What is Device Attestation?
Device attestation is a cryptographically verifiable statement about a device, key or software environment that a remote service can evaluate before trusting a sensitive action.
English name, abbreviation and common aliases
- English name: Device Attestation
- Common aliases: Android device attestation, Hardware-backed attestation
How does Device Attestation work?
A device generates or uses a hardware-backed key and returns a signed certificate chain or integrity token. A trusted server validates signatures, challenge freshness, revocation status and claimed security properties.
A concrete example
Before releasing a high-value credential, a service sends a nonce and accepts the response only after its backend verifies the attestation chain and hardware security level.
Device Attestation vs. related concepts
Attestation produces signed evidence. Google Play Integrity API is a managed Google service that returns broader app, account and device verdicts.
Use cases, benefits and risks
Typical uses include protecting logins, payments, licensed content and high-value in-app actions. Integrity signals can reduce abuse, but false positives and unsupported environments are possible. Services should bind verdicts to requests, verify them server-side and apply proportionate responses.
How is Device Attestation related to DuoPlus?
Apps running on a DuoPlus cloud phone may perform their own integrity, root or emulator checks. Results depend on the app, Android version and required security level. DuoPlus cannot override third-party policies or promise that every app will accept every environment.
Frequently asked questions
Is Device Attestation always reliable or available?
No. It is one security signal and must be verified server-side, bound to the request and combined with a tiered risk policy.
Should a service block every failed or missing signal?
Usually not. A tiered policy with telemetry, retry and remediation is safer than treating every unusual environment identically.
