README.md
1# ASSET
2
3## Introduction
4
5The asset store service (ASSET) provides secure storage and management of sensitive data less than 1024 bytes in size, including passwords, app tokens, and other critical data (such as bank card numbers).
6
7The following figure shows the ASSET architecture.
8
9
10
11An application can perform the following operations using ASSET:
12
13- Adding an asset: ASSET generates a unique key for the application, uses the key to encrypt the asset, and stores the encrypted asset in the database.
14- Updating an asset: ASSET encrypts the new asset using the unique key of the application and updates the data in the database.
15- Querying an asset: ASSET obtains the asset ciphertext from the database based on the query conditions specified, verifies the access permission of the application, uses the unique key of the application to decrypt the asset ciphertext, and returns the plaintext to the application.
16- Removing an asset: ASSET removes the asset that matches the specified conditions.
17
18The secure storage of assets depends on the underlying HUKS. Specifically, HUKS implements the asset encryption, decryption, and access control in a secure environment (such as a TEE). The sensitive user data will never be disclosed even if the system is attacked.
19
20For the scenarios demanding higher security, ASSET allows access to assets only after a successful user identity authentication. Before accessing assets that require identity access control, an application needs to launch a user prompt for user identity authentication (PIN, fingerprint, or facial authentication). After the application sends the user authentication result to ASSET, ASSET invokes HUKS to verify the authentication result. If the verification is successful, HUKS decrypts the asset in a secure environment and returns the plaintext.
21
22With the APIs provided by ASSET, you can quickly integrate system-wide encrypted storage and access control mechanisms for short sensitive data.
23
24## Directory Structure
25
26```bash
27├── frameworks # Framework code
28│ ├── definition # Definitions of common data types
29│ ├── ipc # IPC APIs
30│ ├── js # Code for interaction between JS and C/C++
31│ ├── os_dependency # Adaptation of universal system capabilities
32│ └── utils # Utility APIs
33├── interfaces # APIs exposed externally
34│ ├── inner_api # APIs for system abilities (SAs)
35│ └── kits # APIs for user applications
36├── sa_profile # SA profiles
37└── services # Service layer code
38 ├── constants # Constants of the service layer
39 ├── core_service # Core service module
40 ├── crypto_manager # Data encryption/decryption module
41 ├── db_operator # Data management module
42 └── os_dependency # System capability adaptation module
43```
44
45## Build
46
47The following uses rk3568 as an example.
48
49```bash
50# Build the source code of the module.
51./build.sh --product-name rk3568 --ccache --build-target asset
52
53# Build the test code of the module.
54./build.sh --product-name rk3568 --ccache --build-target asset_bin_test
55```
56
57## Usage
58### Available APIs
59
60[API reference](https://gitee.com/openharmony/docs/blob/master/en/application-dev/reference/apis-asset-store-kit/Readme-EN.md)
61
62### Development Guide
63
64[Development guide](https://gitee.com/openharmony/docs/blob/master/en/application-dev/security/AssetStoreKit/Readme-EN.md)
65
66## Repositories Involved
67**[HUKS](https://gitee.com/openharmony/security_huks)**
68
69**[UserIAM](https://gitee.com/openharmony/useriam_user_auth_framework)**
70
