What is device integrity checking

Definition

What is device integrity checking?

Device integrity checking tests whether a device’s software environment has been modified in ways that would let it lie: rooting, jailbreaking, emulators, mock-location apps, hooking frameworks and remote-access tools.

Why it matters for location

Device location is read by software on the device. If that software can be modified, the location can be too. Integrity checks look for the tools that make modification possible.

Rooting and jailbreaking, which give the user control the operating system normally withholds.
Emulators and virtual machines, which can present any sensor values they like.
Mock-location apps, which on Android can replace the location the system reports to other apps.
Hooking frameworks, which intercept an app’s calls and change the answers.
Remote-access tools, which let someone elsewhere operate a device that is genuinely in the right place.

Counting checks

Vendors often describe integrity checking by the number of checks. GeoComply says it runs “350 checks on every transaction”, and its 2024 product sheet for GeoComply Core says “820+ checks on every transaction”. A large number shows sustained work on the problem. It does not, by itself, say how often the checks catch what they look for, because that depends on what attackers do next.

Enumerating and constraining

There are two ways to approach integrity.

Enumerating means listing known tampering tools and looking for each one. It catches what is known, and has to keep up with what is new.
Constraining means making tampering useless. A result signed by a key in secure hardware, with the platform certifying the app is unmodified, cannot be rewritten by a hooked app, because the hooked app is not the one the platform certifies. See device-attested location.

In practice vendors use both. Constraining reduces what has to be enumerated. Neither stops a person who is genuinely in the right place from acting for someone who is not.

What this does not establish

A verdict answers for a device, not a person. It says an enrolled device was inside or outside a region at a time. It does not say who was holding it. Use it alongside identity verification, never instead of it. It does raise the cost of cheating: instead of a VPN subscription, a cheater needs real devices and a person in the permitted place for every transaction.