对 Android 设备上的信息进行加密（合理防止用户访问）
我们正在制作一个 Android 应用程序，一个问答游戏，我们希望在用户离线时缓存问题和答案。这样做的问题是，我们需要向用户隐瞒这些数据，直到她回答了问题。否则，很容易作弊，从而损害游戏。然后，人们可以提取所有问题 + 答案，并自动将答案提交到服务器 API。
最方便的方法是在安装时从我们的服务器检索密钥或秘密，将其隐藏在“某处”，并使用它与服务器通信，以及对存储中的问题+答案进行加密。但显然，将其隐藏在“某处”并不是一个安全的概念。
我进行了一些研究，似乎在这种情况下不可能进行可靠的加密，因为应用程序必须“知道”秘密（无论是证书、密码+盐或其他什么）或至少在哪里可以找到它，并且可以通过反编译来提取。不过，如果这件事够难的话，我们也不会介意。
问题是：你知道有什么方法可以让普通用户从 APK 中检索秘密变得异常困难 - 即几乎不可能编写自动密钥提取器吗？
我最好的到目前为止的猜测：
- 隐藏数据库中的一些信息并将其用作密钥的盐
- 添加来自设备的几位信息作为盐（IMEI，电子邮件地址，序列号，...） - 也许与混淆的方式一起加盐可能会很困难获得？
We are in the making of an Android app, a quiz game, which we would like to cache questions + answers for when the user is offline. The problem with this is that we would need to withhold this data from the user until she has answered the questions. Otherwise, cheating would be very easy, which would harm the game. One could then extract all questions + answers and automatically submit answers to the server API.
The most convenient way would be to retrieve a key or secret from our server at installation time, hide it "somewhere", and use it for communication with the server, and also for the encryption of questions + answers in storage. But obviously, hiding it "somewhere" is not a secure concept.
I have researched a bit, and it seems that reliable encryption is not possible in such cases, because the app has to "know" the secret (be it a certificate, passphrase + salt, or whatever) or at least where it can be found, and this can be extracted by decompilation. However, we would be fine with it being hard enough to do.
The question is: Do you know of a way to make it prohibitively hard for regular users to retrieve a secret from the APK - i.e., make it near-impossible to write an automated key-extractor?
My best guesses so far:
- Hide some information in the database and use it as salt for the key
- Add several bits of information from the device as salt (IMEI, email address, serial number,...) - perhaps together with obfuscation the way how the salt is applied might be hard to obtain?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您可以为每个问题使用单独的密钥，这取决于上一个问题的答案。因此，除非您已经回答了问题 1，否则不可能解密问题 2。
You could use a separate key for each question, which depends on the answer to the previous question. So it's impossible to decrypt question 2 unless you've already answered question 1.