实施和测试 iOS 数据保护 [英] Implementing and Testing iOS data protection
问题描述
刚刚看到了 209 年会议 - 保护 2010 年 WWDC 的应用程序数据.
Just saw the Session 209 - Securing Application Data from de 2010 WWDC.
主题演讲解释了很多事情，包括您可以为文件设置数据保护属性的方式(NSFileProtectionComplete、NSFileProtectionNone)以及如何确定哪种保护最适合您的情况.
The keynote explains a lot of things, including the way you can set data protection attributes to your files (NSFileProtectionComplete, NSFileProtectionNone) and how to decide which protection is best for your case.
我刚刚实现了它，但不知道如何测试安全性是否开启，有什么想法吗?
I just implemented it, but can't figure out how to test if the security is on, any ideas?
另外，我有一个sql lite数据库需要不时在后台访问，这种数据保护的方法似乎还不够好..任何指导我完成最佳db保护的链接或教程?(找到了 sql 密码，但在进化的项目中添加有点繁重)
In addition, I have a sql lite database that needs to be accessed in background from time to time, and this method of data protection seems to be not good enough.. any link or tutorial that guide me through the best db protection? (found sql cipher but is kinda heavy to add in a evoluted project)
谢谢！
推荐答案
更新:在 iOS 6 中，据说可以通过使用需要在iOS 配置文件中的应用 ID.我还没有测试过，这是我能找到的最好的信息 https://devforums.apple.com/message/707939#707939
Update: With iOS 6 it's supposedly possible to require data protection for your application by using an entitlement that needs to be configured on the App ID in the iOS provisioning profile. I haven't tested this yet, and this is the best information I could find on it https://devforums.apple.com/message/707939#707939
我对此事的调查使我相信，很难确定设备是否启用了数据保护.
My investigations into this matter lead me to believe that it is very difficult to determine if data protection is enabled on a device.
通过将 NSFileProtectionKey 文件属性设置为 NSFileProtectionComplete
File protection is enabled by setting the NSFileProtectionKey file attribute to NSFileProtectionComplete
例如，要创建受保护的文件，您可以运行如下代码:
For example, to create a protected file you could run code like:
[[NSFileManager defaultManager] createFileAtPath:[self filePath]
contents:[@"super secret file contents" dataUsingEncoding:NSUTF8StringEncoding]
attributes:[NSDictionary dictionaryWithObject:NSFileProtectionComplete
forKey:NSFileProtectionKey]];
不幸的是，即使设备上未启用数据保护(或者如果代码在数据保护不可用的模拟器上运行)，此代码也将执行而不会出错.
Unfortunately this code will execute without error even if Data Protection is not enabled on the device (or if the code is run on the Simulator where Data Protection is not available).
更糟糕的是，无论文件是否受保护，都会设置 NSFileProtectionComplete 属性.以下:
Worse, the NSFileProtectionComplete attribute will be be set regardless of whether the file is protected or not. The following:
self.fileProtectionValue = [[[NSFileManager defaultManager] attributesOfItemAtPath:[self filePath]
error:NULL] valueForKey:NSFileProtectionKey];
NSLog(@"file protection value: %@", self.fileProtectionValue);
无论是否开启数据保护都会吐出file protection value: NSFileProtectionComplete.
will spit out file protection value: NSFileProtectionComplete no matter whether Data Protection is enabled or not.
我可以使用两种方法来发现文件保护是否按预期工作.遗憾的是，这两种方法都不适用于检测现场设备上是否启用了数据保护.
There are two methods that I've been able to use to discover if File Protection is working as expected. Unfortunately neither of these methods are suitable for detecting if Data Protection is enabled on a device in the field.
这两种方法的工作原理都是，如果设备被锁定，则无法读取受保护的文件.
Both methods work on the idea that a protected file can not be read if the device is locked.
方法一涉及使用计时器在设备锁定后尝试读取文件，但同时您的应用程序继续运行:
Method one involves using a timer to attempt to read the file after the device is locked, but while your application continues to run:
[self performSelector:@selector(doReload) withObject:nil afterDelay:20];
- (void)doReload {
NSLog(@"protected data available: %@",[[UIApplication sharedApplication] isProtectedDataAvailable] ? @"yes" : @"no");
NSError *error;
self.fileContents = [NSString stringWithContentsOfFile:[self filePath]
encoding:NSUTF8StringEncoding
error:&error];
NSLog(@"file contents: %@
error: %@", self.fileContents, error);
}
如果您运行上述代码并锁定受数据保护的设备，它将吐出:
If you run the above code and lock a data protected device it will spit out:
protected data available: no
file contents: (null)
error: Error Domain=NSCocoaErrorDomain Code=257 "The operation couldn’t be completed. (Cocoa error 257.)" UserInfo=0x16e110 {NSFilePath=/var/mobile/Applications/D71F1F1F-6C25-4848-BB1F-51539B47EC79/Documents/protected_file, NSUnderlyingError=0x16e010 "The operation couldn’t be completed. Operation not permitted"}
20 秒的延迟是必要的，因为在启用数据保护的设备被锁定后，受保护的数据仍有 10 秒左右的宽限期.
The 20 second delay is necessary because there is a 10 second or so grace period where protected data is still available after a Data Protection enabled device is locked.
第二种方法是在应用程序中创建一个受保护的文件，退出应用程序，锁定设备，等待 10 秒，然后使用 XCode 管理器下载应用程序的内容.这将产生一条错误消息，受保护的文件将为空.
The second method is to create a protected file in an application, exit the application, lock the device, wait 10 seconds, and then use the XCode organizer to download the contents of the application. This will produce an error message and the protected file will be empty.
如果上述测试中的任何一项未能按所述进行，则数据保护未启用，或者您的文件保护代码未正确实施.
If either of the above tests fail to behave as described then Data Protection is either not enable, or your File Protection code was not implemented correctly.
因为在将机密信息写入磁盘之前，我没有找到任何方法在应用程序中验证数据保护已启用，所以我已向 Apple 提交了功能增强请求，以便能够将应用程序标记为需要数据保护被启用.(rdar://10167256)
Because I've not found any way to verify within the application that Data Protection is enabled before I write confidential information to disk, I've filed a feature enhancement request with Apple to be able to mark an application as requiring Data Protection to be enabled. (rdar://10167256)
Apple 确实通过其移动设备管理 (MDM) API 提供了解决方案，该 API 与第三方服务器相结合，可用于强制执行要求在设备上启用数据保护的策略.
Apple does offer a solution to this through their Mobile Device Management (MDM) APIs, which combined with a third party server can be used to enforce policies that require Data Protection to be enabled on devices.
这篇关于实施和测试 iOS 数据保护的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
