DroidKey: a practical framework and analysis tool for API key security in Android applications.

Piyumantha, Kavindu; Senanayake, Janaka; Wijayasiriwardhane, Keerthi

Abstract

The reliance on mobile applications has amplified concerns about Application Programming Interface (API) key security in Android platforms. Serving as essential authentication mechanisms, API keys ensure secure communication with external services. However, insecure practices like hardcoding expose keys to reverse engineering and unauthorized use. This research introduces the DroidKey Analysis Tool, designed to evaluate vulnerabilities and guide developers toward secure practices. The tool integrates a comprehensive framework encompassing six security domains. The methodology combines a systematic literature review, expert feedback, and validation through controlled experiments and real-world app evaluations. Results highlight the effectiveness of DroidKey, with secure implementations, such as those of the "Sample Mobile App," achieving significantly higher security scores than their insecure counterparts. Assessments of 10 real-world banking apps further reveal widespread vulnerabilities, underscoring the tool's utility in addressing hardcoded keys and weak encryption. By leveraging industry-standard tools, the DroidKey Analysis Tool offers actionable insights to improve app security. Future enhancements, including real- time monitoring and expanded API key detection, are proposed to strengthen its functionality further. This research bridges the gap between theoretical security frameworks and practical applications, contributing to the advancement of Android app security.

Citation

PIYUMANTHA, K., SENANAYAKE, J. and WIJAYASIRIWARDHNE, K. 2025. DroidKey: a practical framework and analysis tool for API key security in android applications. In Proceedings of the 8th International research conference on Smart computing and systems Engineering 2025 (SCSE 2025), 3 April 2025, Colombo, Sri Lanka. Piscataway: IEEE [online], pages 1-6. Available from: https://doi.org/10.1109/SCSE65633.2025.11030956

• Presentation Conference Type: Conference Paper (published)
• Conference Name: 8th International research conference on Smart computing and systems engineering 2025 (SCSE 2025)
• Start Date: Apr 3, 2025
• Acceptance Date: Feb 7, 2025
• Online Publication Date: Apr 3, 2025
• Publication Date: Apr 3, 2025
• Deposit Date: Jun 20, 2025
• Publicly Available Date: Jul 8, 2025
• Publisher: Institute of Electrical and Electronics Engineers (IEEE)
• Peer Reviewed: Peer Reviewed
• Pages: 1-6
• Series ISSN: 2613-8662
• DOI: https://doi.org/10.1109/SCSE65633.2025.11030956
• Keywords: API key security; Android applications; Key management; Mobile security; Reverse engineering protection
• Public URL: https://rgu-repository.worktribe.com/output/2885910