{"id":86485,"date":"2023-01-29T00:01:23","date_gmt":"2023-01-29T00:01:23","guid":{"rendered":"https:\/\/www.42gears.com\/?p=86485"},"modified":"2025-11-04T05:38:02","modified_gmt":"2025-11-04T05:38:02","slug":"android-encryption-basics","status":"publish","type":"post","link":"https:\/\/www.42gears.com\/pt-br\/blog\/android-encryption-basics\/","title":{"rendered":"Android Encryption Basics"},"content":{"rendered":"\n

Encryption of data is the process of encoding the information to ensure that it is not readable by anyone who is not authorized to read it. Core idea of Android encryption is to protect business or personal data from being stolen or accessed by any unauthorized person or entity. Encryption can be done using symmetric or asymmetric cryptography, but it depends on the level of security required. Symmetric cryptography is usually faster to use but less secure, while asymmetric cryptography provides better security but is slower.<\/p>\n\n\n\n

Android provides built-in security technologies to protect and secure data residing on Android devices.<\/p>\n\n\n\n

All CTS validated and GMS (Google Mobile Services) licensed devices that come installed Android 6 out of the box are encrypted. Any devices which are managed with Android Enterprise (earlier called Android for Work) are also required to be encrypted.<\/p>\n\n\n\n

File-based Encryption (FBE)<\/strong><\/h2>\n\n\n\n

Starting with Android 10, Android supports File-based Encryption (FBE) whereby each file is separately encrypted using AES-256 based encryption. <\/p>\n\n\n\n

FBE implementation allows certain apps to choose their storage location depending on their operation requirements.:<\/p>\n\n\n\n

  1. Device Encrypted (DE) storage<\/strong> is accessible once the device boots, as well as after the user unlocks the device.<\/li>
  2. Credential Encrypted (CE) storage<\/strong> is only available after the user enters their credentials and unlocks the device.<\/li><\/ol>\n\n\n\n

    Full-disk Encryption (FDE)<\/strong><\/h2>\n\n\n\n

    Earlier versions of Android supported Full-disk Encryption (FDE) which involves encrypting the entire user data partition with a single primary key.<\/p>\n\n\n\n

    Hardware-backed Security <\/strong>in Android<\/h2>\n\n\n\n

    Verified Boot<\/strong><\/h3>\n\n\n\n

    Verified Boot is a secure boot process in Android, which performs various checks to ensure that it is safe to continue booting into the main OS, e.g. any attempt to reinstall an older vulnerable version of the OS is detected by Verified Boot, and OS boot is halted. <\/p>\n\n\n\n

    Trusted Execution Environment (TEE)<\/strong><\/h3>\n\n\n\n

    Android devices with lock screen support an isolated environment known as Trusted Execution Environment or TEE. This ensures no one can decrypt user data before the device is unlocked by the user by entering their passcode or security credentials.<\/p>\n\n\n\n

    Application Sandboxing<\/strong><\/h3>\n\n\n\n

    Android runs every app inside a sandbox to prevent harmful or malfunctioning app code from jeopardizing other applications or system components. Entire apps are sandboxed irrespective of how they were developed (APIs, programming language, etc). Apps cannot interact with each other or exchange data, unless they use \u201cofficial\u201d or \u201csupported\u201d APIs.<\/p>\n\n\n\n

    Backup Encryption<\/strong><\/h3>\n\n\n\n

    Starting with Android 9, some Android devices support backup encryption, which is used to ensure backed up application data is first encrypted, and then stored on Google data centers. Restoration of data requires a key that is generated only on the user’s device, and even Google can’t decrypt or read the application data without this key.<\/p>\n\n\n\n

    \"Android<\/a><\/figure>\n\n\n\n

    Using MDM for Android Encryption<\/strong><\/h2>\n\n\n\n

    If you are an organization and looking for a solution to secure your fleet of enterprise devices, you can use an Android Device Management<\/a> platform such as SureMDM to setup Android encryption features. SureMDM supports comprehensive features of Android Enterprise and thereby enables you to take advantage of Full Disk Encryption (FDE) or File Based Encryption (FBE), perform remote device wipe, enforce strong password policies, separate work and personal apps and data, and more. <\/p>\n\n\n\n

    Summary<\/strong><\/h2>\n\n\n\n