For Android, detect Asymmetric Cryptography from documented management, network, or vetting evidence; treat state queries as periodic observations rather than real-time events. Correlate Application Permission via Android Enterprise DPC / Application Vetting [DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review]; Application State via Android Enterprise / EMM [Managed package inventory/status and package metadata]; File Creation via Application Vetting / Forensic Acquisition [Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact]. Alert on a sequence or state change inconsistent with the device/app baseline, approved management policy, or expected user workflow; do not infer unobserved API calls, file/process activity, or payload content from management state alone.
| Data Component | Name | Channel |
|---|---|---|
| Application Permission (DC0114) | android:DevicePolicyManager | DevicePolicyManager.getPermissionGrantState(); PackageManager manifest/requested-permission review |
| Application State (DC0123) | android:EMM | Managed package inventory/status and package metadata |
| File Creation (DC0039) | mobile:ForensicArtifacts | Dynamic filesystem trace or acquired app-container/filesystem artifacts: App writes asymmetric-encrypted blob or encoded ciphertext to local staging path before network transmission — encrypted staging artifact |
| OS API Execution (DC0021) | mobile:DynamicAnalysis | Dynamic API/runtime trace: App invokes RSA/ECC keypair generation, public-key import, or asymmetric encryption operations (KeyPairGenerator, Cipher.RSA, ECDH) NOT IN $ApprovedCryptoApps$ before network transmission |
| mobile:DynamicAnalysis | Dynamic API/runtime trace: Keypair generation, import, or private-key access events occurring prior to outbound communication not matching app declared secure-communication function |
| Field | Description |
|---|---|
| ApprovedCryptoApps | VPN clients, enterprise secure messaging, MDM agent, apps with documented asymmetric crypto need (certificate-pinned enterprise apps). Derive from MDM catalog. |
| InteractionThreshold | Default 300s. |
| AppCDNList | 30-day per-app network destination baseline. |
Indirect evidence of asymmetric cryptographic channel usage inferred through key exchange-like network patterns and application background execution behavior, where direct observation of keypair operations is limited. Detection correlates app entitlement posture + background execution + asymmetric handshake patterns + subsequent encrypted communication.
| Field | Description |
|---|---|
| TimeWindow | Correlation window between initial communication burst and steady encrypted traffic |
| AllowedAppList | Apps expected to perform asymmetric key exchanges |
| HandshakePatternThreshold | Threshold for identifying asymmetric handshake-like traffic patterns |
| ForegroundStateRequired | Whether communication establishment should occur during user interaction |