How to store data into Secure Element in android

Introduction

Secure Element (SE) is a dedicated hardware component in mobile devices, offering a secure environment for storing sensitive data. It provides a tamper-proof and isolated environment, safeguarding data from unauthorized access and attacks. In Android, accessing and storing data in the SE requires specific APIs and protocols.

Understanding Secure Element

What is Secure Element?

A Secure Element is a physical chip embedded in a device, typically a smartphone, that provides a secure environment for storing sensitive data. It’s designed to be tamper-proof and isolated, offering protection against physical and logical attacks.

Benefits of Using Secure Element

• Enhanced data security
• Protection against unauthorized access and modifications
• Compliance with industry standards like EMV and PCI DSS

Types of Secure Element

• eSE (Embedded Secure Element): Integrated directly into the main chip of the device.
• rSE (Removable Secure Element): A separate chip that can be added to the device, such as SIM cards or microSD cards.

Accessing Secure Element in Android

Prerequisites

• Android device with a Secure Element
• Android SDK (Android Studio)
• Necessary permissions (READ_PHONE_STATE, ACCESS_COARSE_LOCATION)

Using Secure Element APIs

Android provides the following APIs to interact with the Secure Element:

1. SecureElement API

This API is used to access the Secure Element and perform basic operations like connecting to the SE and obtaining its information.

// Get the Secure Element instance
SecureElement secureElement = SecureElement.getInstance(context);

// Check if the Secure Element is available
boolean isAvailable = secureElement.isAvailable();

2. SecureElementSession API

This API is used to establish a secure connection with the Secure Element and execute commands.

// Create a Secure Element session
SecureElementSession session = secureElement.openSession();

// Execute a command
byte[] response = session.executeCommand(apduCommand);

3. SecureElement AID (Application Identifier)

Each application running on the Secure Element has a unique AID. This AID is used to identify the specific application to interact with.

Storing Data in Secure Element

1. Preparing the Data

Before storing data in the Secure Element, it needs to be prepared in a suitable format. This typically involves encoding the data using appropriate algorithms, such as Base64 or UTF-8.

2. Creating a Command (APDU)

To interact with the Secure Element, you need to send commands in the form of Application Protocol Data Units (APDUs). An APDU consists of five parts:

The specific APDU structure depends on the command you want to execute.

3. Sending the Command to the Secure Element

Use the SecureElementSession API to send the prepared APDU command to the Secure Element.

// Prepare the APDU command
byte[] apduCommand = new byte[]{
  // ... APDU command data ...
};

// Execute the command
byte[] response = session.executeCommand(apduCommand);

4. Receiving and Handling the Response

The Secure Element will respond with an APDU containing the result of the command execution. The response data can be decoded and processed accordingly.

Security Considerations

• Use strong cryptography to protect data stored in the Secure Element.
• Implement secure communication protocols when communicating with the Secure Element.
• Regularly update the Secure Element firmware to mitigate vulnerabilities.

Example: Storing a User ID

import android.app.Activity;
import android.os.Bundle;
import android.util.Log;
import android.widget.Toast;
import android.nfc.NfcAdapter;
import android.nfc.SecureElement;
import android.nfc.SecureElementSession;

public class MainActivity extends Activity {

    private static final String TAG = "MainActivity";

    private SecureElement secureElement;
    private SecureElementSession secureElementSession;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        // Get the Secure Element instance
        secureElement = SecureElement.getInstance(this);

        // Check if the Secure Element is available
        if (secureElement.isAvailable()) {
            // Create a Secure Element session
            secureElementSession = secureElement.openSession();

            // Prepare the data to store
            String userId = "your_user_id";
            byte[] userIdData = userId.getBytes();

            // Create the APDU command to store the data
            byte[] apduCommand = new byte[]{
                    0x00, // CLA
                    0xA4, // INS (select file)
                    0x04, // P1 (file control parameter)
                    0x0C, // P2 (file control parameter)
                    0x02, // Length of AID
                    0x11, 0x22 // AID (example)
            };

            // Execute the command and store the response
            byte[] response = secureElementSession.executeCommand(apduCommand);

            // Check if the command was successful
            if (response[0] == 0x90 && response[1] == 0x00) {
                Toast.makeText(this, "User ID stored successfully!", Toast.LENGTH_SHORT).show();
            } else {
                Log.e(TAG, "Failed to store user ID");
                Toast.makeText(this, "Failed to store user ID!", Toast.LENGTH_SHORT).show();
            }
        } else {
            Toast.makeText(this, "Secure Element not available!", Toast.LENGTH_SHORT).show();
        }
    }
}