[Huawei Developers] Martin Bieber:
Being the official app distribution platform for Huawei over the past nine years, AppGallery provides a full-cycle security and protection system for security assurance throughout the app’s lifecycle.

The comprehensive security assurance system developed provides security assurance throughout the apps' lifecycle, including reviews of developers' qualifications, security checks before the apps' release, as well as periodic checks and user feedback tracking after their release.

As part of the comprehensive security assurance system, the four-layer protection creates a safety check at each step of the way to ensure the apps are free of malicious code, in order to ensure users are well protected against security vulnerabilities. These four security checks include malicious behaviour detection, security vulnerability scanning, privacy breach inspection, and manual recheck.

Exclusive quadruple detection ensures user privacy and security

All AppGallery apps need to pass a quadruple safety test to be eligible for release. AppGallery protects against malicious apps that may infringe user privacy or steal user property. Through careful selection and strict testing, AppGallery rejects apps that may pose security risks to users, providing users with a secure app acquisition experience.

The first of the four-layer protection includes malicious behaviour detection which focuses on detecting viruses, Trojan horses, malicious fee deduction, and malicious traffic consumption. To handle large numbers of app release requests, AppGallery uses SecDroid, a cloud-based automatic scanning platform that works with multiple well-known antivirus engines in the industry to detect viruses across Android packages (APKs). In addition, SecDroid uses sandbox-based dynamic execution technology and static feature analysis technology to detect and analyse sensitive behaviour, such as malicious billing, excessive traffic consumption, and malicious tampering of personal information.

The second layer is security vulnerability scanning, which combines dynamic and static scanning for security vulnerabilities, greatly reducing the probability of vulnerabilities or backdoors in apps. The scan covers tens of analysis and detection aspects, including the security of components and data, excessive traffic consumption, insecure command execution, analysis of APKs for potential vulnerabilities, and more.

The third layer is the privacy breach inspection, which aims to prevent apps from invoking, collecting, transmitting, or using sensitive user data, such as the address book and photo library, without users' authorisation or disregarding existing legal grounds. Both static and dynamic privacy analysis covers security vulnerabilities such as detection of corruption and breach points, identifying common issues such as key leakage, dangerous functions, and insecure algorithms. Filter criteria (such as suffix and type) are then set for refined control over scanned objects to determine the exact match locations and contexts as well as highlight the matched contents.

The final check passes through the manual recheck phase, in which a dedicated security team tests the apps in real-world scenarios to ensure compatibility, safety, as well as reliability to ensure users have the best app experience before it is released on AppGallery.

Huawei ensures a safe, private and protected digital environment on AppGallery for users

Through AppGallery, Huawei aims to strictly protect users’ privacy and security while providing them with a unique and smart experience. Serving over 730 million Huawei end users in over 170 countries and regions, AppGallery is committed to ensuring consumers enjoy a safe, private and protected digital environment as they explore unique and smart app experiences on the platform.

According to AppGallery 2020 Annual Security Report, in 2020, Huawei App Market's exclusive quadruple detection handled more than 970,000 app release applications from more than 170 countries and regions worldwide, a year-on-year increase of 27%. The extensive review filtered out 33.20% of the total app reviewed, identifying problems such as lack of copyright qualification, delayed app versions, app function defect, unexpected app exits, as well as registration and login exceptions.

In the future, AppGallery will continue its efforts to enhance the overall app experiences launched on AppGallery by updating the technologies and mechanisms for remediating risky apps, providing users with secure and high-quality apps, protecting their privacy and property security, and working with industry partners to build a green and healthy app ecosystem.

For more information, please visit https://consumer.huawei.com/en/privacy/. You may also read the latest HMS Security Technical White Paper here.