Introducing a dependable strategy to time retaining on your apps

Posted by Kanyinsola Fapohunda – Software program Engineer, and Geoffrey Boullanger – Technical Lead

Correct time is essential for all kinds of app functionalities, from scheduling and occasion administration to transaction logging and safety protocols. Nonetheless, a consumer can change the system’s time, so a extra correct supply of time than the system’s native system time could also be required. That is why we’re introducing the TrustedTime API that leverages Google’s infrastructure to ship a reliable timestamp, unbiased of the system’s probably manipulated native time settings.

How does TrustedTime work?

The brand new API leverages Google’s safe infrastructure to supply a trusted time supply to your app. TrustedTime periodically syncs its clock to Google’s servers, which have entry to a extremely correct time supply, in order that you do not want to make a server request each time you need to know the present community time. Moreover, we have built-in a singular mannequin that calculates the system’s clock drift. This may inform you when the time could also be inaccurate between community synchronizations.

Why is an correct supply of time essential?

Many apps depend on the system’s clock for numerous options. Nonetheless, customers can change their system’s time settings, both deliberately or unintentionally, subsequently altering the time that your app will get. This may result in issues equivalent to:

• Information Inconsistency: Apps counting on chronological occasion ordering are weak to information corruption if customers manipulate system time. TrustedTime mitigates this threat by offering a reliable time supply.
• Safety Gaps: Time-based safety measures, like one-time passwords or timed entry controls require an unaltered time supply to be efficient.
• Unreliable Scheduling: Apps that rely on correct scheduling, like calendar or reminder apps, can malfunction if the system clock (i.e. Unix timestamp) is inaccurate.
• Inaccurate Time: The system’s inner clock can drift on account of numerous components, equivalent to temperature, doze mode, battery stage, and so on. This may result in issues in functions that require extra precision. The TrustedTime API additionally gives the estimated error with the timestamps, in an effort to guarantee your app’s time-sensitive operations are carried out appropriately.
• Lack of Consistency Between Units: Inconsistent time throughout gadgets may cause issues in multi-device situations, equivalent to gaming or collaborative functions. The TrustedTime API helps make sure that all gadgets have a constant view of time, bettering the consumer expertise.
• Pointless Energy and Information Consumption: TrustedTime is designed to be extra environment friendly than calling an NTP server each time an app wants the present time. It avoids the overhead of repeated community requests by periodically syncing its clock with time servers. This synced time is then used as a reference level, and the TrustedTime API calculates the present time primarily based on the system’s inner clock. This strategy reduces community utilization and improves efficiency for apps that want frequent time checks.

TrustedTime Use Instances

The TrustedTime API opens up a variety of prospects for enhancing the reliability and safety of your apps, with use instances in areas equivalent to:

• Monetary Purposes: Make sure the accuracy of transaction timestamps even when the system is offline, stopping fraud and disputes.
• Gaming: Implement honest play by stopping customers from manipulating the sport clock to realize an unfair benefit.
• Restricted-Time Presents: Assure that promotions and presents expire on the right time, whatever the consumer’s system settings.
• E-commerce: Precisely observe order processing and supply occasions.
• Content material Licensing: Implement time-based restrictions on digital content material, like leases or subscriptions.
• IoT Units: Synchronize clocks throughout a number of gadgets for constant information logging and management.
• Productiveness apps: Precisely document the time of any modifications made to cloud paperwork whereas offline.

Getting began with the TrustedTime API

The TrustedTime API is constructed on high of Google Play companies, making integration seamless for many Android builders.

The best approach to combine is to initialize the TrustedTimeClient early in your app lifecycle, equivalent to within the onCreate() technique of your Software class. The next instance makes use of dependency injection with Hilt to make the time consumer out there to elements all through the app.

[Optional] Setup dependency injection

// TrustedTimeClientAccessor.kt
import com.google.android.gms.duties.Process
import com.google.android.gms.time.TrustedTimeClient

interface TrustedTimeClientAccessor {
  enjoyable createClient(): Process<TrustedTimeClient>
}

// TrustedTimeModule.kt
@Module
@InstallIn(SingletonComponent::class)
class TrustedTimeModule {
  @Gives
  enjoyable provideTrustedTimeClientAccessor(
    @ApplicationContext context: Context
  ): TrustedTimeClientAccessor {
    return object : TrustedTimeClientAccessor {
      override enjoyable createClient(): Process<TrustedTimeClient> {
        return TrustedTime.createClient(context)
      }
    }
  }
}

Initialize early in your app’s lifecycle

// TrustedTimeDemoApplication.kt
@HiltAndroidApp
class TrustedTimeDemoApplication : Software() {

  @Inject
  lateinit var trustedTimeClientAccessor: TrustedTimeClientAccessor

  var trustedTimeClient: TrustedTimeClient? = null
    personal set

  override enjoyable onCreate() {
    tremendous.onCreate()
    trustedTimeClientAccessor.createClient().addOnCompleteListener { process ->
      if (process.isSuccessful) {
        // Stash the consumer
        trustedTimeClient = process.consequence
      } else {
        // Deal with error, possibly retry later
        val exception = process.exception
      }
    }
    // To make use of Kotlin Coroutine, you should utilize the await() technique, 
    // see https://builders.google.com/android/guides/duties#kotlin_coroutine for more information.
  }
}

NOTE: In the event you do not use dependency injection in your app. You'll be able to merely name
`TrustedTime.createClient(context)` as an alternative of utilizing a TrustedTimeClientAccessor.

Use TrustedTimeClient wherever in your app

// Retrieve the TrustedTimeClient out of your utility class
  val myApp = applicationContext as TrustedTimeDemoApplication

  // On this instance, System.currentTimeMillis() is used as a fallback if the
  // consumer is null (i.e. consumer creation process failed) or when there is no such thing as a time
  // sign out there. It's possible you'll not need to do that if utilizing the system clock is
  // not appropriate on your use case.
  val currentTimeMillis =
    myApp.trustedTimeClient?.computeCurrentUnixEpochMillis()
        ?: System.currentTimeMillis()
  // trustedTimeClient.computeCurrentInstant() can be utilized if On the spot is
  // most popular to lengthy for Unix epoch occasions and you'll be able to use the APIs.

Use in short-lived elements like Exercise

@AndroidEntryPoint
class MainActivity : AppCompatActivity() {
  @Inject
  lateinit var trustedTimeAccessor: TrustedTimeAccessor

   personal var trustedTimeClient: TrustedTimeClient? = null

  override enjoyable onCreate(savedInstanceState: Bundle?) {
    tremendous.onCreate(savedInstanceState)
    ...
    trustedTimeAccessor.createClient().addOnCompleteListener { process ->
      if (process.isSuccessful) {
          // Stash the consumer
          trustedTimeClient = process.consequence
        } else {
         // Deal with error, possibly retry later or use one other time supply.
          val exception = process.exception
        }
    }
  }

  personal enjoyable getCurrentTimeInMillis() : Lengthy? {
    return trustedTimeClient?.computeCurrentUnixEpochMillis()
  }
}

TrustedTime API availability and limitations

The TrustedTime API is on the market on all gadgets operating Google Play companies on Android 5 (Lollipop) and above. You want to add the dependency com.google.android.gms:play-services-time:16.0.1 (or above) to entry the brand new API. No extra permission is required to make use of this API. Nonetheless, TrustedTime wants an web connection after the system begins as much as present timestamps. If the system hasn’t linked to the web since booting, the TrustedTime APIs will not return timestamps.

It’s essential to notice that the system’s inner clock can drift on account of components like temperature, doze mode, and battery stage. TrustedTime does not stop this drift, however its APIs present an error estimate for every timestamp. Use this estimate to find out if the timestamp’s accuracy meets your utility’s necessities. Whereas TrustedTime makes it harder for customers to govern the time accessed by your app, it doesn’t assure full security. Superior methods can nonetheless be used to tamper with the system’s time.

Subsequent steps

To study extra concerning the TrustedTime API, try the next assets: