Upgrade to Pro — share decks privately, control downloads, hide ads and more …

個人情報を扱うアプリと暗号化について

dotrikun
September 16, 2017

 個人情報を扱うアプリと暗号化について

iOSDC2017トーク

dotrikun

September 16, 2017
Tweet

More Decks by dotrikun

Other Decks in Technology

Transcript

  1. ݸਓ৘ใΛѻ͏ΞϓϦͱ҉߸Խʹ͍ͭͯ
    iOSDC 2017 Talk

    View full-size slide

  2. ࣗݾ঺հ
    • ࢛ํɹ༟ʢγΧλ ώϩγʣ
    • Sansanגࣜձࣾॴଐ
    • ๏ਓ޲໊͚ࢗ؅ཧΞϓϦʰSansanʱͷ։ൃνʔϜϦʔμʔ
    ݉iOSΞϓϦ։ൃΤϯδχΞ
    • ݩւ্ࣗӴୂһ
    • ݸਓ৘ใอޢ࢜

    View full-size slide

  3. લஈ
    • ࣗࣾαʔϏεͷձࣾ
    • BtoB
    • ݸਓ৘ใΛѻ͏ΞϓϦͱ҉߸Խͷ͓࿩
    • ։ൃνʔϜϦʔμʔࢹ఺

    View full-size slide

  4. ࠓ೔ͷΞδΣϯμ
    • ݸਓ৘ใอޢ͕࢜ޠΔݸਓ৘ใʹ͍ͭͯ
    • iOSΞϓϦͷ҉߸ԽͰؾΛ͚ͭΔϙΠϯτ
    • BtoBΞϓϦͷέʔεελσΟ

    View full-size slide

  5. Έͳ͞ΜͷΞϓϦͰ͸
    ݸਓ৘ใΛѻ͍ͬͯ·͔͢ʁ

    View full-size slide

  6. ͦ΋ͦ΋ݸਓ৘ใͱ͸?

    View full-size slide

  7. ݸਓ৘ใͱ͸
    • ੜଘ͢Δݸਓͷ৘ใ
    • ಛఆͷݸਓΛࣝผ͢Δ͜ͱ͕Ͱ͖Δ΋ͷ
    ‣ 1ͭͰ͸ݸਓΛࣝผͰ͖ͳͯ͘΋ɺଞͷ৘ใ
    ͱ߹ΘͤΔ͜ͱͰݸਓͷࣝผ͕ՄೳʹͳΔ
    ΋ͷ΋ݸਓ৘ใ

    View full-size slide

  8. • ࢯ໊
    • ϝʔϧΞυϨε
    • ೥ྸ
    • ੑผ
    • ॅॴ
    • ి࿩൪߸
    • إࣸਅೖΓͷΞΠίϯը૾
    • Ґஔ৘ใ
    ~ͳͲͷ૊Έ߹Θͤ

    View full-size slide

  9. ͳͥΞϓϦͰݸਓ৘ใΛकΔͷ͔ʁ
    • ݸਓ৘ใऔѻࣄۀऀ͸ݸਓ৘ใΛ؅ཧ͢Δٛ຿
    ͕͋Δ
    • ݸਓ৘ใྲྀग़ͳͲͷϦεΫ
    • اۀ͕ΞϓϦΛಋೖ͢ΔࡍͷηΩϡϦςΟج४
    ΛΫϦΞͰ͖ͳ͍
    ‣ αʔϏεͷར༻֦େνϟϯεΛಀ͢

    View full-size slide

  10. ΞϓϦͰ҉߸Խͯ͠कΔ΂͖΋ͷ

    View full-size slide

  11. ΞϓϦͰ҉߸Խͯ͠कΔ΂͖΋ͷ
    • WebAPI΍WebViewͳͲͷ௨৴
    • ϩʔΧϧʹอଘ͢ΔϑΝΠϧ΍σʔλ

    View full-size slide

  12. WebAPI΍WebViewͳͲͷ௨৴
    • SSL௨৴Λ࢖ͬͯ௨৴಺༰Λ҉߸Խ͢Δ
    • ϓϩΩγΛར༻ͨ͠தؒऀ߈ܸͳͲ΋͋Δ
    ͷͰ100%Ͱ͸ͳ͍
    • ΞϓϦଆͰ͸։ൃ࣌ʹATSΛແޮʹ͢Δઃఆ
    ͳͲ͕ϓϩμΫγϣϯʹೖΒͳ͍Α͏஫ҙ

    View full-size slide

  13. ϩʔΧϧʹอଘ͢ΔϑΝΠϧ΍σʔλ
    • ՄೳͰ͋Ε͹ݸਓ৘ใ͸ۃྗϩʔΧϧʹอଘ
    ͠ͳ͍͜ͱ͕๬·͍͠
    ‣ ͔͠͠ɺΦϑϥΠϯ࣌ͰͷΞϓϦར༻΍ɺ
    σʔλऔಘʹ͕͔͔࣌ؒΔ৔߹ͳͲɺརศ
    ੑͷͨΊʹϩʔΧϧʹஔ͔͟ΔΛಘͳ͍έʔ
    ε͕͋Δ

    View full-size slide

  14. ϩʔΧϧʹอଘ͢ΔϑΝΠϧʹ͍ͭͯ
    • iOSΞϓϦ͸αϯυϘοΫεߏ଄
    • جຊతʹଞͷ App ʹ͔Βɺอଘͨ͠ϑΝΠϧ
    ʹΞΫηε͞ΕΔ͜ͱ͸ͳ͍
    • iOS8.3͔Βݫ֨Խ͞Εͨ
    • Appάϧʔϓͷڞ༗ίϯςφͳͲྫ֎΋͋Δ

    View full-size slide

  15. ϩʔΧϧʹอଘ͢ΔϑΝΠϧʹ͍ͭͯ
    - ϑΝΠϧ࡞੒
    ϑΝΠϧอޢͷछྨ
    extension FileProtectionType {
    @available(iOS 4.0, *)
    public static let none: FileProtectionType
    @available(iOS 4.0, *)
    public static let complete: FileProtectionType
    @available(iOS 5.0, *)
    public static let completeUnlessOpen: FileProtectionType
    @available(iOS 5.0, *)
    public static let completeUntilFirstUserAuthentication: FileProtectionType
    }
    // ϑΝΠϧอޢͳ͠
    // ୺຤ͷϩοΫ࣌ʹ҉߸Խ
    // ʢϑΝΠϧΛopenͨ͠ঢ়ଶͷ৔߹Λআ͖ʣ୺຤ͷϩοΫ࣌ʹ҉߸Խ
    // ୺຤ͷϩοΫ͔࣌ΒϢʔβ͕ϩοΫղআ͢Δ·Ͱ҉߸Խ

    View full-size slide

  16. ϩʔΧϧʹอଘ͢ΔϑΝΠϧʹ͍ͭͯ
    - ϑΝΠϧ࡞੒
    iOS 7Ҏ߱ɺΞϓϦͷϑΝΠϧ࡞੒࣌ͷσϑΥϧτ͸҉߸Խ͕ઃఆ͞
    Ε͍ͯΔ
    try FileManager.default.createFile(atPath: filePath, contents: nil, attributes: nil)
    __C.FileAttributeKey(_rawValue: NSFileProtectionKey):
    NSFileProtectionCompleteUntilFirstUserAuthentication
    ʢϑΝΠϧ࡞੒ʣ
    ʢϩάͰϑΝΠϧଐੑΛ֬ೝʣ

    View full-size slide

  17. ϩʔΧϧʹอଘ͢ΔϑΝΠϧʹ͍ͭͯ
    - Data Protection
    ΞϓϦશମͰϑΝΠϧอޢΛ༗ޮʹ͢Δ
    ʢXcodeʣ
    ʢAppleDeveloperʣ

    View full-size slide

  18. ϩʔΧϧʹอଘ͢ΔϑΝΠϧʹ͍ͭͯ
    - Data Protection
    Data ProtectionΛ༗ޮʹͯ͠ϑΝΠϧΛ࡞੒͢ΔͱσϑΥϧτ͕มΘ
    Δ
    try FileManager.default.createFile(atPath: filePath, contents: nil, attributes: nil)
    __C.FileAttributeKey(_rawValue: NSFileProtectionKey):
    NSFileProtectionComplete
    ʢϑΝΠϧ࡞੒ʣ
    ʢϩάͰϑΝΠϧଐੑΛ֬ೝʣ

    View full-size slide

  19. ϩʔΧϧʹอଘ͢ΔϑΝΠϧʹ͍ͭͯ
    • CommonCryptoͳͲΛ࢖ͬͯࣗྗͰ҉߸Խ/
    ෮߸Խ͢Δ͜ͱ΋Ͱ͖Δ
    • ҉߸Խ/෮߸ԽͷύϑΥʔϚϯεʹ஫ҙ
    • ҉߸Խ/෮߸Խʹ࢖͏ൿີ伴ΛͲ͜ʹஔ͔͕͘
    ໰୊ʹ

    View full-size slide

  20. ϩʔΧϧʹอଘ͢Δσʔλ
    • KeyChainαʔϏε
    ‣ σʔλΛOSʹ༬͔ͬͯ΋Β͑Δ
    ‣ ಉ͡σϕϩούͷ App ؒͰ͋Ε͹ڞ༗Ͱ͖Δ
    ‣ ΞϓϦΛΞϯΠϯετʔϧͯ͠΋ফ͑ͳ͍
    ‣ େ͖ͳαΠζͷσʔλ͸ѻ͑ͳ͍
    • UserDefaults
    ‣ ࣮ࡍ͸plistʹอଘ͞Ε͍ͯΔͷͰϑΝΠϧͱಉ͡

    View full-size slide

  21. ϩʔΧϧʹอଘ͢Δσʔλ- Database -
    • CoreData
    ‣ ϑΝΠϧͷ҉߸Խ
    • Realm
    ‣ ҉߸Խػೳ͕͋Δ
    • FMDB/SQLite
    ‣ SQLCipherʢϥΠϒϥϦʣͰ҉߸Խ

    View full-size slide

  22. BtoBΞϓϦͷέʔεελσΟ

    View full-size slide

  23. BtoBͰ׮༰ͩͬͨͱ͜Ζ
    • ϩʔΧϧʹஔ͔ͳ͍Α͏ʹ͓͚ͯ͠͹େମΫϦΞͰ͖Δ
    • MDM΍iCloudͷϦϞʔτϫΠϓͳͲ͕ͪΌΜͱઃఆ/؅
    ཧ͞Ε͍ͯΔͱ͜Ζ΋͋Δ
    • ʮར༻ޙ͸ຖճϩάΞ΢τ͢Δʯͱ͍ͬͨӡ༻͕औΒΕ
    ͍ͯͨΓ͢Δ
    • Jailbreak΍ύείʔυϩοΫະઃఆͳͲ͸࿦֎

    View full-size slide

  24. BtoBͷγϏΞͳͱ͜Ζ
    • େاۀ΍ಛఆͷۀք
    • શࣾಋೖϞσϧ
    ‣ اۀ಺ͷશར༻ऀʹ؅ཧ͕ߦ͖ಧ͔ͳ͍ͨ
    ΊɺΞϓϦଆʹ഑ྀ͕ٻΊΒΕΔ
    • BYODʢඇMDMʣ͕࠾༻͞Ε͍ͯΔέʔε

    View full-size slide

  25. ࢀߟ
    • ʰiOSͷηΩϡϦςΟʱ
    ‣ AppleͷϗϫΠτϖʔύʔ
    ‣ https://images.apple.com/jp/business-
    docs/iOS_Security_Guide.pdf

    View full-size slide