Passing information to a HostApduService from another Context

Question

This has been asked before with no responses, so I will try to phrase the question a bit differently. What are the various ways to pass some data to an Android Service without being able to bind to it or start it myself?

Here's the issue - I have a HostApduService that is started by the operating system on every NFC card transaction. It requires the permission android.permission.BIND_NFC_SERVICE, which is a system permission, so my application can't bind to it. I don't want to leave data at rest so anything that gets written to the disk is a no-go. I thought of a few possible solutions, but they are either messy or insecure:

1. Put the data in our app's SharedPreferences. This presents a DAR issue.
2. Broadcast information to the Service. The HostApduService runs for the duration of the card transaction, so I can't reliably time the broadcast to reach the service before it starts working.
3. Put the information I want to pass in into a static field somewhere. This is messy and could potentially cause concurrency issues, but is what I'm currently using.

Any other ideas? Thanks in advance.

Answer 1

I think this question comes down to another question:

How would you store (persistent) data within a bound service?

The HCE service is a bound service, thus it is only guaranteed to run while its calling context exists (see here). As a result, whatever data you store within the service (→ variables that exist in RAM) will only exist for the lifetime of the service and will no longer be available after the service is restarted.

Consequently, binding to the service and setting some values within the service would not reliably work, even if you could bind to the HCE service. The same issue applies to data that you broadcast to the service.

A similar problem exists with storing values in static fields. Those fields only exist as long as their declaring context (i.e. the class they are declared in) is loaded in the virtual machine's memory. As the VM can be killed at any time when the service is not used and no activity of the app is displayed in the foreground, you can't be sure that data you put into static fields survives the whole duration that you need it.

So the only reliable method to store your data is to use persistent storage technology, which is to either use the SharedPreferences mechanism, to use a content provider (that's backed by a database on persistent storage) or to directly store data to files. I guess the best you could do is to store the data on the files system encrypted. However, this brings you to another issue: How to (securely) store the encryption key. But you might be able to adeqately solve that isse using the Android key store (see here and here).