有没有办法在Android中安全地处理内存中的敏感数据？ [英] Is there a way to process sensitive data in memory securely on Android?

问题描述

我正在使用一些我从Android中的文件解密的内容，并且需要在内存中的整个应用程序中保留。这是饼干的安全隐患吗？如果是这样，Android是否提供某种形式的内存保护敏感内容，类似于Windows的进程安全内存访问保护机制？

I am working with some content which I decrypt from a file in Android and which needs to remain for the entire duration of the application in memory. Is this a security risk from crackers? If so, does Android offer some form of in-memory protection of sensitive content similar to Windows' process secure memory access protection mechanism?

我不是通过SharedPreferences寻找存储在私人模式下，我需要一些无法进行篡改的内存区域。将本地缓冲区中的数据存储为一个很好的路由？我还意识到，不可变的，垃圾收集的String对象可能是存储此数据的一个非常糟糕的主意，我目前正在使用char []。

I am not looking for storage via SharedPreferences in Private mode, I would need some memory zone which is inaccessible for tampering. Would storing data in native buffers be a good route? I also realize that non-mutable, garbage-collected String objects are probably a very bad idea for storing this data and I am currently using char[].

推荐答案

这是破解者的安全风险吗？如果是这样，Android是否提供某种形式的内存保护敏感内容，类似于Windows的进程安全内存访问保护机制？

Is this a security risk from crackers? If so, does Android offer some form of in-memory protection of sensitive content similar to Windows' process secure memory access protection mechanism?

Android进程的内存只能由该应用的用户帐户或超级用户访问。因此，任何拥有超级用户权限的用户（在Android术语中都是有根的设备用户）原则上可以使用内核调试器访问您的进程的内存。

The memory of an Android process can only be accessed by that app's user account or a superuser. Hence, anyone with superuser privileges (in Android terms: rooted device users) could, in principle, access your process' memory using a kernel debugger.

AFAIK每个现代操作系统在类似的模式下工作。因此，Android在这方面的安全性不如Windows，OS X，Linux等。事实上，Android正在使用实际的Linux进程安全性来实现。

AFAIK, every modern operating system works under a similar model. Hence, Android is no less secure in this respect than is Windows, OS X, Linux, etc. In fact, Android is using actual Linux process security for its own implementation.

请参阅访问Linux 2.6.x下的任何内存位置更多。

将本机缓冲区中的数据存储在一个好的路由？

Would storing data in native buffers be a good route?

这不会有影响。

这篇关于有没有办法在Android中安全地处理内存中的敏感数据？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！