Foydalanuvchining himoyalangan ma'lumotlarini qaerga…

iOS uchun foydalanuvchi himoyalangan ma'lumotlarini saqlash uchun, ma'lumotlar turi va xavfsizlik darajasiga qarab quyidagi joylardan foydalanardim:

Keychain Services:

Maxfiy ma'lumotlarni, masalan, parollar, autentifikatsiya tokenlari, shifrlash kalitlarini saqlash uchun ideal.
securityd tizim demon keychainni boshqaradi va ma'lumotlarni diskda shifrlangan holda saqlaydi.
Turli kirish darajalarini qo'llab-quvvatlaydi (masalan, faqat qurilma bloklangan bo'lsa kirish mumkin).
Ma'lumotlar iCloud Keychain orqali avtomatik sinxronlashtiriladi, agar yoqilgan bo'lsa.

import Foundation
import Security

func savePassword(service: String, account: String, password: String) -> OSStatus {
    let data = password.data(using: .utf8)!
    let query: [String: Any] = [
        kSecClass as String: kSecClassGenericPassword,
        kSecAttrService as String: service,
        kSecAttrAccount as String: account,
        kSecValueData as String: data
    ]

    SecItemDelete(query as CFDictionary) // Mavjud yozuvni o'chirish
    return SecItemAdd(query as CFDictionary, nil) // Yangi yozuv qo'shish
}

Shifrlangan Core Data / Realm:

Tuzilgan ma'lumotlarni, bazada shifrlashni talab qiladigan.
Core Data shifrlash uchun uch tomonli kengaytmalarni qo'llab-quvvatlaydi (masalan, RNCryptor).
Realm Database faylini o'z ichiga olgan shifrlashni ta'minlaydi.
Shifrlash kaliti Keychainda saqlanishi kerak.

// Realm shifrlash bilan sozlash misoli
import RealmSwift

func setupEncryptedRealm() throws {
    var config = Realm.Configuration()
    if let key = KeychainHelper.getRealmEncryptionKey() { // Kalitni Keychaindan olamiz
        config.encryptionKey = key
    } else {
        // Yangi kalit yaratamiz, uni Keychainga saqlaymiz va foydalanamiz
        let newKey = NSMutableData(length: 64)!
        _ = SecRandomCopyBytes(kSecRandomDefault, newKey.length, newKey.mutableBytes)
        KeychainHelper.saveRealmEncryptionKey(key: newKey as Data)
        config.encryptionKey = newKey as Data
    }

    let realm = try Realm(configuration: config)
    // Realmdan foydalanamiz
}

Faylni himoyalash APIlari:

Fayl tizimida saqlangan fayllarni shifrlash uchun.
iOS fayl tizimidagi fayllarni Secure Enclave yordamida boshqariladigan kalitlar bilan avtomatik shifrlaydi.
Faylga kirishni nazorat qilish uchun turli himoya rejimlarini (masalan, complete, completeUnlessOpen, completeUntilFirstUserAuthentication, none) o'rnatish mumkin.

func saveProtectedDataToFile(data: Data, fileName: String) throws {
    let fileManager = FileManager.default
    let urls = fileManager.urls(for: .documentDirectory, in: .userDomainMask)
    guard let documentDirectory = urls.first else { throw NSError(domain: "MyApp", code: 1, userInfo: [NSLocalizedDescriptionKey: "Hujjatlar katalogi topilmadi"]) }

    let fileURL = documentDirectory.appendingPathComponent(fileName)

    // Himoya rejimini o'rnatamiz
    let options: Data.WritingOptions = .atomicWrite
    let protectedOptions: Data.WritingOptions = options.union(.writingWithoutOverwriting) // Misol uchun, haqiqiy himoya opsiyalari fayl atributlari yoki info.plistda o'rnatiladi

    try data.write(to: fileURL, options: options)

    // Fayl tizimi atributlarini o'rnatish (misol)
    var attributes: [FileAttributeKey : Any] = [:]
    attributes[.protectionKey] = FileProtectionType.complete
    try fileManager.setAttributes(attributes, ofItemAtPath: fileURL.path)
}

Secure Enclave:

Qurilmaning asosiy protsessoridan ajratilgan apparat koprotsessori, kriptografik kalitlar va ma'lumotlarni saqlash va ishlash uchun mo'ljallangan.
Touch ID / Face ID va boshqa sezgir operatsiyalar uchun ishlatiladi.
Secure Enclave ichida saqlangan kalitlar hech qachon undan chiqmaydi va asosiy protsessor yoki operatsion tizimga kirish imkoniyatiga ega emas.
Imzo yoki shifrlash uchun kalitlarni yaratish, saqlash va ishlatishda, dasturiy hujumlardan himoya qilish uchun ideal.

import CryptoKit
import LocalAuthentication

func generateAndStoreKeyInSecureEnclave() throws -> P256.Signing.PrivateKey {
    let accessControl = SecAccessControlCreateWithFlags(
        kCFAllocatorDefault,
        kSecAttrAccessibleWhenPasscodeSetThisDeviceOnly, // Parol o'rnatilgan bo'lsa kirish mumkin
        [.userPresence], // Foydalanuvchi autentifikatsiyasini talab qiladi (Touch ID/Face ID)
        nil
    )!

    let attributes: [String: Any] = [
        kSecAttrKeyType as String: kSecAttrKeyTypeECSECPrimeRandom,
        kSecAttrKeySizeInBits as String: 256,
        kSecAttrTokenID as String: kSecAttrTokenIDSecureEnclave,
        kSecPrivateKeyAttrs as String: [
            kSecAttrIsPermanent as String: true, // Kalit doimiy bo'ladi
            kSecAttrApplicationTag as String: "com.yourapp.signingkey".data(using: .utf8)!, // Unikal teg
            kSecAttrAccessControl as String: accessControl
        ]
    ]

    var error: Unmanaged<CFError>?
    guard let privateKey = SecKeyCreateRandomKey(attributes as CFDictionary, &error) else {
        throw error!.takeRetainedValue() as Error
    }

    // Kalitlarni Secure Enclave dan teg yordamida olish mumkin
    return try P256.Signing.PrivateKey(rawRepresentation: privateKeyData) // Misol, SecKey dan Data ga o'tkazish talab qilinadi
}

Tanlov joylashuv ma'lumotlarning hajmi (kichik hajm vs strukturalangan ma'lumotlar), tipiga (parol vs fayl vs kriptografik kalit), himoya darajasiga, sinhronizatsiya ehtiyojlariga (Keychain), foydalanuvchi autentifikatsiyasiga (Secure Enclave, Faylni himoyalash) bog'liq bo'ladi.

Foydalanuvchining himoyalangan ma'lumotlarini qaerga saqlaysiz?