public interface ShieldEngine

The service-provider seam between the public shield API and the attestation engine that implements it.

Codename One ships an inert default that reports itself unavailable, so an app written against AppShield compiles and runs everywhere. A build entitled to the enterprise engine has a real implementation registered by the build server before Display.init, via ShieldEngineRegistry.setEngine(ShieldEngine).

What must never move into the framework

The split is only worth anything if the engine keeps the parts an attacker would want to reach. An implementation must own, and must never delegate to open framework code:

• challenge and nonce generation – predictable nonces make replay possible;
• any key material, and any code that touches it;
• the pin comparison and the decision to fail a request. The framework may hold a PinSet; patching the framework’s copy must not be enough to disable pinning;
• the detection heuristics themselves. Published heuristics are bypassed heuristics, so the framework only ever sees finished ShieldSignal results – and only the ones the engine chooses to publish;
• interpretation of the raw platform attestation. Those responses go to the verifying service, which the attacker does not control, rather than being judged on the device.

The security property this preserves is not “the app refuses to make the call” – an attacker who controls the device can always strip a header. It is that the customer’s backend refuses to serve a request without a valid, unexpired, service-signed token, which a substituted engine cannot mint.