Enterprise Zero-Trust Identity Mesh
Hardened Single Sign-On (SSO) and inter-app identity federation for Android with StrongBox/TEE Keystore encryption, dual-layer signature pinning, and RFC 9449 DPoP.
Quickstart (Gradle Dependency)
Add the Maven repository and SDK dependency directly to your Android project's build.gradle:
repositories {
maven { url 'https://tzsmm.com/sdk/maven' }
google()
mavenCentral()
}
dependencies {
implementation 'com.tzsmm:tz-identity-sdk:1.0.0'
}
Core Security Architecture
Hardware-Backed Storage
StrongBox Keymaster with TEE fallback generates 256-bit AES root keys inside hardware secure elements. AES-256-GCM authenticated encryption binds AAD to immutable user IDs.
Dual-Layer Caller Verification
Enforces Binder UID checks and SHA-256 certificate pinning against release hash FAC61745.... Non-conforming apps are rejected immediately at the kernel level.
DPoP Sender-Constrained Tokens
RFC 9449 Demonstration of Proof-of-Possession. Tokens are cryptographically bound to client-generated ephemeral EC keypairs and cannot be used if leaked.
Anti-Replay & Rate Limiting
Requires 32-byte nonces and UTC timestamp checks (≤ 30s delta). In-memory LRU tracking and per-UID Token Bucket (15 burst, 2/sec) prevent replay and DoS attacks.
Client App Configuration
Add signature-protected permissions and IPC queries to your client app's AndroidManifest.xml:
<manifest xmlns:android="http://schemas.android.com/apk/res/android">
<!-- Request the signature-level Identity Vault permission -->
<uses-permission android:name="com.tzsmm.permission.IDENTITY_VAULT" />
<queries>
<package android:name="com.tzsmm.tzinbox" />
<provider android:authorities="com.tzsmm.identity.vault" />
<provider android:authorities="com.tzsmm.identity.sync" />
<intent>
<action android:name="com.tzsmm.identity.action.AUTHORIZE" />
</intent>
</queries>
<application
android:networkSecurityConfig="@xml/network_security_config"
android:usesCleartextTraffic="false">
...
</application>
</manifest>
SDK Code Examples
// 1. Retrieve all synchronized mesh accounts (<5ms)
val accounts: List<MeshAccount> = IdentityClient.getAccounts(context)
val activeAccount = accounts.find { it.isActive }
// 2. Request audience-scoped, DPoP-bound delegated access token
val delegatedTokenResult = IdentityClient.getDelegatedToken(context)
val token = delegatedTokenResult?.token
// 3. Instant 1-click active account switch across the entire ecosystem
val switched = IdentityClient.switchActiveAccount(context, targetAccountId = "104")
// 4. Register real-time ContentObserver for zero-latency session updates
val observer = MeshSyncObserver(context) { updatedAccounts ->
runOnUiThread {
syncUi(updatedAccounts)
}
}
observer.register()