How to Implement Data-at-Rest Encryption in Android Apps Using AI
Learn to protect data stored in mobile apps using encryption in mobile CI/CD with a Data-Driven DevSecOps™ build system.
What Is Data-at-Rest Encryption?
Data-at-Rest Encryption converts readable data, or plaintext, into unreadable ciphertext using algorithms and encryption keys. Common encryption techniques, such as AES and RSA, protect sensitive data—like login credentials and payment information—both in transit and at rest within mobile apps. This defense ensures that intercepted data remains inaccessible without the decryption key, aligning with compliance requirements under regulations like PCI DSS, which mandate robust encryption practices to safeguard financial transactions and user data.
The Three States of Mobile App Data
There are three states in which data exists in mobile apps:
- Data at rest is mobile app data that is persistent and stored in the application sandbox and installation directory.
- Data in transit is mobile app data sent from the app to outside servers or other app users.
- Data in use (aka: data in memory) is data the mobile app temporarily stores in application memory, including Data at rest and in transit before they are sent/saved.
Data at rest and Data in use encryption are enabled as part of TOTALData Encryption. 
How Appdome Protects Mobile Apps With Data-at-Rest Encryption?
Appdome’s dynamic Prevent Screen Sharing Scams & Malware plugin for iOS detects and blocks unauthorized screen recording, mirroring, and external capture attempts in iOS apps. By monitoring for screen-sharing tools and detecting recording events, Appdome ensures sensitive app content cannot be visually extracted. When a recording or mirroring event is detected, Appdome prevents further access and notifies users with a customizable alert, ensuring data loss prevention (DLP) measures are upheld. Mobile developers can use Appdome’s Threat-Events™ to gather real-time data on screen-sharing or recording events and create customized user experiences when such threats are detected. This protection secures app content, mitigates unauthorized data leaks, and reinforces app security against modern malware threats.
Overview of Appdome’s TOTALData™ Encryption
Using Appdome Data at Rest encryption, all data generated by the app is encrypted at runtime using industry-standard AES 256 cryptographic protocols. You can also choose to encrypt data in use/in memory, where all data temporarily stored in application memory is encrypted before it is sent/saved. With Appdome, encryption is accomplished dynamically, without any dependencies on the data structure, databases or file structures.
Appdome uses AES-CTR 256 bit encryption, which is faster when accessing partial files (i.e. when reading a buffer from a file or mapping a part of a file into memory). This is much more efficient than the AES-CBC encryption used by most Third-party SDKs and encryption libraries (which forces encryption/decryption of the entire file even when it only needs to read a small block within it).
Appdome’s mobile TOTALDataTM Encryption implementation does not impact app behavior. This results in a consistent and easy to implement experience, as opposed to a DIY approach which would require the mobile developer to choose encryption components from a wide variety of libraries, cipher strengths, and key stores (and then need to integrate them together).
Like all integrations on Appdome, customers can integrate just data at rest or data in use encryption, or they can combine this feature with any or all other features from Appdome’s Mobile Security Suite. They can even combine Appdome Mobile Security with multiple 3rd party SDKs and APIs, forming countless numbers of service combinations and integrations into any mobile app. On Appdome, there’s never any coding and all integrations are completed in under a minute.
Advanced Configuration Options for Mobile TOTALDataTM Encryption
Appdome also provides options for customers to exclude certain files or folders from being encrypted. There is an option to automatically exclude all media files from being encrypted. And there is another option to name specific files that you wish to be excluded from encryption.
Key Management
Appdome dynamically generates symmetric data encryption keys at runtime. Keys are generated by Appdome by using industry-standard AES mechanisms. Keys are never stored on the device and are derived at run-time. In addition, Appdome can factor in additional contextual information such as bundle ID, device ID, checksums, user input (passwords, tokens), and application state conditions (eg: the existence of a debugger) into the key derivation mechanism. See the diagram below.
For advanced users, appdome also provides an option for customers to control parts of the key management process via an external key management system (KMS). With this option, additional external factors may be introduced for key derivation.
Like all features in the Appdome Mobile Security Suite, customers can implement this feature standalone, or combined with other mobile security features or 3rd party SDK/APIs – all of which can be integrated into any mobile app in minutes with no coding.
