phonegap应用程序中的本地存储保护 [英] Local storage protection in phonegap application

问题描述

我应该开发 phonegap 应用程式。我需要加密我的请求到服务器端，然后解密。
HTTPS 不是解决方案，因为我需要签署请求以确保数据不是假的。我可以使用任何异步加密（应用程序将生成私人/公共密钥，并将发送公钥到服务器）。

问题是：如何在设备上安全地保存私钥？

我可以使用 sqlclipher （加密我的本地 SQLite DB ）和将整合到我的 phonegap应用程式。很好，但是这里我必须保存数据库的密钥）

  var db = window.sqlitePlugin.openDatabase DB，key：secret1}）; 
  

任何有权访问手机的人都可以获得此密钥。所以这里我有同样的问题：）

请给我任何建议。

谢谢！ p>

ps iOS和Android版应用程式

解决方案

您必须区分加密和验证。

首先，我建议使用https加密您的邮件并安全地传输邮件。

其次，我建议使用HMAC验证您的邮件。它基本上是这样工作的：

• 在编译时生成你的应用程序和服务器已知的秘密字符串。您将此密钥直接存储在应用程序的源代码中，因此它不会传输到服务器或从服务器传输。这可能是与您的私有/公钥方法的主要区别：您将秘密权限编译到您的应用程序，而不是在以后在某些用户可访问的存储中写入。 直接进入您的应用程序意味着在Phonegap的情况下不是在您的HTML / JS文件，而是在本机源代码！




• 在用户启动您的应用时设置用户ID（=键;长，随机！应用程序的第一次。如果你想验证你的用户，你可能有某种登录/密码机制。 （存储用户ID以及根据用户ID和设备上的共享密钥生成的HMAC）。每次读取用户ID时，请检查该哈希，以确保用户ID没有被欺骗。）

在您的应用程式中

1. 在每封邮件中加入使用者编号。


2. 在每封邮件中加入时间戳记。




4. 在您的请求标头中包含哈希值

ol>



在服务器端



1. 检查时间戳是有效的，e。 G。不大于2分钟左右。


2. 检查用户ID是否有效。


3. 计算HMAC哈希值从消息，服务器地址，请求URI和共享秘密组合的字符串。包含请求URI可阻止其他人向您服务器上的另一个URI发送相同的有效请求; e。 G。在REST环境中，如果将相同的DELETE请求发送到 / comment / 1 或 / user / 1
   
4. 将其与您标题中提交的哈希值进行比较，它们必须相等。


5. 如果任何检查失败，请发送错误。




有机会获得共享密钥和有关如何通过反编译计算HMAC哈希值的方式的信息您的源代码。我没有办法避免这种风险。 ...




/developer.apple.com/library/ios/documentation/Security/Conceptual/keychainServConcepts/iPhoneTasks/iPhoneTasks.html\">https://developer.apple.com/library/ios/documentation/Security/Conceptual/keychainServConcepts/iPhoneTasks/ iPhoneTasks.html




Android安全功能





http://developer.android.com/training/articles/security-tips.html




I should develop an phonegap application. I need to encrypt my requests to the server side and then decrypt. HTTPS is not a solution, because I need to sign requests to be sure that the data is not fake. I can use any async cryptography (the app will generate private/public keys and will send public key to the server). But this way I need to keep my private key on the device.

The question is: how I can keep private key on the device securely?

I can use sqlclipher (to encrypt my local SQLite DB) and integrate it into my phonegap app. Great, but here I have to keep secret key for database :)

var db = window.sqlitePlugin.openDatabase({name: "DB", key: "secret1"});

Any one who have access to the phone can get this secret key. So here I have the same issue:)

Please, give me any suggestions.

Thanks!

p.s. app for iOS and Android

解决方案

You have to differentiate between encryption and authentication.

First, I suggest to use https to encrypt your messages and transfer them securely.

Second, I suggest to use HMAC for authentication of your messages. It basically works like this:

• Generate a secret string known to your app and the server at compile time. You store this secret directly in the source code of your app so it is never transmitted to or from the server. This might be the main difference to your private/public key approach: You compile the secret right into your app instead of writing it later in some user accessible storage. "Right into your app" means in the case of Phonegap NOT in your HTML/JS files but in the native source code! You have to bridge the accessor to javascript if necessary.

• Set a user id (=key; long, random!) in your app when the user starts your app for the first time. If you want to authenticate your users, you probably have some kind of login/password mechanism. (Store the user id as well as an HMAC generated from the user id and the shared secret on the device. Every time you read the user id, check it against the hash to be sure that the user id was not spoofed.)

In your App

1. Include a user id in every message.
2. Include a timestamp in every message.
3. Calculate the HMAC hash from a string put together from the message, the server address, the request URI, and the shared secret.
4. Include the hash value in your request header.

On the server side

1. Check if the timestamp is valid, e. g. not older than 2 minutes or so. This prevents replay attacks (at least after 2 minutes).
2. Check in your database if the user id is valid.
3. Calculate the HMAC hash from a string put together from the message, the server address, the request URI, and the shared secret. Including the request URI prevents people to send the same valid request to another URI on your server; e. g. in REST environments it is a big difference if you send the same DELETE request to /comment/1 or /user/1.
4. Compare it to the hash value submitted in your header, they have to be equal.
5. If any check fails, send an error. Otherwise send the response.

There is a chance of getting the shared secret and information about the way how you calculate the HMAC hash by decompiling your source code. I see no way to avoid this risk. ...without diving deeper into native development:

iOS Keychain

https://developer.apple.com/library/ios/documentation/Security/Conceptual/keychainServConcepts/iPhoneTasks/iPhoneTasks.html

Android security features

http://developer.android.com/training/articles/security-tips.html

这篇关于phonegap应用程序中的本地存储保护的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！