AppPulse Mobile Whitepaper: Overhead, Privacy, and Security March 2016
Legal Notices Warranty The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HPE shall not be liable for technical or editorial errors or omissions contained herein. The information contained herein is subject to change without notice. Restricted Rights Legend Confidential computer software. Valid license from HPE required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. Copyright Notice Copyright 2015-2016 Hewlett Packard Enterprise Development LP Trademark Notices Apple is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Google is a trademark of Google Inc. AppPulse Mobile Page 2 of 11
Contents Introduction 4 How Instrumentation Works 5 Supported Mobile Operating System Versions 5 Overhead 7 Network Consumption 7 Resource Utilization 7 Application Size 7 Privacy 9 Configuring Opt-in/Opt-out 9 Security 10 Permissions 10 Data Center Security 10 AppPulse Mobile Page 3 of 11
Introduction In mobile applications, user experience isn t everything; it s the only thing! With HPE AppPulse Mobile, application owners, product managers and developers can measure what matters in user experience, focus on fixing problems that affect the most users, improve customer experience, and deliver 5-star apps! AppPulse Mobile monitors native applications installed by end-users on their devices, usually from the itunes or Google Play stores. This means that the application must be shipped with embedded AppPulse Mobile monitoring capabilities. This document describes how AppPulse Mobile affects application installation size and network consumption, and also explains how other aspects are not affected. AppPulse Mobile is a self-service SaaS solution. The following diagram illustrates the AppPulse Mobile data flow: AppPulse Mobile Page 4 of 11
How Instrumentation Works How Instrumentation Works AppPulse Mobile is a tag-less solution, with no code changes required. The instrumentation wraps listeners and methods related to user actions, which enables AppPulse Mobile to monitor the user experience by capturing, labeling, and measuring user actions. Once the mobile app is installed on a mobile device and the user launches the app and interacts with it, AppPulse Mobile automatically identifies their actions, and reports statistics about their user experience to our SaaS backend. This monitoring data is reported to HPE SaaS per application, according to the unique application key created during AppPulse Mobile on-boarding. The instrumentation process varies depending on your OS: Android. Post-build tool for Windows or Mac OS performs bytecode instrumentation. ios. Linking AppPulse Mobile framework to your xcode project. Adding AppPulse Mobile to an application does not change the way the application functions and responds to the user. Note: AppPulse Mobile does not capture data from instrumented applications when the network is unavailable or the application is in background, in order to minimize overhead on the end user device. Supported Mobile Operating System Versions Android. AppPulse Mobile supports Android from version 2.3 (Gingerbread). ios. AppPulse Mobile supports ios from version 7. AppPulse Mobile Page 5 of 11
Supported Mobile Operating System Versions Beta OS versions are not officially supported. Support for hybrid apps is currently in beta; contact us to enable hybrid support. Unsupported OS versions will not have any stability issues, they will simply not report data. AppPulse Mobile Page 6 of 11
Overhead Overhead Network Consumption HP AppPulse Mobile s report rate depends on the rate in which real users interact with the application. For a typical application where a user taps on the screen approximately 6 times per minute, AppPulse Mobile s network consumption will be approximately 600 bytes per minute. AppPulse Mobile's reporting engine limits the reporting to no more than twice every minute, and no more than 60KB per minute. The rest of the data is ignored. When a crash occurs, a crash report is sent and its size is a maximum of 128KB. AppPulse Mobile reports data regardless of whether data connectivity is WIFI or cellular. The data collected is reported in compact format, to minimize network consumption. Resource Utilization CPU Usage and Memory. We designed AppPulse Mobile to use a minimum amount of CPU and memory; for typical apps, this consumption will be insignificant relative to the application code itself. Storage Size.No data is stored by AppPulse Mobile locally. Battery Consumption. Battery consumption may be affected by network usage which we reduced to minimum; for details see "Network Consumption" above. Application Size Android. Adding AppPulse Mobile to an Android application causes it to increase in size by an additional 180-400 KB, depending on the application architecture. AppPulse Mobile Page 7 of 11
Overhead ios. The increase of ios application size depends on which architectures the app is using. When compiled for standard architectures (ARM64, ARMv7, ARMv7s), the increase in size is expected to be 500-700 KB. AppPulse Mobile Page 8 of 11
Privacy Privacy HPE AppPulse Mobile reports display statistical metrics aggregated from many users. We do not send any PII (personally identifiable information). All data sent from users' devices is filtered to remove any potentially private data, such as Social Security numbers (SSN), credit card numbers, and so on. We report only the actions and not the user input associated with them. We do not collect any information external to the application process on end-user devices. We identify a unique mobile device based on the device's secure ID (as implemented by the OS), which then undergoes asymmetric hashing encryption to protect user privacy. Example 1: If a user enters their credit card number in a credit card number field, the number itself is not reported to AppPulse Mobile, and is not displayed by AppPulse Mobile. We only report that a number was entered into the field. Example 2: If an application has a button which includes a credit card number and the user taps this button, the number itself is not reported to AppPulse Mobile. Instead, this is reported as Tap **** button in Credit card page. As part of the SDK configuration the operator can extend blocking control by specifying data they wish to block. For details, see the Setting up Android Apps and the Setting up ios Apps PDFs. Configuring Opt-in/Opt-out By default, data is automatically sent from mobile apps to HPE AppPulse Mobile. We also have opt-in/opt-out capabilities, whereby you can enable the end-user to accept or reject monitoring on their device. For details, see the Setting up Android Apps and the Setting up ios Apps PDFs. AppPulse Mobile Page 9 of 11
Security Security All data from the mobile device is sent over an HTTPS (secured) channel to port 443. Each packet is signed by a signature which validates its correctness. We support the TLS cryptographic protocol. All the data is stored using the highest security measures, as defined and verified by the HPE Security office. If your device network is behind a firewall, open access to the following address to send data to AppPulse Mobile: 15.224.193.241:443. Permissions HPE AppPulse Mobile does not add permissions to the application. On Android, AppPulse Mobile requires Network permission. Data Center Security AppPulse Mobile is hosted in HPE SaaS, which is a secured cloud service. HPE SaaS and its infrastructure are compliant with International Security Standard, ISO/IEC 27001:2013. HPE SaaS undergoes annual ISO 27001 process certification (issued by IQNet, the world s largest network of leading certification bodies) of our data facilities by the Standards Institution of Israel (SII), including organization, processing facilities, customer data and privacy, technology and services, marketing, financial, and HR data. Only HPE with a SaaS portfolio based on more than a decade of experience working with and delivering for the world s leading brands can credibly offer enterprise-class levels of availability and security. The customer is responsible for managing user and group account administration for the HPE SaaS application and making sure only valid, authorized users access the HPE SaaS application. This includes the following tasks: permissions and privileges for users and groups, account naming schemes, password policies, and authentication procedures. Such users will access and use the system only for the purposes of using the application. The customer will prohibit use of any hacker tool such as port scanners, password crackers, and network sensors on the SaaS environment. Furthermore, the customer may not perform load tests. AppPulse Mobile Page 10 of 11
Security HPE SaaS has implemented numerous physical security measures, firewalls and routers, access control lists, OS hardening, and other processes. Additional security measures include the following: Strong password policies Two-factor authentication for network devices Controlled access to database or system passwords Each data center is equipped with physical protection such as video cameras on all access points and along the perimeter, key card access and ID cards, and visual identification by 24x7 security personnel. All visits must be prearranged, otherwise access is denied. AppPulse Mobile Page 11 of 11