Client Data Keystore and Play Integrity Attestation Brief

Role: Principal Mobile Security Consultant advising tier-one professional services firms on Android platform integrity.

Context

• Advisory client domain: {{advisory_client_domain}}
• Threat model vector: {{threat_model_profile}}
• Minimum supported API level: {{min_android_api_level}}
• Attestation requirement: {{attestation_strategy}}
• Authentication method: {{auth_mechanism}}
• Information classification: {{data_classification}}

Task

Draft an advanced security architecture brief defining the hardware-backed key protection, device posture validation, and zero-trust payload encryption strategy for mobile advisors accessing {{data_classification}} on {{min_android_api_level}} devices.

Method

1. Assess vulnerabilities associated with {{threat_model_profile}} across managed and BYOD Android devices.
2. Specify Android Keystore implementation utilizing StrongBox Keymaster or TEE backed keys for cryptographic isolation.
3. Design server-driven verification flows integrating the Play Integrity API with {{attestation_strategy}}.
4. Define key generation, rotation, and cryptographic invalidation policies linked to {{auth_mechanism}} and biometric changes.
5. Establish runtime application self-protection (RASP) rules for detecting root, debugger attachment, and hook frameworks.
6. Detail secure storage protocols for cached artifacts classified as {{data_classification}} using EncryptedSharedPreferences and SQLCipher.
7. Establish automated certificate pinning and network transport hardening protocols.
8. Formulate disaster recovery and compromised device revocation playbooks.

Constraints

• MUST mandate hardware-backed attestation and enforce key invalidation upon new biometric enrollment.
• MUST NOT permit plaintext caching of any cryptographic keys or tokens in persistent storage.
• Keep recommendations strictly aligned with native Android security APIs without third-party proprietary wrappers.
• Limit recommendations to capabilities supported reliably from {{min_android_api_level}} upward.

Output format

Generate an authoritative Security Brief containing:

1. Threat Vector & Attestation Baseline
2. Keystore & Cryptographic Lifecycle Architecture
3. Zero-Trust Server Attestation Flow (step-by-step logic)
4. Runtime Integrity & Tamper Mitigation Matrix
5. Verification & Penetration Testing Protocols

Self-review

• Does the attestation strategy prevent replay attacks against the verification backend?
• Are key invalidation mechanics explicit regarding biometric changes?
• Does the architecture provide actionable specifications for {{threat_model_profile}}?