[MUSIC PLAYING]
DAN GALPIN: Hi, I'm Dan from the Android DevRel team,
and I'm here to talk about integrity.
Integrity-- the quality of being honest,
the state of being whole and coherent.
You've spent time and effort making games, countless hours
tweaking in-game economies, tuning play mechanics,
making sure that the game has a great hook,
figuring out monetization models,
ensuring that it retains players.
And in between all of that, you even made it entertaining.
Your hard work and dedication has made Android a great place
to play in so many ways.
And the majority of users have good interactions
and enjoy playing your games the way you've intended.
However, there are always actors who are less well-intentioned,
so you have to deal with abuse, such as cheating, tampering,
fraud, theft, piracy, and unauthorized access.
Many types of abuse can originate
from untrustworthy interactions with your app
coming from unknown accounts or devices with unknown integrity.
In the past, separate APIs helped with specific problems.
The SafetyNet Attestation API and Google Play Licensing
help thousands of games trust devices, their installed app
binaries, and user access privileges every day.
But the challenge continues to evolve.
There are increasingly sophisticated forms of abuse
that put your users and your business at risk.
You've also told us that you're concerned
about the complexity of integrating
with multiple APIs and the fear of letting serious abuse
through without even knowing.
So we've unified our most advanced technologies
so that you can protect the integrity of your games
by calling a single API, helping you
to detect risky and untrustworthy game
interactions.
This new API gives your app server
signals to help it decide whether or not to trust
an interaction with your app.
The API helps you answer three questions.
Is this a genuine binary?
Is this a genuine Play install?
Is this a genuine Android device?
Based on the answers to these, you
can decide how to mitigate any potential risks.
The new API has some key benefits.
It's fully supported by Google Play
with up-to-date documentation, samples, and best practices.
You can set up the API and customize its responses
from the Play Console.
The integrity response token is small and encrypted.
It packages multiple integrity signals in one response,
so you don't need to implement multiple APIs.
The API is also future-looking.
It can support new device types, form factors,
and future integrity signals.
So how does it work?
The API allows your app server to communicate through your app
to Google Play's servers to determine trust in a way that
can't be interfered with.
Let's look at the main steps together.
First, the user tries to do something,
like join a multiplayer game.
At this moment, your backend server
starts an integrity check with a unique ID.
Then your game makes a call to the Play Integrity API.
Google Play has a lot of different signals
to assess whether the device has been compromised
and whether it has passed the certification tests.
Play also verifies the license, which
means that the user has downloaded the game from Play.
This ensures that purchased games were purchased,
but also that the game is available in the user's region.
As a result, the Play Integrity API
sends back a signed and encrypted verdict
about whether you can trust the device, the binary,
and whether the user should have access to the game.
Your game forwards it back to your server,
where you can analyze the verdict
and check that it comes back with the same ID you sent it
with.
If everything is fine, you can let your user move on.
All this happens with little CPU and network usage,
minimizing user disruption.
So that is how the Play Integrity API works.
So how do you get started with the Play Integrity API?
To fully take advantage of this API,
you really should have a game server,
and that server should be responsible
for a critical portion of game logic.
This enables you to make game decisions
on a tamper-free service based at least partially
upon the signals you get in the Play Integrity API.
Like with many of Google Play's APIs,
before you start implementing any of this,
you need to link a Google Cloud project.
We've added an easy way to do this
within the Google Play Console.
You can also configure which integrity
signals your game will receive within the Google Play Console.
Then you can start integrating the Play Integrity
API into your game client.
We provide the API in multiple forms
to best suit your environment, including Kotlin and Java, C,
and a plugin for the Unity Engine.
The basic API flow, shown here in highly abridged form
with the C API, involves creating the request,
setting a nonce that will typically
come from your server, requesting the integrity token,
receiving the signed token back, and passing that signed token
off to your server to be verified.
The nonce value used once is typically a random number
used to prevent replay attacks.
But it can also be used to prevent high-value actions
from tampering.
When being used to prevent replay attacks,
the server generates a nonce and sends it to the game client.
The game calls Play Integrity with the nonce,
and Google Play will create a signed response that
includes the nonce the game will return
to the server for verification.
One can also protect a high-value action
from tampering by calculating the hash
of a high-value message, using that as the nonce
and having Play return the signed response with the hash
so that the server can verify the action.
You can combine these two techniques
to get both benefits.
The server generates and sends a nonce to the game client.
The game appends the hash associated
with the high-value action to the nonce
and then sends this combined nonce
to Google Play through the Play Integrity API.
The signed verdict is returned to the game,
which sends the signed result to the game server.
The signature is verified by the game server,
and the original nonce is separated from the combined
nonce and verified.
The hashed part of the nonce is then
used to verify or perform the action,
and then the server responds with client instructions.
We provide the ability to do end-to-end testing
with the Google Play Console.
You can make sure that testers within a specific email list
get a specific return value from the API,
allowing you to make sure you've tested all of the response
pathways within your client and server from end to end.
If you've used SafetyNet Attestation API,
the implementation is very similar.
One big difference is in the encoding of the nonce.
SafetyNet Attestation allows you to use a byte array,
while the Play Integrity API requires
a Base64-encoded, web-safe, no-wrapped string
for the nonce.
On your server, you'll want to add code
to support both the SafetyNet Attestation API, as well
as the Play Integrity API, the new nonce encoding,
and handlers for any additional integrity signals.
Within your game client, there's a direct mapping
from the way SafetyNet Attestation works
to the way the Play Integrity API works.
In addition, you'll want to implement the retry logic
recommended by Play Integrity.
Reducing the number of APIs you need
to call to protect your game is a big part
of what motivated the Play Integrity API.
We return app licensing information
as part of the integrity verdict.
This allows you to verify that the user has acquired
the game from Google Play, which is important for games
that are doing a limited regional release or a closed
beta.
It also allows you to verify that your game has
been purchased if you have a paid game.
The existing license verification library
is still the recommended choice for games
that don't have an online component.
Now, some important things to remember when using the API--
identify your main concerns.
Do you have a piracy problem?
Game misuse?
Fraudulent traffic?
Cheating or something else?
Measure how big the problem is and consider
what it's costing you so that you know how much effort
to put into reducing it.
When it comes to integrity issues,
there is no silver bullet, and the Play Integrity API
is not intended to be one.
You should use the Play Integrity API
as part of an overall security and anti-abuse strategy.
Make sure you're taking into account
the risk of false positives and any costs
that you might be introducing to good users.
Consider creative alternatives rather than just
blocking risky traffic.
Finally, you should keep measuring and evolving.
Listen to your users and stay up to date with our Android
and Play features, as well as industry
anti-abuse best practices.
In conclusion, you spent time and energy
designing an entire ecosystem for your players.
The Play Integrity API provides signals
you can use to ensure that your honest players are enjoying
the coherent experience you've created for them.
The Play Integrity API is available now.
Find out more at g.co/play/integrityapi.
[MUSIC PLAYING]