ios - iOS 数据保护如何运作

Question

我有一个简短的问题:

我下载了一个 iOS 应用程序，它使用 NSFileProtectionComplete 类来保护包含敏感信息的 sqlite 文件。

根据 iOS 安全文档 (http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf)，当设备 (iPhone/iPad) 与笔记本电脑配对时，笔记本电脑会从移动设备获取托管 key 包。 key 包包含解密设备信息所需的所有类 key 。

但是，我注意到当我将设备与笔记本电脑配对并使用 iExplorer 浏览文件系统时，sqlite 文件仅在设备解锁时可用。当手机被锁定(仍然配对)时，文件不可读。设备锁定时可以查看未使用 NSFileProtectionComplete 的文件。

如果托管 key 包包含解密信息的所有类 key ，为什么我必须解锁设备才能通过 iExplorer 访问它？

我在 iPad3 上使用 iOS 6.0 并使用 ios-dataprotection 工具 ( https://github.com/ciso/ios-dataprotection ) 来确定文件使用的数据保护类。

iOS 应用程序:AccountVault
文件:PointMinder.sqlite

我们将不胜感激。

谢谢。

Answer 1

来自您链接的文档文件:

Complete Protection (NSFileProtectionComplete): The class key is protected with a key derived from the user passcode and the device UID. Shortly after the user locks a device (10 seconds, if the Require Password setting is Immediately), the decrypted class key is discarded, rendering all data in this class inaccessible until the user enters the passcode again.

因此，如果您想访问这些文件，则应解锁设备。这就是 Apple 的做法。

编辑:在“Hacking and Securing iOS Applications”中找到:

Protection class keys are master encryption keys used to unlock files based on their access policy. Protection classes are the encryption mechanism used to enforce the access policies of files.

Some files are so important that the operating system should be able to decrypt them only when the device’s user interface is unlocked. These files’ encryption keys are wrapped with a class key that is available only after the user has entered his passcode. When the device locks again, the key is wiped from memory, making the files unavailable again.

Protection class master keys are stored in an escrow known as a keybag. The keybag contains the encrypted protection class master keys, as well as other keys to system files on the device. The system keybag is encrypted using another encryption key named BAGI, which is also stored in the effaceable storage of the NAND. Whenever the user authenticates to meet a specific security protection policy, the encrypted keys in the keybag can be decrypted.

因此，该文件的 key 已传输，但已加密。当您输入密码时，操作系统会解密该 key ，然后它可用于解密受其保护的文件。