com.samsung.aasaservice Copy

A Samsung platform component with two different names attached to it, neither of which Samsung explains. Devices in this database report the label "SecurityPolicy", while Samsung's own Knox Common Criteria mode application lists, which inventory the software preinstalled on a certified model, list the same package as "AASAservice". Samsung publishes no description of the component and does not expand the abbreviation anywhere we could find, so this note does not expand it and does not infer a purpose from either name. In particular, do not read the device-reported label as documentation that this is what enforces security policy on a Galaxy device: nothing we found supports that, and Knox policy enforcement is documented separately. What can be stated is the provenance recorded here. It is preinstalled and Samsung-signed with certificates that also sign the framework, and it has no launcher entry in our sample. Its permission set is large, up to 71 permissions, and mixed in character. Some entries are consistent with a privileged background service: RECEIVE_BOOT_COMPLETED, SCHEDULE_EXACT_ALARM and USE_EXACT_ALARM, INTERNET and ACCESS_NETWORK_STATE, POST_NOTIFICATIONS, INTERACT_ACROSS_USERS and INTERACT_ACROSS_USERS_FULL, and REAL_GET_TASKS, which is a signature or privileged permission that exposes what is running on the device. Others are Samsung-defined and point at Samsung subsystems rather than at the platform: READ_SCPM and WRITE_SCPM, com.samsung.android.asksmanager.permission.BIND_ASKS_MANAGER, com.samsung.android.sm.permission.BIND_DEVICE_SECURITY, com.sec.android.SYSTEM_FILE_ACCESS and two private access token permissions. The set also includes a long block of bind permissions for Samsung's on-device AI services under com.samsung.android.intellivoiceservice, com.samsung.android.aicore, com.samsung.android.scs and com.samsung.android.visual.cloudcore. This site aggregates permissions across all observations of a package rather than reporting them per build, so which builds declare which of these cannot be established from the record. What any of that does in practice is not published, and the mixture of a security-sounding label with AI service bindings is exactly the kind of thing that should not be guessed at. Version note: this package has clearly changed, and the version history is the evidence. Samsung's Common Criteria lists record version 6.4 on the Galaxy S7 LTE (Android 8), 12.0 on the Galaxy S20+ 5G (Android 10) and 15 on the Galaxy S21+ 5G (Android 11), all in a plain incrementing series. This database's sample then spans 23 through to 3.0.05.0, so the numbering was reset onto a new 1.x, 2.x, 3.x line partway through, with target SDKs from 31 to 36 and package size rising from roughly 82 KB to 5.7 MB. A version scheme reset alongside a seventyfold size range is a strong hint that something about the component changed substantially, though on its own it does not establish what. Which Android or One UI release any such change landed in, and what the component does differently as a result, could not be sourced. No observation in our sample is marked Play-eligible, so it ships and updates with firmware on the devices we have seen. For Android Enterprise, EMM and kiosk fleets, no source was found identifying it as an enrolment, policy or compliance dependency, and no source describes what it does at all. That absence is the finding. It is a privileged, network-capable, boot-starting component that can see running tasks and act across users, on a device where the vendor documents neither its function nor its data handling. If a deployment needs to account for every privileged vendor component, this one cannot be signed off from public documentation and is a reasonable thing to raise with Samsung or your device supplier directly. Because its function could not be established, no disable recommendation is given here, and anyone considering acting on it should treat that as an experiment on a single device rather than a fleet change.

• Galaxy S21+ 5G (SM-G996B, Android 11) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S20+ 5G (SM-G986U1, Android 10) Common Criteria mode application list - Samsung Knox Documentation →
• Galaxy S7 LTE (SM-G930R4, Android 8) Common Criteria mode application list - Samsung Knox Documentation →
• Package provenance for com.samsung.aasaservice - Android System App Database →

• Signed by the device maker's own signing key (Samsung), so it is an OEM preinstall, but 2 different certificates appear across the fleet, so OEMs ship their own builds of it. It also signs the Android framework, so it is a platform-level key on its device(s). Inferred from the certificate appearing only on Samsung devices (508 packages, 10196 observations).
• Its largest observed manifest declares 71 permissions: 1 runtime (user-granted), 5 signature or system-level, 4 install-time and 61 vendor or uncatalogued.
• APK size ranges from 0.1 MB to 5.5 MB across the reporting device profiles, so the build differs substantially between them.
• Never reported as user-facing, so it runs as a background or system component rather than an app the user opens.