Android 手机和应用程序已root
我想在 Android 应用程序上拥有一个大型数据库。该数据库是一个独立的文件，每月可能有 2-3 次更新（每次 20mb+，但我预测最大应该在 40mb 左右）。
我不断听说 Android 应用程序被 root，这样人们就可以访问这些敏感数据（这将是一个付费应用程序）。怎样才能对数据库的数据进行加密才不会丢失呢？是否有任何可以使用并且更安全的替代数据库（除了 sqlcypher）模型（甚至键/值）？
另外，root 手机用户是否可以从外部商店购买 Android 应用程序（由于订阅限制，我正在考虑创建一个外部非 Android 市场商店）并可以完全访问其内容？
我想做一些类似于 iphone 模型的事情，其中没有对数据库的明显访问权限（如果您不将其放入文档或启用您的设备进行共享）。
I want to have a large database on an android app. The database is a self contained file that might have 2-3 updates per month (each 20mb+ but I predict that the maximum should be around 40mb).
I keep hearing that the android apps get rooted so people can access those sensitive data (it's going to be a paid app). How can I encrypt the data of the database so that there will be no loss. Is there any alternative database (except from sqlcypher) model (even key/value) that can be used and is more secure?
Also, can a rooted phone user buy an android app from external store (I am thinking on making an external non android market store, due to subscription limitations) and has full access to its contents?
I want to do something similar of the iphone model, where there is no apparent access to the database (if you don't put it to the Documents or enable your device for sharing).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
如果您使用 H2，您可以加密数据库的表。
因此只有您的应用程序可以安装和访问它。
当然，您不应该将密钥存储在单个字符串中，因为即使在混淆之后，通过反编译也很容易找到它。
但总的来说，您应该问自己这是否真的是一个好的模型。
If you use H2 you can encrypt the tables of the database.
So only your application can mount and access it.
You should of course not store the key in a single String though, as this would be easy to find out with a decompile, even after obfuscation.
In general however you should ask yourself if this is really a good model.
“iPhone模式”同样容易被越狱打败。
如果数据库和与之配合使用的代码都位于已取得 root 权限的手机上，那么意志坚定的攻击者最终将获得这些数据。他们只需要一个调试器和一个适时的断点。此外，Java 代码非常容易进行逆向工程。由于您必须将解密代码发送给用户（否则应用程序将如何工作？），因此同一用户可以隔离并利用您自己的解密代码。
"The iPhone model" is defeated by jailbreaking just as easily.
If both the database and the code that works with it are on a rooted phone, a determined enough attacker will get to the data eventually. A debugger and a breakpoint at just the right moment is all they need. Also, Java code is notoriously easy to reverse engineer. Since you have to ship the decryption code to the user (otherwise, how will the app work?), the same user can isolate and leverage your own decryption code.