Introducing the AndroidX Security State Libraries: A Unified View of Device Security

Android has released the AndroidX Security State Libraries version 1.1.0 and Security State Provider version 1.0.0, offering a unified view of device security. These libraries enable developers to programmatically verify the security state of a device across different components, instead of relying on the coarse Security Patch Level (SPL).

There are three patch levels: Device SPL (DSPL) - the current security patch level on the device; Published SPL (PSPL) - the latest official patch level; and Available SPL (ASPL) - the patch level ready for download and installation.

The libraries can track these patch levels for system components such as the system, system modules, and kernel. By using these APIs, developers can make informed decisions about device security. For example, a banking app could check a device's DSPL against its ASPL before authorizing payments, requiring the user to update their device first if an update is pending.

The companion androidx.security.state.provider library allows OEMs and OTA client developers to expose update availability via standardized mechanisms. This standardization improves transparency and allows apps to access update information, regardless of whether the update is delivered through an OEM's OTA client or Google Play.

In addition to SPL, the libraries provide details about Android Security Bulletin data from the Open Source Vulnerabilities (OSV) database. This enables apps to programmatically audit whether specific critical CVEs have been resolved on a device.