存储应用内购买的正确且安全的方式
在设备上存储应用内购买的最佳方式是什么？ 这样购买也可以离线访问，但是 购买的安全性没有受到损害？
What is the best way to store an in-app-purchase on a device,
so that the purchases can also be accessed offline but
the security of the purchases are not compromised?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
不要在设备上存储任何有价值的东西，因为它不可信，并且很容易被有动机的人破坏。
现在，所有这一切都取决于所购买物品的类型和价值，以及如果物品受损会发生什么。
如果它确实有价值，那么使用远程安全服务器来管理安全项目。应用内购买包括收据，您的远程安全服务器可以通过安全连接直接与苹果服务器对话来验证收据。请参阅此链接验证商店收据。
Do not store anything valuable on the device as it cannot be trusted and it can easily be compromised by someone motivated.
Now, all of this depends on the type and value of the item that is being purchased and what happens if its compromised.
If its truly valuable then use a remote secure server for managing secure items. In app purchases include a receipt that can be verified by your remote secure server talking to apple's servers directly through a secure connection. See this link to verifying store receipts.
据我所知，安全存储购买的资产的最便捷方法是使用某种形式的加密。
用户应该能够下载加密资产，并且应用程序应该即时解密。
但是，请确保您也以安全的方式存储密钥，因为熟练的黑客可以轻松恢复字符串密钥（在应用程序二进制文件中）。保护密钥的一个好方法是使用基于服务器的系统进行某种身份验证。该应用程序将从服务器获取密钥，并仅在解密资产所需的几分钟内保留它。
这种防御机制并非坚不可摧。我觉得它足够复杂，足以阻止大多数用户尝试破坏它。
要解密设备上的资产，最好使用 CommonCrypto。它由 Apple 提供（通过 iOS SDK），因此您不必从头开始构建它，也不必为您的应用程序提供文档（美国法律要求）。我发现 Jim Dovey 的 Common Crypto 包装器是最简单的使用方法。
希望有帮助。 :)
As far as I know, the most convenient way to securely store a purchased asset would be to use some form of encryption.
The user should be able to download an encrypted asset, and the app should decrypt it on the fly.
However, make sure that you store the key in a secure fashion as well, as string keys (within the app binary) can easily be recovered by a skilled hacker. A good way to secure the key would be to use some sort of authentication with a server-based system. The app would get the key off the server and keep it only for the few moments required to decrypt the asset.
This defense mechanism is not impregnable; I feel that it is sophicaticated enough to discourage most users from attempting to undermine it.
To decrypt your assets on the device, a good idea would be to use CommonCrypto. It's provided by Apple (with the iOS SDK), so you don't have to build it from scratch and you don't have to provide documentation (required by US law) for your app. I find Jim Dovey's Common Crypto wrapper the easiest way to use it.
Hope that helps. :)
您需要加密该文件，对此您最好的选择可能是通用加密。为了能够离线访问数据，您需要将加密密钥存储在设备上。
解决方案是使用钥匙串：使用
SecRandomCopyBytes生成足够长度的密钥，并使用SecItemAdd将其存储在钥匙串中。然后使用该密钥加密数据并以正常方式将其写入设备的本地存储。当需要从磁盘读回文件时，使用 SecItemCopyMatching 加载钥匙串中的密钥并使用它来解密数据。You'll want to encrypt the file, for which your best bet is probably Common Crypto. In order to be able to access the data offline, you need to store the encryption key on the device.
The solution is to use the keychain: Use
SecRandomCopyBytesto generate a key of sufficient length, and store it in the keychain usingSecItemAdd. Then use that key to encrypt the data and write it to the device's local storage in the normal manner. When it comes time to read the file back from disk, useSecItemCopyMatchingto load the key from the keychain and use it to decrypt the data.