Design 03 - Android and Cloud Field Operations Platform

Prompt

Design security for Android field devices that collect regulated infrastructure inspections, operate offline for 24 hours, synchronize to a multi-tenant cloud API, and receive work orders.

Architecture

  • Enterprise/device enrollment and app-signing/update policy.
  • OIDC user authentication with short offline session policy; device/app signals are risk inputs, not authorization by themselves.
  • Minimal encrypted local database with Keystore-wrapped keys and explicit backup/screenshot/log controls.
  • Sync queue uses immutable operation IDs, tenant/user binding, idempotency, conflict policy, and server-side authorization for every object.
  • TLS with sound platform validation; pinning only with rotation and failure plan.
  • Deep links and exported components minimized and caller/input validated.
  • Attachments processed in isolated cloud workers with type/size/content controls.
  • Remote revocation limits documented for offline devices.

Abuse Cases

Lost/unlocked device, malicious local app and intent, rooted device, stolen refresh token, cross-tenant sync bug, replayed offline action, malicious attachment, WebView content, backend object authorization flaw, and supply-chain compromise.

Validation

  • Instrumentation tests for storage, logs, screenshots, components, deep links, and network config.
  • API object/function/tenant authorization matrix.
  • Offline replay, conflict, clock-skew, duplicate, and revocation tests.
  • Native attachment-parser fuzzing.
  • Lost-device and compromised-signing-key tabletop.

Tradeoffs

Offline utility conflicts with immediate revocation and centralized authorization. Minimize offline scope, bound validity, encrypt local data, make high-risk actions online-only, and design server reconciliation rather than pretending root detection prevents local control.

Telemetry and Recovery

Use privacy-minimized app health/security signals, API audit events, sync anomaly detections, release provenance, staged rollout, rollback, forced upgrade policy for severe issues, and a customer communication plan.