App Attestation
App attestation is a protocol through which a backend evaluates cryptographic or platform-issued evidence about an app instance, its identity, its installation or delivery context, and sometimes device properties.
Read guideUse precise language
Mobile RASP Glossary
Plain-English definitions for the technical and risk terms used in Mobile RASP architecture, implementation, testing, operations, and procurement.
24 focused guides3 cornerstone topicsPrimary sources first
Working position
What this section is built to answer
Mobile security terms often describe different trust questions even when vendors use them interchangeably. A precise definition should state what is being observed, which system makes the decision, what the evidence can support, and what it cannot prove.
- Align engineering, security, fraud, legal, and procurement language
- Distinguish related concepts before writing requirements
- Use definitions as a starting point, then verify platform-specific behavior
Complete topic set
Mobile RASP Glossary guides
Application Hardening
Application hardening changes code, resources, build output, configuration, and runtime behavior to increase resistance to analysis, alteration, extraction, or misuse.
Read guideAnti-Tamper
Anti-tamper controls prevent, detect, or respond to unauthorized changes in application code, resources, configuration, signatures, execution state, or protected data.
Read guideAnti-Debugging
Anti-debugging is the use of checks and countermeasures to detect, disrupt, complicate, or record attempts to observe and control an application with debugging facilities.
Read guideCode Obfuscation
Code obfuscation transforms program representation to make structure, names, control flow, strings, or data harder to understand while preserving intended behavior.
Read guideControl-Flow Integrity
Control-flow integrity constrains or checks whether execution follows allowed transfers between code locations, helping detect or prevent some redirection, patching, and memory-corruption outcomes.
Read guideDevice Integrity
Device integrity is evidence about whether a device satisfies defined platform, boot, certification, compromise, or environment properties at a point in time.
Read guideEnvironment Integrity
Environment integrity describes whether the app appears to execute within expected operating-system, device, process, library, and configuration conditions.
Read guideRuntime Integrity
Runtime integrity is confidence that executing code, loaded components, critical state, and control flow remain consistent with protected expectations while the application runs.
Read guideRisk-Based Authentication
Risk-based authentication adjusts authentication or authorization using context such as account history, device, session, behavior, transaction, and runtime evidence.
Read guideRemote Attestation
Remote attestation is the remote verification of evidence about software or platform state, usually rooted in cryptographic keys or a trusted service rather than an unauthenticated client assertion.
Read guideCertificate Pinning
Certificate pinning restricts a client connection to designated certificates or public keys in addition to ordinary platform trust validation.
Read guideJailbroken Device
A jailbroken device is an Apple mobile device whose normal platform restrictions have been modified or bypassed to permit capabilities such as expanded filesystem access, unsigned code, injection, or system customization.
Read guideRooted Device
A rooted device is typically an Android device where software can obtain elevated privileges or where boot and system trust assumptions have been altered to enable deeper control.
Read guideDynamic Analysis
Dynamic analysis examines an application while it executes, using observation, instrumentation, debugging, interaction, network inspection, memory analysis, or controlled manipulation.
Read guideStatic Analysis
Static analysis examines source or packaged artifacts without relying on live execution, revealing structure, strings, permissions, APIs, resources, data flow, configuration, and potential control locations.
Read guideRuntime Hooking
Runtime hooking intercepts or replaces a function, method, symbol, call target, or execution path so an observer can inspect or alter inputs, outputs, and behavior.
Read guideInstrumentation
Instrumentation adds observation or control points to software. It may be legitimate at build time for protection and observability, or introduced dynamically for testing, research, debugging, or attack.
Read guideApp Repackaging
App repackaging is the process of unpacking an application, altering code or resources, rebuilding it, signing it under another identity, and redistributing the modified package.
Read guideSideloading
Sideloading installs an app outside the platform's usual first-party marketplace or managed distribution path. It may be legitimate, enterprise-controlled, or used to deliver counterfeit and repackaged builds.
Read guideSecure Storage
Secure storage uses platform-protected containers and access policies for keys, tokens, credentials, and sensitive data, such as Android Keystore and the Apple Keychain.
Read guideHardware-Backed Key
A hardware-backed key is generated, stored, or operated on within a hardware-isolated security component so private key material is harder or impossible to export through normal software interfaces.
Read guideCryptographic Nonce
A nonce is a value intended for one-time or uniquely scoped use so a proof, assertion, or signed request cannot be accepted again outside its intended context.
Read guideReplay Attack
A replay attack captures a valid request, token, assertion, or transaction message and submits it again to reproduce an authorized outcome without recreating the original trust conditions.
Read guideNo guides match that filter.
Test before trust
Evidence expected from this topic cluster
Validation
- Ask whether a term names a signal, control, outcome, or assurance claim
- Check the definition against primary platform or standards documentation
- Record product-specific meanings where they differ
Failure modes to avoid
- Using attestation and device integrity as synonyms
- Calling hardening a guarantee against reverse engineering
- Treating a detection label as proof of malicious intent