How to only allow NFC interaction with devices that have the same application/activity running

Question

I have an application that uses NFC. I want to limit the NFC interactions to other devices that are on the same activity of my application.

Problem

At the moment if I use a device A that has Chrome opened and my device B running my application, then Chrome will still detect the data sent by my app over NFC.

How can I say "if you are not running my application then you can't NFC interact with me"?

@Override
public NdefMessage createNdefMessage(NfcEvent event)
{
    String stringOut = getMacAddress(this);
    byte[] bytesOut = stringOut.getBytes();

    NdefRecord ndefRecordOut = new NdefRecord(NdefRecord.TNF_MIME_MEDIA, "text/plain".getBytes(), new byte[] {}, bytesOut);

    NdefMessage ndefMessageOut = new NdefMessage(ndefRecordOut);

    return ndefMessageOut;
}

In the code above I am sending the NFC message regardless of what activity the other device has. Maybe there is a way to wait for a reply?

Answer 1

You can't. It's the reader (tag)/receiver (peer-to-peer) side that determines which application handles an NFC event. On Android, this is done by intent filters, by the foreground dispatch system, and by the reader-mode API. Through the latter two, foreground activities may always request precedence over all other applications. There is nothing that you could do to prevent that. Moreover, peer-to-peer mode on Android (Android Beam) essentially allows only unidirectional message exchange, so you an't really perform any handshake.

While not directly preventing communication with your app by other apps, there are some options though:

1. Use encryption to render the data that you send across NFC unusable for any receiving app that does not know the decryption key.

2. Use reader-mode on one side + HCE on the other side. That way, you could perform some handshake, establish an authenticated channel, etc. And by using your own application identifier for the HCE side, you make it less likely that another app even tries to access your app.