Android7.0指纹服务FingerprintService实例介绍
指纹服务是Android系统中一个较为简单的服务(相比于AMS,WMS等),也比较独立,功能上包括几点
- 指纹的录入与删除
- 指纹认证
- 指纹的安全策略(错误次数判定)
和其他的systemservice一样,应用程序通过FingerprintManager实现与FingerprintService的通信,除了上面所说的功能之外,FingerprintManager提供了一些别的的接口,重要的接口都会要求系统级别的权限,并且也不是公开的api(指纹的录入,删除,重命名,重置错误计数等)
/** *Obtainthelistofenrolledfingerprintstemplates. *@returnlistofcurrentfingerprintitems * *@hide */ @RequiresPermission(USE_FINGERPRINT) publicListgetEnrolledFingerprints(intuserId){ if(mService!=null)try{ returnmService.getEnrolledFingerprints(userId,mContext.getOpPackageName()); }catch(RemoteExceptione){ throwe.rethrowFromSystemServer(); } returnnull; } /** *@hide */ @RequiresPermission(allOf={ USE_FINGERPRINT, INTERACT_ACROSS_USERS}) publicbooleanhasEnrolledFingerprints(intuserId){ if(mService!=null)try{ returnmService.hasEnrolledFingerprints(userId,mContext.getOpPackageName()); }catch(RemoteExceptione){ throwe.rethrowFromSystemServer(); } returnfalse; } /** *Determineiffingerprinthardwareispresentandfunctional. * *@returntrueifhardwareispresentandfunctional,falseotherwise. */ @RequiresPermission(USE_FINGERPRINT) publicbooleanisHardwareDetected(){ if(mService!=null){ try{ longdeviceId=0;/*TODO:plumbhardwareidtoFPMS*/ returnmService.isHardwareDetected(deviceId,mContext.getOpPackageName()); }catch(RemoteExceptione){ throwe.rethrowFromSystemServer(); } }else{ Log.w(TAG,"isFingerprintHardwareDetected():Servicenotconnected!"); } returnfalse; }
FingerprintService的启动过程
FingerprintService在systemserver中创建并初始化,当检测到手机支持指纹功能的时候就会启动这个service
... if(mPackageManager.hasSystemFeature(PackageManager.FEATURE_FINGERPRINT)){ mSystemServiceManager.startService(FingerprintService.class); } ...
FingerprintService在初始化后会建立和HAL层的通信,即连接到fingerprintd,拿到用于通信的IFingerprintDaemon对象(binder)
publicvoidonStart(){ publishBinderService(Context.FINGERPRINT_SERVICE,newFingerprintServiceWrapper()); IFingerprintDaemondaemon=getFingerprintDaemon(); listenForUserSwitches(); } publicIFingerprintDaemongetFingerprintDaemon(){ if(mDaemon==null){ mDaemon=IFingerprintDaemon.Stub.asInterface(ServiceManager.getService(FINGERPRINTD)); if(mDaemon!=null){ try{ mDaemon.asBinder().linkToDeath(this,0); mDaemon.init(mDaemonCallback); mHalDeviceId=mDaemon.openHal(); if(mHalDeviceId!=0){ updateActiveGroup(ActivityManager.getCurrentUser(),null); }else{ Slog.w(TAG,"FailedtoopenFingerprintHAL!"); MetricsLogger.count(mContext,"fingerprintd_openhal_error",1); mDaemon=null; } }catch(RemoteExceptione){ Slog.e(TAG,"FailedtoopenfingeprintdHAL",e); mDaemon=null;//tryagainlater! } }else{ Slog.w(TAG,"fingerprintservicenotavailable"); } } returnmDaemon; }
本质上来说,除去安全相关的策略外,指纹的功能是依赖硬件实现的,FingerprintService也只是充当了frameworkjava层与native层的消息传递者罢了,所以指纹的识别,录入和监听都是向fingerprintd发送命令和获取相应的结果
指纹监听认证过程
以指纹认证为例,介绍这一过程,录入和删除的过程和认证类似,不重复描述
FingerprintManager
publicvoidauthenticate(@NullableCryptoObjectcrypto,@NullableCancellationSignalcancel, intflags,@NonNullAuthenticationCallbackcallback,Handlerhandler,intuserId){ if(callback==null){ thrownewIllegalArgumentException("Mustsupplyanauthenticationcallback"); } if(cancel!=null){ if(cancel.isCanceled()){ Log.w(TAG,"authenticationalreadycanceled"); return; }else{ cancel.setOnCancelListener(newOnAuthenticationCancelListener(crypto)); } } if(mService!=null)try{ useHandler(handler); mAuthenticationCallback=callback; mCryptoObject=crypto; longsessionId=crypto!=null?crypto.getOpId():0; mService.authenticate(mToken,sessionId,userId,mServiceReceiver,flags, mContext.getOpPackageName()); }catch(RemoteExceptione){ Log.w(TAG,"Remoteexceptionwhileauthenticating:",e); if(callback!=null){ //Thoughthismaynotbeahardwareissue,itwillcauseappstogiveuportry //againlater. callback.onAuthenticationError(FINGERPRINT_ERROR_HW_UNAVAILABLE, getErrorString(FINGERPRINT_ERROR_HW_UNAVAILABLE)); } } }
可以看到,最终仍然是向FingerprintService发送消息,但是开启指纹认证的函数传入了两个比较重要的参数,一个是CancellationSignal对象,用于取消指纹认证,另一个是指纹认证的回调对象AuthenticationCallback
publicstaticabstractclassAuthenticationCallback{ publicvoidonAuthenticationError(interrorCode,CharSequenceerrString){} publicvoidonAuthenticationHelp(inthelpCode,CharSequencehelpString){} publicvoidonAuthenticationSucceeded(AuthenticationResultresult){} publicvoidonAuthenticationFailed(){} publicvoidonAuthenticationAcquired(intacquireInfo){} };
看函数名称也能知道其功能,他们分别代表了指纹认证时的回调结果(成功,失败,检测到指纹,认证异常等),参数包含了具体的信息,这些信息在FingerprintManager中都有对应的常量定义,有兴趣可以查看代码
FingerprintService
publicvoidauthenticate(finalIBindertoken,finallongopId,finalintgroupId, finalIFingerprintServiceReceiverreceiver,finalintflags, finalStringopPackageName){ finalintcallingUid=Binder.getCallingUid(); finalintcallingUserId=UserHandle.getCallingUserId(); finalintpid=Binder.getCallingPid(); finalbooleanrestricted=isRestricted(); mHandler.post(newRunnable(){ @Override publicvoidrun(){ if(!canUseFingerprint(opPackageName,true/*foregroundOnly*/, callingUid,pid)){ if(DEBUG)Slog.v(TAG,"authenticate():reject"+opPackageName); return; } MetricsLogger.histogram(mContext,"fingerprint_token",opId!=0L?1:0); //Getperformancestatsobjectforthisuser. HashMappmap =(opId==0)?mPerformanceMap:mCryptoPerformanceMap; PerformanceStatsstats=pmap.get(mCurrentUserId); if(stats==null){ stats=newPerformanceStats(); pmap.put(mCurrentUserId,stats); } mPerformanceStats=stats; startAuthentication(token,opId,callingUserId,groupId,receiver, flags,restricted,opPackageName); } }); }
前面会有对包名,userid以及应用进程是否在在前台的检查,继续看
privatevoidstartAuthentication(IBindertoken,longopId,intcallingUserId,intgroupId, IFingerprintServiceReceiverreceiver,intflags,booleanrestricted, StringopPackageName){ updateActiveGroup(groupId,opPackageName); if(DEBUG)Slog.v(TAG,"startAuthentication("+opPackageName+")"); AuthenticationClientclient=newAuthenticationClient(getContext(),mHalDeviceId,token, receiver,mCurrentUserId,groupId,opId,restricted,opPackageName){ @Override publicbooleanhandleFailedAttempt(){ mFailedAttempts++; if(mFailedAttempts==MAX_FAILED_ATTEMPTS){ mPerformanceStats.lockout++; } if(inLockoutMode()){ //Failingmultipletimeswillcontinuetopushoutthelockouttime. scheduleLockoutReset(); returntrue; } returnfalse; } @Override publicvoidresetFailedAttempts(){ FingerprintService.this.resetFailedAttempts(); } @Override publicvoidnotifyUserActivity(){ FingerprintService.this.userActivity(); } @Override publicIFingerprintDaemongetFingerprintDaemon(){ returnFingerprintService.this.getFingerprintDaemon(); } }; if(inLockoutMode()){ Slog.v(TAG,"Inlockoutmode;disallowingauthentication"); //Don'tbotherstartingtheclient.Justsendtheerrormessage. if(!client.onError(FingerprintManager.FINGERPRINT_ERROR_LOCKOUT)){ Slog.w(TAG,"Cannotsendtimeoutmessagetoclient"); } return; } startClient(client,true/*initiatedByClient*/); }
AuthenticationClient继承自ClientMonitor,用于处理指纹认证相关的功能事务,ClientMonitor的其他子类如RemovalMonior,EnrollMonitor也是如此,ClientMonitor会直接与fingerprintd通信,其核心是调用其start()或stop()方法,
对于AuthenticationClient而言
privatevoidstartClient(ClientMonitornewClient,booleaninitiatedByClient){ ClientMonitorcurrentClient=mCurrentClient; if(currentClient!=null){ if(DEBUG)Slog.v(TAG,"requeststopcurrentclient"+currentClient.getOwnerString()); currentClient.stop(initiatedByClient); mPendingClient=newClient; mHandler.removeCallbacks(mResetClientState); mHandler.postDelayed(mResetClientState,CANCEL_TIMEOUT_LIMIT); }elseif(newClient!=null){ mCurrentClient=newClient; if(DEBUG)Slog.v(TAG,"startingclient" +newClient.getClass().getSuperclass().getSimpleName() +"("+newClient.getOwnerString()+")" +",initiatedByClient="+initiatedByClient+")"); newClient.start(); } } publicintstart(){ IFingerprintDaemondaemon=getFingerprintDaemon(); if(daemon==null){ Slog.w(TAG,"startauthentication:nofingeprintd!"); returnERROR_ESRCH; } try{ finalintresult=daemon.authenticate(mOpId,getGroupId()); if(result!=0){ Slog.w(TAG,"startAuthenticationfailed,result="+result); MetricsLogger.histogram(getContext(),"fingeprintd_auth_start_error",result); onError(FingerprintManager.FINGERPRINT_ERROR_HW_UNAVAILABLE); returnresult; } if(DEBUG)Slog.w(TAG,"client"+getOwnerString()+"isauthenticating..."); }catch(RemoteExceptione){ Slog.e(TAG,"startAuthenticationfailed",e); returnERROR_ESRCH; } return0;//success }
向底层发送认证命令后就只需要等待认证结果就可以了,前面我们说到在初始化的时候会建立与fingerprintd的通信,其核心是下面这行代码
mDaemon.init(mDaemonCallback);
mDaemonCallback是一个binder对象,接受来自底层的结果,然后通过FingerprintService和FingerManager一层层把结果发送到应用程序中去。
8.0的一些变化
8.0上的fingerprintd变化很大,甚至都不叫fingerprintd了,当然这是native层的东西,这里不讨论,对于FingerprintService而言,一个显著的变化是安全策略的调整
- 8.0之前,指纹只能错误5次,达到5次时会禁止指纹认证,同时开启30秒倒计时,等待结束后重置错误计数,继续认证
- 8.0之后,依然是每错误5次就会倒计时30秒,然而30秒结束后错误计数并不会被清空,8.0上加入了最大20次的限制,累计错误20次之后就无法使用指纹认证功能了,只能用密码的方式才能重置错误计数
privatestaticfinalintMAX_FAILED_ATTEMPTS_LOCKOUT_TIMED=5; privatestaticfinalintMAX_FAILED_ATTEMPTS_LOCKOUT_PERMANENT=20; privateintgetLockoutMode(){ if(mFailedAttempts>=MAX_FAILED_ATTEMPTS_LOCKOUT_PERMANENT){ returnAuthenticationClient.LOCKOUT_PERMANENT; }elseif(mFailedAttempts>0&&mTimedLockoutCleared==false&& (mFailedAttempts%MAX_FAILED_ATTEMPTS_LOCKOUT_TIMED==0)){ returnAuthenticationClient.LOCKOUT_TIMED; } returnAuthenticationClient.LOCKOUT_NONE; }
总结
以上所述是小编给大家介绍的Android7.0指纹服务FingerprintService实例介绍,希望对大家有所帮助,如果大家有任何疑问请给我留言,小编会及时回复大家的。在此也非常感谢大家对毛票票网站的支持!