iOS

Assessing device state with DeviceCheck

App Attest, Keychain, signing and Apple platform controls.

iOS security1 min readEditorial methods

DeviceCheck helps assess particular device-related state. Application integrity, promotion abuse and user authorization are different questions, so do not confuse it with App Attest.

Evaluation approach

The service's state information can support a business rule that tracks whether a benefit has already been used. The server must define its meaning and update policy.

Application example

In a trial promotion, consider device state alongside account and transaction history. Provide a correction path for a new device owner or a support exception.

Limits and considerations

Using device state as a permanent personal identity can produce incorrect outcomes and privacy problems.

Limited data for a limited purpose

DeviceCheck capabilities do not have the same meaning as App Attest application-integrity evidence. Define on the server what the device-related state represents. Product labels are not a basis for treating the services as interchangeable.

A record used to assess promotion abuse should not be the sole reason for an account sanction. Review phone ownership changes and legitimate reinstallation. Specify who may change the state and which business event triggers an update.

Checks and decisions

  • Document the state's meaning
  • Define a correction path
  • Combine account signals

State clearly which abuse decision the service supports.

Sources

The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.