Fi is normal; switching to a known proxy or data center is a high-risk signal.

💬 Join the Discussion

  • How do you balance security friction (MFA prompts) with user experience?
  • Have you implemented Key Attestation? What were the challenges with backend verification?

📘 Master Your Next Technical Interview

Since Java is the foundation of Android development, mastering DSA is essential. I highly recommend “Mastering Data Structures & Algorithms in Java”. It’s a focused roadmap covering 100+ coding challenges to help you ace your technical rounds.

Comments

Post a Comment

Popular posts from this blog

No More _state + state: Simplifying ViewModels with Kotlin 2.3

Image
 Clean up your Android code with Explicit Backing Fields—the modern way to handle read-only state without the boilerplate. TL;DR:  Kotlin 2.3 introduces  explicit backing fields , allowing you to replace the classic  _state  +  state  boilerplate with a single, cleaner property—provided you're okay with a few experimental trade-offs. If you’ve been developing Android apps, you know the “Backing Property Dance.” It’s that repetitive ritual where we create a private  MutableStateFlow  and a public  StateFlow  just to ensure encapsulation. The “Old” Way (The Boilerplate) private val _uiState = MutableStateFlow(UiState.Loading) // Exposing a read-only view of the mutable internal state val uiState: StateFlow<UiState> = _uiState.asStateFlow() We’ve done this for years to prevent external classes from mutating our state. While effective, it pollutes our IDE suggestions with underscores and adds unnecessary ceremony to every singl...
Read more

Why You Should Stop Passing ViewModels Around Your Compose UI Tree 🚫

Image
 Master State Hoisting and the "Route-level" pattern to build scalable, testable, and preview-friendly Android apps. If you’ve been building with Jetpack Compose for a while, you know how tempting it is to just pass a  ViewModel  instance down through five layers of UI components. It’s convenient—one object gives you all the data and all the functions you need. But here is the architectural reality:  Passing ViewModel instances deep into your UI tree is an architectural anti-pattern.  It couples your visual components to business logic and makes your code significantly harder to maintain, test, and preview. The Core Problem: Lifecycle and Scoping ViewModels are designed to be state holders tied to a specific lifecycle (usually a Navigation Destination). When you pass a ViewModel into a small UI component, you break the  Unidirectional Data Flow (UDF) . ❌ The “Bad” Way (Tight Coupling) // ❌ BAD: This component is now impossible to preview or reuse @Composabl...
Read more

Is Jetpack Compose Making Your APK Fatter? (And How to Fix It)

Image
 Unpacking the Compose Tax, compiler-driven DEX optimization, and why your resource strategy must evolve for modern UI. TL;DR DEX Bloat:  Compose’s compiler injects “Restartable” and “Skippable” logic for memoization; R8 minification is effectively required. Code vs. Assets:  Moving iconography to  ImageVector  constants allows R8 to prune unused assets as code. Tooling Leak:   ui-tooling  in release builds is the #1 cause of "false" bloat. The Scale Factor:  Compose has a higher “size floor” but a much lower “size ceiling” than the legacy View system. The promise of Jetpack Compose was simple: “Write less code, ship faster.” But as teams migrate, a quiet concern often echoes in code reviews:  “Why did our APK size just jump?” While Compose removes the weight of deep XML hierarchies and the overhead of ViewBinding, it introduces a unique “Compose Tax.” For a senior engineer, the goal isn’t just to accept this tax, but to optimize the runtime...
Read more