保护iOS上的sqlite文件 [英] Protect an sqlite file on IOS

问题描述

我花了几个月的时间收集，整理和整理一些数据。我正在构建的应用程序将能够搜索数据。到目前为止，我将sqlite文件存储在用户文件系统中，而不是存储在远程服务器上，因为我希望搜索结果能够即时提供给用户最佳的体验，而与他们的连接速度无关。

I have some data I’ve spent months collecting, cleaning and structuring. The app I'm building will be able to search the data. So far I'm storing the sqlite file in the users filesystem and not on a remote server because I want the search result to be instant to give users the best experience possible, independently of their connection speed.

但是我刚刚发现任何拥有越狱电话的人都可以窃取我的sqlite文件中的信息存储。

But I've just discovered anybody with a jailbroken phone can just "steal" the information store in my sqlite file.

我最后一件事希望某人获得我的辛勤工作的结果并将其发布在可能使该应用程序无用的网站上。

The last thing I want is for someone to get the result of my hard work and publish it on a website which could potentially makes the app useless.

有什么方法可以阻止这种情况的发生？

Is there any way to stop this from happening?

谢谢您的帮助！

推荐答案

您想要的是DRM的一种形式。最终，DRM无法阻止专门的攻击者获取底层数据。从理论上讲，用户可以访问的任何内容都可以被恶意应用程序访问。

What you want is a form of DRM. Ultimately, DRM cannot prevent a dedicated attacker from getting at the underlying data. Anything the user can access can, in theory, be accessed by a malicious application.

您可以加密数据库的行并将密钥隐藏在应用程序中的某个位置，但是勇敢的黑客会找到它。您可以在初次运行时下载整个文件，并使用该设备独有的密钥对其进行加密，但是随后您必须将密钥存储在某个地方或使用一种算法对其进行重新生成-黑客可以任意选择（即使该文件位于如果需要网络连接并使用从服务器端和客户端生成的密钥……那么，攻击者可以欺骗请求并获得该服务器端组件。

You can encrypt the rows of the database and hide the key somewhere in the app, but an intrepid hacker will find it. You can download the whole file on first run and encrypt it with a key unique to that device, but then you have to store the key somewhere or have an algorithm for regenerating it--and a hacker can get at either (even if it's in the keychain.) If you require a network connection and use a key generated from something server-side and client-side... well, an attacker can just spoof the request and get that server-side component anyway.

因此，这实际上取决于您想要获得的安全性。如果您只是想让诚实的人诚实，那么简单的加密通常就足够了。如果您想制作防弹DRM系统...您将是第一个实现它的人。

So it really depends how secure you want to be. If you just want to keep honest people honest, simple encryption is often good enough. If you want to make a bulletproof DRM system... you'd be the first to accomplish it.

这篇关于保护iOS上的sqlite文件的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！