What is new in Android security (M and N Version) - Google I/O 2016 翻译

截至发博，字幕还在后期中，应该快了吧。
YouTube视频链接：https://www.youtube.com/watch?v=XZzLjllizYs

字幕翻译：
1
00:00:01,820 –> 00:00:04,920
他们告诉我计时已经开始了
They pointed at me and the clock started moving.

2
00:00:04,920 –> 00:00:08,640
我们有44分钟外加56秒来讨论安全问题
We have 44 minutes and 56 seconds to talk about security.

3
00:00:08,640 –> 00:00:10,090
早上好
Good morning.

4
00:00:10,090 –> 00:00:12,270
现在是早上9点
It’s 9:00 AM.

5
00:00:12,270 –> 00:00:14,580
我今早6点就坐公交车从旧金山过来
I caught the bus down from San Francisco at 6:00 AM

6
00:00:14,580 –> 00:00:17,160
然后在公交车上修改了幻灯片的
this morning to clean up some last little details

7
00:00:17,160 –> 00:00:18,890
最后一点细节
of my slides on the bus.

8
00:00:18,890 –> 00:00:22,040
大家都吃早饭了吗
Did everybody find coffee and breakfast?

9
00:00:22,040 –> 00:00:23,420
如果还没，去吃吧
If not, go find it.

10
00:00:23,420 –> 00:00:24,110
然后再回来
Come back.

11
00:00:24,110 –> 00:00:26,380
我们会在这等一小会
We’ll be here for a little bit.

12
00:00:26,380 –> 00:00:28,560
我的名字叫 Adrian Ludwig
My name is Adrian Ludwig.

13
00:00:28,560 –> 00:00:30,730
我带领的 Android 安全团队
I head up the Android Security team

14
00:00:30,730 –> 00:00:34,539
在那个方向有至少3个展区
here at Google, or at least three blocks over that way at Google.

15
00:00:34,539 –> 00:00:38,310
我们负责 Android 平台的安全事务
We’re responsible for the security of the Android platform.

16
00:00:38,310 –> 00:00:41,190
这个平台具有多样性并且变化迅速
The platform is a broad, diverse, growing kind

17
00:00:41,190 –> 00:00:43,390
像你们知道的那样
of incredible thing, as many of you know.

18
00:00:43,390 –> 00:00:50,070
所以我们的工作范围也具有多样性而且变化迅速
So the scope of what we do is also broad, diverse, and growing.

19
00:00:50,070 –> 00:00:52,580
你已经看到了
You saw a couple things that were mentioned yesterday

20
00:00:52,580 –> 00:00:56,260
昨天提出的一些 Android N 的新特性
in the keynote that are new features that were introduced

21
00:00:56,260 –> 00:00:58,340
我们正致力于
in Android N that we’ve been working

22
00:00:58,340 –> 00:01:00,500
和其他的 Android 团队一起
with the rest of the Android team to enable,

23
00:01:00,500 –> 00:01:02,440
把类似文件基础加密 媒体服务器强化
things like File Based Encryption,

24
00:01:02,440 –> 00:01:04,640
以及自动更新等功能付诸实践
Media Server Hardening, and Automatic Updates.

25
00:01:04,640 –> 00:01:06,570
有一些核心改变在 Android N 的介绍中
These are some of the core changes that

26
00:01:06,570 –> 00:01:11,580
已经提到过了 那些建立在安全模型上的技术
have been introduced in Android N. Those of course

27
00:01:11,580 –> 00:01:17,010
现在已经扩展到 Android 平台中了
build on a security model that extends deep into the platform.

28
00:01:17,010 –> 00:01:19,160
这不是遥不可及的未来 它触手可及
It’s not just a future here, a future there.

29
00:01:19,160 –> 00:01:22,090
这些是关于我们如何把应用分段
It’s about how we have segmented applications.

30
00:01:22,090 –> 00:01:24,430
我们如何在 Android 平台中把权限独立出来
How we have isolated capabilities

31
00:01:24,430 –> 00:01:26,630
以及我们用来实现
in the platform and the underlying technologies

32
00:01:26,630 –> 00:01:29,540
这些安全功能的底层技术
that we’re using to deliver those security features.

33
00:01:29,540 –> 00:01:34,410
不过这并不仅仅限于 Android 自身
It’s not limited just to Android itself though.

34
00:01:34,410 –> 00:01:37,060
我们在 Android 操作系统
The work that we do in securing the Android operating

35
00:01:37,060 –> 00:01:39,660
Android 平台与 Android 生态系统中
system, the Android platform, and the Android ecosystem

36
00:01:39,660 –> 00:01:42,140
所做的安全工作已经被
extends to a broad range of applications

37
00:01:42,140 –> 00:01:46,210
扩展到了 Google 的安全服务范畴中
that we deliver that we talk about as the Google Security Services.

38
00:01:46,210 –> 00:01:49,290
这些在昨天的主题分享中
Those also got a very brief mention yesterday

39
00:01:49,290 –> 00:01:51,570
也提到过了
in the keynote that I wanted to flag,

40
00:01:51,570 –> 00:01:56,650
目前我们每天的扫描次数超过十亿次
which is that at present we’re doing over a billion scans per day.

41
00:01:56,650 –> 00:01:58,605
我们称之为“检测” 因为不做安全工作的人
We say checks, because non-security people are

42
00:01:58,605 –> 00:02:01,530
觉得相比扫描一词 检测听起来更让人舒服一点
more comfortable with the idea of doing a checkup than doing a scan.

43
00:02:01,530 –> 00:02:04,300
但是我们现在正在做的事就是
But what we’re doing is looking at security characteristics

44
00:02:04,300 –> 00:02:06,300
寻找设备上不那么安全的地方
on the devices that are out there in the world

45
00:02:06,300 –> 00:02:08,206
然后把它变得安全
to make sure that we’re keeping them safe.

46
00:02:08,206 –> 00:02:09,580
其中我们关注的一件事就是数字
One of the things that we look at

47
00:02:09,580 –> 00:02:12,660
即被安装到设备上的
is the number, the broad range of applications that have been

48
00:02:12,660 –> 00:02:13,910
应用数量
installed on these devices.

49
00:02:13,910 –> 00:02:16,530
所以我们每天检测应用的数量超过80亿
So we check over 8 billion applications

50
00:02:16,530 –> 00:02:19,770
来保证你的全方位安全
every single day, to give you a sense of the overall scope.

51
00:02:19,770 –> 00:02:23,000
Dave 无法知道的其中一件事就是
One of the things that Dave wasn’t able to get into

52
00:02:23,000 –> 00:02:26,550
他不知道这究竟意味着什么
was what exactly these things mean.

53
00:02:26,550 –> 00:02:28,740
大概三个还是四个星期前我们推出了
About three or four weeks ago we published

54
00:02:28,740 –> 00:02:32,250
一个名叫“安全检查年”的活动
something called the “Annual Security Year in Review,” where

55
00:02:32,250 –> 00:02:34,170
我们在这些安全服务中
we went into a lot of the work that we’ve

56
00:02:34,170 –> 00:02:36,910
做了大量的工作
been doing investing in these security services,

57
00:02:36,910 –> 00:02:40,520
使得已经投入使用的 Google 后台技术
making them more capable, using the technology

58
00:02:40,520 –> 00:02:43,540
能够进行更加复杂的分析
that Google has in our back end to deliver

59
00:02:43,540 –> 00:02:46,062
并理解现在的 Android 生态系统中
more and more sophisticated analysis of applications,

60
00:02:46,062 –> 00:02:47,770
正在
more and more sophisticated understanding

61
00:02:47,770 –> 00:02:50,090
发生着什么
of what it is that’s going on in the Android ecosystem

62
00:02:50,090 –> 00:02:52,890
以便我们能更好的保护用户
so that we can better protect users.

63
00:02:52,890 –> 00:02:55,650
这张图其实意味着50页的文件
That 50-page document included this diagram.

64
00:02:55,650 –> 00:02:57,850
当然我不打算在这里展开说
I’m not going to go into a lot of detail here.

65
00:02:57,850 –> 00:03:04,070
但我想强调的是我们关注
But I wanted to emphasize that the vast majority of our focus

66
00:03:04,070 –> 00:03:06,530
每一件能够保护用户的事情
is on everything that we can do to protect users.

67
00:03:06,530 –> 00:03:10,630
所以无论从硬件的更新与安全
So that ranges from hardware updates and hardware security,

68
00:03:10,630 –> 00:03:13,320
还是平台的更新与安全还是服务
to platform updates and platform security features,

69
00:03:13,320 –> 00:03:14,872
都是我们所关心的范围
to services as well.

70
00:03:14,872 –> 00:03:16,830
而且我们正致力于安全的每一层
And we’re investing at every layer in the stack

71
00:03:16,830 –> 00:03:19,380
从而最大程度的保护用户
to try to protect users as best we can.

72
00:03:19,380 –> 00:03:23,000
现在我将详细解释
Now for today, I’m going to hone in on a handful

73
00:03:23,000 –> 00:03:25,010
Android M 和 N
of specific new capabilities that

74
00:03:25,010 –> 00:03:29,170
中的新特性
were introduced in Android M and Android N. M

75
00:03:29,170 –> 00:03:31,760
让我们从实际情况来看一下 Android M
because, let’s be realistic.

76
00:03:31,760 –> 00:03:34,170
它目前还没有被广泛的使用
It hasn’t gotten to a point where it has broad based adoption.

77
00:03:34,170 –> 00:03:35,700
所以如果你还没有花费很长时间思考
So it’s not terribly surprising if you

78
00:03:35,700 –> 00:03:37,070
怎样利用 Android M 中的特性
haven’t been spending a lot of time thinking

79
00:03:37,070 –> 00:03:39,070
那你是不会被震惊到的
about how to take advantage of the features that

80
00:03:39,070 –> 00:03:41,950
而且因为 Android N 现在比较火热
were introduced in M. And Android N because that’s the new hotness.

81
00:03:41,950 –> 00:03:44,970
而且它也推出
Or at least it will be as soon as it begins to roll out

82
00:03:44,970 –> 00:03:47,930
有几个月了
a couple of months from now.

83
00:03:47,930 –> 00:03:51,540
所以我想强调的是
So I wanted to emphasize though that this is just

84
00:03:51,540 –> 00:03:55,485
这只是我们所有工作的一部分
part of the overall sort of set of capabilities that we have.

85
00:03:55,485 –> 00:03:57,610
我们想为应用的开发人员做些事情
We want to build things for application developers.

86
00:03:57,610 –> 00:03:59,184
我们想为用户做些事情
We want to build things for users.

87
00:03:59,184 –> 00:04:01,100
而且我们也想为设备制造商做些事情
And we want to build things for device makers.

88
00:04:01,100 –> 00:04:04,569
而我认为目前 用户是最重要的
I think on the main stage, the focus was on users.

89
00:04:04,569 –> 00:04:06,110
当然我们也把很多时间
Elsewhere in the world we spend a lot

90
00:04:06,110 –> 00:04:07,790
用在了与设备制造商交流上
of time talking about device makers.

91
00:04:07,790 –> 00:04:09,170
但是今天 我们想要谈谈
But today, we’re going to talk about what

92
00:04:09,170 –> 00:04:10,628
我们正在做的新事情
are the new things that we’re doing

93
00:04:10,628 –> 00:04:12,530
为什么对开发者而言
to make your life as an application developer

94
00:04:12,530 –> 00:04:15,478
在 Android M 和 N 上开发软件更爽
better on Android M and N.

95
00:04:15,478 –> 00:04:17,760
所以这就是我主要想讲的几点
So these are some of the key features that I’m going to talk about.

96
00:04:17,760 –> 00:04:19,222
一共有七点
There are seven of them up here.

97
00:04:19,222 –> 00:04:21,180
我将一个一个的说
I’m just going to walk through them one by one.

98
00:04:21,180 –> 00:04:24,174
我们将逐一介绍
We’ll talk about what it is that was introduced,

99
00:04:24,174 –> 00:04:26,590
并且看一看部分源码
take a look at some source code so that you can understand

100
00:04:26,590 –> 00:04:28,440
以便你能更好的在你的应用中使用它
how you might incorporate it into your application

101
00:04:28,440 –> 00:04:29,800
而且还能增长开发经验
and your development experience.

102
00:04:29,800 –> 00:04:31,360
然后我们将讨论一下
And then talk about some of the best practices

103
00:04:31,360 –> 00:04:32,710
我们认为的
that we’ve been thinking about for how

104
00:04:32,710 –> 00:04:34,440
你将如何运用在你程序中的
we think it is that you’d want to be incorporating

105
00:04:34,440 –> 00:04:36,940
最佳范例
these new technologies into your application development.

106
00:04:36,940 –> 00:04:37,440
如何
Right?

107
00:04:37,440 –> 00:04:38,450
很直观吧
Pretty straightforward.

108
00:04:38,450 –> 00:04:41,450
嘣嘣嘣 然后跳到下一个 嘣嘣嘣
Boom, boom, boom, move to the next one, boom, boom, boom.

109
00:04:41,450 –> 00:04:44,225
没有绚丽的图标 只有一些代码
No fancy diagrams, just a little bit of code here and there.

110
00:04:44,225 –> 00:04:47,315
所以权限是我们将要讨论的第一个话题
So permissions is the first thing we’re going to talk about.

111
00:04:47,315 –> 00:04:50,400
你也许记得
You may remember, or you may know,

112
00:04:50,400 –> 00:04:53,020
如果你在装有 Android M 的 Nexus 设备上
if you’re running on Android M right now on Nexus device

113
00:04:53,020 –> 00:04:55,480
或是其他装有 Android M 的其他设备上运行程序
or one of the other devices that’s started to receive it,

114
00:04:55,480 –> 00:04:58,310
其中用户体验的一个主要变化就是
that one of the major changes in the user experience that

115
00:04:58,310 –> 00:05:02,270
运行时权限
was introduced with Marshmallow was runtime permissions,

116
00:05:02,270 –> 00:05:05,500
意思就是只有在程序运行过程中
the idea that an application can defer

117
00:05:05,500 –> 00:05:09,920
真正需要使用到相应权限时才进行申请
requesting the use of permissions until it really needs them.

118
00:05:09,920 –> 00:05:11,445
因此用户就有了
And that the user has the ability

119
00:05:11,445 –> 00:05:13,040
决定是否给予权限
to decide whether the application gets

120
00:05:13,040 –> 00:05:15,340
的权利
that specific permission or not.

121
00:05:15,340 –> 00:05:18,374
这是 Android M 中
Really a fundamental change in the way that applications

122
00:05:18,374 –> 00:05:20,790
申请敏感权限的
are going to request access to more sensitive capabilities

123
00:05:20,790 –> 00:05:22,632
一个根本性变化
on the device introduced with Marshmallow.

124
00:05:25,530 –> 00:05:27,500
从应用开发者的立场来说
From an application developer’s standpoint,

125
00:05:27,500 –> 00:05:29,680
这是一件很值得考虑的事情
it’s a really powerful thing for you to think about.

126
00:05:29,680 –> 00:05:32,080
它给了你简化安装应用过程
It gives you the ability to simplify the installation

127
00:05:32,080 –> 00:05:33,334
的能力
process for your application.

128
00:05:33,334 –> 00:05:36,460
因为你不需要提前申请所有的权限了
Because you don’t have to request all of those permissions up front.

129
00:05:36,460 –> 00:05:39,030
它也不需要
It gives you the ability to upgrade

130
00:05:39,030 –> 00:05:42,410
在用户确认升级之后
without having the user have to confirm that that upgrade is

131
00:05:42,410 –> 00:05:45,720
再升级
necessary for applications being delivered through, for example,

132
00:05:45,720 –> 00:05:46,830
比如说从 Google Play 上
through Google Play.

133
00:05:46,830 –> 00:05:49,090
因为这在安全性上
Because there’s no increase in the capabilities

134
00:05:49,090 –> 00:05:50,870
没有任何的变化
of the application in the security model.

135
00:05:50,870 –> 00:05:53,010
因此也没有让用户确认的必要
And so there’s no need for the user to affirm that.

136
00:05:53,010 –> 00:05:54,850
所以这真的可以提高
So this can really accelerate the rate

137
00:05:54,850 –> 00:05:56,766
你的应用的升级比例
at which your applications are being upgraded,

138
00:05:56,766 –> 00:06:00,590
如果你能在新平台上运用好运行时权限的话
if you take advantage of runtime permissions on these newer platforms.

139
00:06:00,590 –> 00:06:03,264
而且我认为 就我十分担心的问题
And from my perspective, when I think about security,

140
00:06:03,264 –> 00:06:05,180
安全性考虑而言
one of the things I worry about is making sure

141
00:06:05,180 –> 00:06:07,490
这可以确保用户知道应用中都在发生着什么
that users understand what it is that’s going on.

142
00:06:07,490 –> 00:06:10,250
而且我们也发现运行时权限对用户来说
And we found that runtime permissions are fundamentally

143
00:06:10,250 –> 00:06:12,172
是更加能够接受的
more understandable for users.

144
00:06:12,172 –> 00:06:13,630
这使得开发者可以
They give the application developer

145
00:06:13,630 –> 00:06:16,340
在更恰当的时候申请权限
the ability to provide context, and the user

146
00:06:16,340 –> 00:06:18,539
而用户也更好的理解
to understand how that capability is

147
00:06:18,539 –> 00:06:22,800
所申请的权限用在了什么地方
going to be associated with the application that they’re employing.

148
00:06:22,800 –> 00:06:24,550
如何
So what does it look like?

149
00:06:24,550 –> 00:06:26,342
这很直观吧
It’s pretty straightforward.

150
00:06:26,342 –> 00:06:29,216
你需要做的第一件事就是
The first thing that you want to do in the context of your application

151
00:06:29,216 –> 00:06:33,250
调用当时的局部环境并且检查自身的权限
is invoke the local environment and check self permission.

152
00:06:33,250 –> 00:06:36,890
我已经有这个权限了吗
Do I already have this permission?

153
00:06:36,890 –> 00:06:39,090
如果没有 那你可能需要
If you don’t, then you want to explain,

154
00:06:39,090 –> 00:06:40,815
向你的用户解释一下
probably provide some context to the user

155
00:06:40,815 –> 00:06:43,010
为何你要在此处申请权限
about why it is that you’re going to request that permission.

156
00:06:43,010 –> 00:06:45,640
在这个例子中申请的是读取联系人权限
In this particular instance it’s the use of read contacts.

157
00:06:45,640 –> 00:06:47,390
你可能说 我需要发邮件
So you might say, I want to send an email.

158
00:06:47,390 –> 00:06:48,973
如果我能够看到在你的联系人中
And it would be really nice if I could

159
00:06:48,973 –> 00:06:52,120
谁已经是你的好友了
see who you’re already friends with inside your contact

160
00:06:52,120 –> 00:06:54,740
这样会非常方便
environment, or make a call, or any number

161
00:06:54,740 –> 00:06:57,620
当然也可以是打电话或其他功能
of other types of functionality it might want to expose.

162
00:06:57,620 –> 00:06:59,934
如果你还没有读取过的话
If you do not have the capability already,

163
00:06:59,934 –> 00:07:01,600
那么你就需要申请权限了
then you’re going to need to request it.

164
00:07:01,600 –> 00:07:04,200
而且 API 也相当的简单 “Request Permission”
And there’s a simple API, “Request Permission.”

165
00:07:04,200 –> 00:07:06,520
然后你就可以请求权限了
And you can go ahead make that request.

166
00:07:06,520 –> 00:07:10,267
现在也许你已经申请到权限了 也许没有
And at that point, you now have that permission, or not.

167
00:07:10,267 –> 00:07:12,600
下面我们来演示一下
Let’s talk a little bit about some of the best practices

168
00:07:12,600 –> 00:07:14,774
确保你能申请到权限的最佳范例
to make sure that you actually get that permission.

169
00:07:14,774 –> 00:07:17,190
因为我们也要考虑到用户
Because that’s one of the things that people are concerned

170
00:07:17,190 –> 00:07:21,290
不一定总是会同意
about with runtime permissions is that they maybe don’t always

171
00:07:21,290 –> 00:07:22,012
申请权限的
say yes.

172
00:07:22,012 –> 00:07:24,886
所以你也需要考虑到
So you’re going to need to consider in the context of your application

173
00:07:24,886 –> 00:07:27,415
用户不同意的情况
that the user might say no.

174
00:07:27,415 –> 00:07:28,790
而且你也同样要考虑
And you’re going to want to think

175
00:07:28,790 –> 00:07:31,350
怎样做才能让更多的用户
about how it is that you can increase the likelihood

176
00:07:31,350 –> 00:07:32,730
通过权限申请
that the user will say yes.

177
00:07:32,730 –> 00:07:35,977
所以我们提供了一些设计准则
So one of the things that we did is provide some design guidelines.

178
00:07:35,977 –> 00:07:37,060
准则已经推出了
Those have been published.

179
00:07:37,060 –> 00:07:40,270
你可以在 developer.android.com
You can find them up on developer.android.com

180
00:07:40,270 –> 00:07:42,686
上找到一些最佳范例
that describe some of the best practices.

181
00:07:42,686 –> 00:07:45,740
最重要的是告诉用户
One of the most important ones is to provide some context for why it

182
00:07:45,740 –> 00:07:47,230
你将要用它来做什么
is that you’re going to do it.

183
00:07:47,230 –> 00:07:50,214
以 Hangouts 中的短信为例
So for example, in the case of SMS,

184
00:07:50,214 –> 00:07:51,880
如果你想在
in the case of the Hangouts application,

185
00:07:51,880 –> 00:07:53,310
应用中接收到
explaining hey, if you want to receive

186
00:07:53,310 –> 00:07:54,900
短信里的内容
SMS in the context of this application,

187
00:07:54,900 –> 00:07:56,608
那我们就需要读取短信的权限
we’re going to need to have access to it.

188
00:07:56,608 –> 00:07:58,152
我现在要请求权限了
And I’m going to request it now, then

189
00:07:58,152 –> 00:08:00,610
这有助于提高申请权限的成功率
makes it possible for you to request it and really increase

190
00:08:00,610 –> 00:08:03,800
用户觉得这对我确实有意义
the rate at which user say, OK, makes sense to me.

191
00:08:03,800 –> 00:08:05,460
接受吧
Go ahead and grant it.

192
00:08:05,460 –> 00:08:07,350
在加入了权限解释的 Google 应用中
Within the context of Google applications,

193
00:08:07,350 –> 00:08:11,220
我们发现85%的用户同意了权限申请
we found that about 85% of the time users do say yes.

194
00:08:11,220 –> 00:08:13,550
相比那些不加权限解释的应用
That’s better than the average that we’ve

195
00:08:13,550 –> 00:08:16,400
加了权限解释的应用权限申请通过率
seen for other applications that are sort of broadly distributed

196
00:08:16,400 –> 00:08:17,810
更高
on the Android platform.

197
00:08:17,810 –> 00:08:20,750
这是一个通过率提高了的例子
Just to give you some examples of how much better it is,

198
00:08:20,750 –> 00:08:25,180
大约15.8%的用户在第一次提示时拒绝了权限申请
about 15.8% of the time when we prompt a user, they say no.

199
00:08:25,180 –> 00:08:27,970
这比之前降低了40%
That’s about 40% lower.

200
00:08:27,970 –> 00:08:30,900
而其他应用的拒绝率
So for other applications, the failure rate on that request

201
00:08:30,900 –> 00:08:33,080
大概在20%到25%之间
is going to be about 20% to 25%.

202
00:08:33,080 –> 00:08:35,520
这其中差了40%
So about 40% difference between those.

203
00:08:35,520 –> 00:08:39,940
如果你不停的申请权限而用户又不停的拒绝申请
If you ask too many times and the user says no repeatedly,

204
00:08:39,940 –> 00:08:42,870
我觉得在三次之后
eventually, after I think three times,

205
00:08:42,870 –> 00:08:46,490
用户就有权利选择不要再申请了
the user has the option to say stop asking me.

206
00:08:46,490 –> 00:08:48,289
而且我们发现在 Google 应用中
And so we found that the stop asking me,

207
00:08:48,289 –> 00:08:51,470
拒绝再次申请的概率大约是3%
don’t ever ask me again rate for Google applications is about 3%.

208
00:08:51,470 –> 00:08:53,324
所以我们要在合适的时候申请权限
So effectively we prompt a couple of times

209
00:08:53,324 –> 00:08:54,740
这样用户
in order to get to the point where

210
00:08:54,740 –> 00:08:56,614
才不会觉得不舒服
the user is comfortable with the application.

211
00:08:56,614 –> 00:08:59,490
大约97%的用户
And we find about 97% of the time users

212
00:08:59,490 –> 00:09:02,360
通过了申请的权限
accept the permission ask that we’re making.

213
00:09:02,360 –> 00:09:05,209
上述就是你需要考虑的最佳范例
So those are the best practices that you want to think about.

214
00:09:05,209 –> 00:09:06,750
我们还做了
There’s another capability that we’ve

215
00:09:06,750 –> 00:09:08,530
一件大事
been expanding dramatically, which

216
00:09:08,530 –> 00:09:12,060
就是密钥材料的保护
is a protection of key material, cryptographic keys

217
00:09:12,060 –> 00:09:13,220
尤其是 Android 上的密钥
specifically on Androids.

218
00:09:13,220 –> 00:09:16,340
所以我们来讨论一下 Android 密钥库
So we’ll talk about the Android Keystore.

219
00:09:16,340 –> 00:09:18,990
密钥库广泛的应用在
The Keystore leverages hardware that

220
00:09:18,990 –> 00:09:22,545
Android 设备中
exists on the vast majority of Android devices.

221
00:09:22,545 –> 00:09:25,170
作为一名安全从业者
As a security practitioner, it’s always been really interesting

222
00:09:25,170 –> 00:09:28,750
我对那些带有 TrustZone 的设备十分感兴趣
to me that most devices, literally about 80% to 90%

223
00:09:28,750 –> 00:09:31,230
这些设备大概占到80%到90%
of devices have something called TrustZone on them.

224
00:09:31,230 –> 00:09:33,170
他们都有一个 TEE
They have a TEE that’s been put in place.

225
00:09:33,170 –> 00:09:37,300
它提供了一套可以访问 DRM 保护内容的机制
It was there to enable access to DRM protected content.

226
00:09:37,300 –> 00:09:39,410
我们这几年正在做的就是
What we’ve been doing over the last several years

227
00:09:39,410 –> 00:09:41,626
让开发者保护
is making that available to you as an application

228
00:09:41,626 –> 00:09:43,250
用户设备中的敏感功能与
developer as a means for you to protect

229
00:09:43,250 –> 00:09:46,660
密钥成为可能
the most sensitive capabilities and keys in your device.

230
00:09:46,660 –> 00:09:52,000
让我们从 jb-mr2 开始说起吧
So starting in jb-mr2.

231
00:09:52,000 –> 00:09:55,140
大概在四年前
So almost four years ago, we began implementing API

232
00:09:55,140 –> 00:09:56,830
我们开始不断的继承 API
after API after API.

233
00:09:56,830 –> 00:10:02,820
从 Android L 开始 陆续可以使用 RSA 和椭圆曲线数字签名算法
As of Android L, the ability to use RSA, elliptic curve DSA,

234
00:10:02,820 –> 00:10:07,620
即ECDSA 或是像 AES 这样的对称算法 还有 HMAC
so ECDSA, symmetric algorithms like AES, and then also HMAC,

235
00:10:07,620 –> 00:10:10,820
这些密钥都被内置在 TrustZone 中
where those keys are held inside of TrustZone and cannot be

236
00:10:10,820 –> 00:10:13,900
而没有展现在普通用户面前
exposed to the kernel or to anybody else on the device is

237
00:10:13,900 –> 00:10:18,630
但这些功能确实是设备的核心功能
one of the core capabilities that we’ve been enabled.

238
00:10:18,630 –> 00:10:20,540
其中一件非常重要的事就是
One of the really important things to do

239
00:10:20,540 –> 00:10:22,720
把它从大多数设备
is to transition from it being on most devices

240
00:10:22,720 –> 00:10:23,900
过渡到所有的设备
to being on all devices.

241
00:10:23,900 –> 00:10:27,340
因此这就变成了 Android N 的任务
So this became required as of the Android N release.

242
00:10:27,340 –> 00:10:29,230
我们从现在起将会看到
So we’re going to see, from here on out,

243
00:10:29,230 –> 00:10:32,150
所有的新设备都将装载它
all new devices are going to definitely have it on board.

244
00:10:32,150 –> 00:10:33,812
而且就在现在 绝大多数的
As it is right now, the vast majority

245
00:10:33,812 –> 00:10:38,620
高端或是中端设备都已经有 Keystore 了
of higher end and mid-range devices already have Keystore in place.

246
00:10:38,620 –> 00:10:42,490
所以 Android N 中的一个新特性
So one of the new features that was introduced with Android N

247
00:10:42,490 –> 00:10:44,280
就是密钥认证
was what we call attestation.

248
00:10:44,280 –> 00:10:47,020
关于密钥认证我们所做的就是把密钥
What we do with attestation is bake a key

249
00:10:47,020 –> 00:10:49,857
加进 TrustZone 中的固件中
into the firmware inside of TrustZone.

250
00:10:49,857 –> 00:10:51,940
这样你就可以验证
So it is possible for you to validate that this is

251
00:10:51,940 –> 00:10:53,231
硬件的合法性了
a legitimate piece of hardware.

252
00:10:53,231 –> 00:10:55,580
你可以通过创建一个密钥
And you can check that by creating a key

253
00:10:55,580 –> 00:10:57,700
然后检测绑定到
and then checking the search chain to tie it

254
00:10:57,700 –> 00:11:00,510
需要进行 CTS 测试的硬件搜索链
back to a piece of hardware that’s gone through CTS testing.

255
00:11:00,510 –> 00:11:02,260
我将用几秒钟的时间
And I’ll sort of talk through how

256
00:11:02,260 –> 00:11:04,444
稍微讨论一下你应该如何做
it is that you can do that in just a second.

257
00:11:04,444 –> 00:11:06,860
这是一个源码的
So here’s an example of what that looks like from a source

258
00:11:06,860 –> 00:11:08,370
例子
code standpoint.

259
00:11:08,370 –> 00:11:09,350
你需要做什么
What do you need to do?

260
00:11:09,350 –> 00:11:12,490
你需要从创建一个 KeyPair 开始
Well, you can start off by creating a key pair.

261
00:11:12,490 –> 00:11:16,050
你创建了一个 Android Keystore 的实例
So you create an instance of Android Keystore.

262
00:11:16,050 –> 00:11:18,760
在这个例子中 我们用的是椭圆曲线
In this instance, we’re using elliptic curves,

263
00:11:18,760 –> 00:11:21,120
所以你需要把它加入到你的算法中
so you specify that to your algorithm.

264
00:11:21,120 –> 00:11:23,410
我将要介绍一件在 Android M
One of the more interesting new capabilities

265
00:11:23,410 –> 00:11:25,440
中更有趣的特性
that was introduced actually in Android M

266
00:11:25,440 –> 00:11:27,240
那就是这个密钥只有刚被验证过的
was the ability to say this key can only

267
00:11:27,240 –> 00:11:31,069
用户才可以使用
be used if the user has recently authenticated.

268
00:11:31,069 –> 00:11:32,860
我再用几秒钟多说一点
I’ll talk more about that in just a second.

269
00:11:32,860 –> 00:11:34,710
这是一个很有力的声明
But that’s a really powerful statement that you can make.

270
00:11:34,710 –> 00:11:36,640
那就是你能知道有一个真真切切的用户
So that you know that there’s a real user that’s

271
00:11:36,640 –> 00:11:38,431
在与设备进行着交互
been interacting with the device right now.

272
00:11:38,431 –> 00:11:40,950
当然这也是被内置于 TrustZone 中的
And that’s been validated inside of TrustZone.

273
00:11:40,950 –> 00:11:42,745
所以你可以保护你的密钥
So you can protect your keys.

274
00:11:42,745 –> 00:11:44,370
然后你可以做的最后一件事就是
And then the last thing that you can do

275
00:11:44,370 –> 00:11:46,867
你能够获得与密钥相关的
is you can actually get the certificate chain associated

276
00:11:46,867 –> 00:11:47,450
证书
with that key.

277
00:11:47,450 –> 00:11:52,370
所以这密钥是绑定到设备上的
So that key is one that has been bound to a particular device.

278
00:11:52,370 –> 00:11:54,452
而且它不能转移到其他设备上
And it can’t move to some other device.

279
00:11:54,452 –> 00:11:56,910
然后你就可以通过看证书链
Then you can actually confirm by looking at the certificate

280
00:11:56,910 –> 00:12:00,450
确定这是一个已经通过 CTS 测试的正常设备
chain that it’s a device that legitimately went through CTS testing.

281
00:12:00,450 –> 00:12:02,790
它已经经过确认了
It’s gone through that kind of validation.

282
00:12:02,790 –> 00:12:06,740
所以我认为这种类型的功能是非常重要的
So I think this type of capability is really important for enhancing

283
00:12:06,740 –> 00:12:09,240
尤其是对通过 Google 检验的
the trust in those devices that have gone through the Google

284
00:12:09,240 –> 00:12:14,260
Android 测试设备信任度的增加
validation process and are valid, Android tested devices.

285
00:12:14,260 –> 00:12:18,522
所以你需要认真想一想
So some best practices, think for a moment

286
00:12:18,522 –> 00:12:20,730
你的应用中是否需要加上
whether there’s a case for you to be using encryption

287
00:12:20,730 –> 00:12:22,840
最佳范例中的加密功能
in the context of your application.

288
00:12:22,840 –> 00:12:25,340
如果是的话 那么 Keystore 对于你来说
And if so, then Keystore is a great place for you

289
00:12:25,340 –> 00:12:27,380
就是保存密钥最好的地方
to be storing those keys.

290
00:12:27,380 –> 00:12:28,170
它可供使用
It’s available.

291
00:12:28,170 –> 00:12:29,850
而且很直观
It’s very straightforward.

292
00:12:29,850 –> 00:12:32,060
而且它的优点在于
And it has the advantage of the key

293
00:12:32,060 –> 00:12:34,560
即使设备中的其他东西被破解了
not being exposed in the event of compromise of other things

294
00:12:34,560 –> 00:12:36,300
密钥也不会被暴露出来
on the device.

295
00:12:36,300 –> 00:12:39,590
你也可以用这个从 Android N 开始的密钥
You can also use the key, starting with Android N,

296
00:12:39,590 –> 00:12:42,100
来验证这是否是一个合法的 Android 设备
as a mechanism to validate that this is a legitimate Android

297
00:12:42,100 –> 00:12:47,270
而非一个不兼容的设备
device and not one that’s been created outside the compatibility.

298
00:12:47,270 –> 00:12:48,766
这就给了你进一步校验
And so that gives you the ability

299
00:12:48,766 –> 00:12:50,390
设备的能力
to do further validation of the device.

300
00:12:53,140 –> 00:12:54,600
我之前提到了验证
I hinted at authentication.

301
00:12:54,600 –> 00:12:56,190
让我们来谈论一些
So let’s talk a little bit about some of the changes

302
00:12:56,190 –> 00:12:58,023
关于验证方面的改变
that have gone into authentication recently.

303
00:13:00,872 –> 00:13:02,580
在加强验证方面
So there’s two different goals that we’re

304
00:13:02,580 –> 00:13:06,530
我们有两个不同的目标
striving for as we’re enhancing authentication.

305
00:13:06,530 –> 00:13:12,370
第一个就是 坦率地说
The first one is, well, let’s be frank,

306
00:13:12,370 –> 00:13:14,590
用户根本不喜欢验证
users don’t like authenticating.

307
00:13:14,590 –> 00:13:17,372
验证是很令人厌烦的
It’s annoying.

308
00:13:17,372 –> 00:13:18,580
我拿出我的设备
I want to take out my device.

309
00:13:18,580 –> 00:13:20,000
我就想马上使用它
And I want to use it immediately.

310
00:13:20,000 –> 00:13:21,900
我就想立刻看到内容
And I want to have access to my information.

311
00:13:21,900 –> 00:13:24,170
所以我们才开始调查
And so when we began looking into why

312
00:13:24,170 –> 00:13:26,654
为什么用户不在他们的设备上使用屏幕锁
it is that users didn’t have lock screens on their device.

313
00:13:26,654 –> 00:13:28,070
这就是为什么用户不喜欢
And why they didn’t use what seems

314
00:13:28,070 –> 00:13:31,680
使用这最基本的安全保护方式
to be the most fundamental security protection,

315
00:13:31,680 –> 00:13:34,830
答案就是 它们出现的太频繁了
the answer is, it just comes up too often.

316
00:13:34,830 –> 00:13:37,770
因此接近半数的用户
And almost half of Android users have

317
00:13:37,770 –> 00:13:40,330
决定不使用屏幕锁
decided that they don’t want a secure lock screen.

318
00:13:40,330 –> 00:13:42,220
所以我们尽力做的事情就是
So one of the things that we’re trying to do

319
00:13:42,220 –> 00:13:44,410
实现用户的愿望
is find ways to encourage that.

320
00:13:44,410 –> 00:13:48,011
如果在用户登入设备时
Because if we get to a point where the logging in mechanism

321
00:13:48,011 –> 00:13:50,010
在开始与设备交互时
is trustworthy, where authentication of the user

322
00:13:50,010 –> 00:13:51,340
就是被验证过的
at the time they start interacting with the device,

323
00:13:51,340 –> 00:13:52,850
那么你应用中的设置
then you can do a lot more and be

324
00:13:52,850 –> 00:13:55,255
其实可以更加的灵活
a lot more flexible in the set of applications that you can provide.

325
00:13:55,255 –> 00:13:57,440
所以 Android Pay 就是一个很好的例子
So Android Pay is a good example where,

326
00:13:57,440 –> 00:14:01,410
因为用户是已经被验证过的 他们就可以使用 Android Pay
because users are authenticated, they can have access to Android Pay.

327
00:14:01,410 –> 00:14:05,300
所以我们结合了这两种想法
So we actually bind those two ideas together.

328
00:14:05,300 –> 00:14:08,164
因此在介绍指纹解锁时就更容易了
So to make things easier we introduced fingerprints.

329
00:14:08,164 –> 00:14:10,080
这些我们之前都已经介绍过了
That was one of the things that was introduced

330
00:14:10,080 –> 00:14:12,220
包括 Nexus 手机上的 Android M
with Android M on Nexus phones and an API for you

331
00:14:12,220 –> 00:14:14,290
以及开发者所使用的API
to interact with it as an application developer.

332
00:14:14,290 –> 00:14:17,380
我们可以看到在 Nexus 设备上
On Nexus devices we’ve seen adoption of secure lock screen

333
00:14:17,380 –> 00:14:20,836
一旦加入了指纹解锁
go from about 50% to over 90% on devices

334
00:14:20,836 –> 00:14:22,210
屏幕锁的使用数量就从50%上升到了90%
where a fingerprint is available.

335
00:14:22,210 –> 00:14:25,324
因为这实在是太简单方便了
Because it’s just so much easier.

336
00:14:25,324 –> 00:14:27,240
我们也为那些没有指纹识别传感器的设备
We’ve also made changes for those devices that

337
00:14:27,240 –> 00:14:29,030
提供了另一种解决方案
don’t have access to fingerprint,

338
00:14:29,030 –> 00:14:32,610
比如说智能解锁
for one reason or another, through things like Smart Lock.

339
00:14:32,610 –> 00:14:34,870
其中智能解锁提供的一个功能
One of the capabilities that Smart Lock provides

340
00:14:34,870 –> 00:14:38,365
我们称之为身体探测
is what we call on body detection, where we monitor how the device is

341
00:14:38,365 –> 00:14:40,240
我们可以监测出与设备交互的周围环境
interacting with the environment around them.

342
00:14:40,240 –> 00:14:41,170
它是否在口袋里
Is it in their pocket?

343
00:14:41,170 –> 00:14:43,461
它是不是还在初次解锁它的人
Do we think it’s still in control of the individual who

344
00:14:43,461 –> 00:14:44,770
手里
first unlocked it?

345
00:14:44,770 –> 00:14:47,360
这个功能可以使
The use of that alone can reduce the frequency

346
00:14:47,360 –> 00:14:50,560
验证频率减少50%
with which users need to authenticate by over 50%.

347
00:14:50,560 –> 00:14:52,180
在我们的经验中能够看到这一点
We’ve seen that in our experience.

348
00:14:52,180 –> 00:14:56,640
在把验证变得简单这件事上我们已经取得很大的进展了
So we’ve got good progress on making authentication easier for users.

349
00:14:56,640 –> 00:14:59,180
这也是我们一直在努力的事情
So that’s one of the things that we’re striving for.

350
00:14:59,180 –> 00:15:00,830
我们还尽力把
The other thing that we’re trying to do

351
00:15:00,830 –> 00:15:03,330
验证变得更强大
is make authentication stronger.

352
00:15:03,330 –> 00:15:05,340
这同样也带来一些改变
So there are some changes there as well.

353
00:15:05,340 –> 00:15:08,860
其中之一就是允许
One of them was to allow applications

354
00:15:08,860 –> 00:15:11,380
应用把私密数据绑定到验证上
to tie their secrets to authentication.

355
00:15:11,380 –> 00:15:14,000
你可以确保应用中的某些功能
So you can make sure that your application will only

356
00:15:14,000 –> 00:15:17,050
是只有被验证过的
function if the user has a secure lock screen

357
00:15:17,050 –> 00:15:19,100
用户才可以使用的
and they have been recently authenticated.

358
00:15:19,100 –> 00:15:21,220
这是一个非常重要的改变
So that’s an important change that you can make.

359
00:15:21,220 –> 00:15:23,345
有一类事情是应用需要特别担心的
One of the types of things that an application that

360
00:15:23,345 –> 00:15:25,110
即财务系统
worries about, say financial systems

361
00:15:25,110 –> 00:15:27,830
或是访问敏感数据
or access to sensitive data, would want to do.

362
00:15:27,830 –> 00:15:30,780
我们做的另一件事就是
Another thing that we’ve done is to move the authentication

363
00:15:30,780 –> 00:15:32,660
把验证挪进了 TrustZone
actually into TrustZone.

364
00:15:32,660 –> 00:15:34,860
所以即使
So that even if the overall operating system

365
00:15:34,860 –> 00:15:37,680
操作系统都被攻陷了
has been compromised, there is no mechanism

366
00:15:37,680 –> 00:15:41,850
根据现有的机制
available for the device to leak the credential,

367
00:15:41,850 –> 00:15:45,900
证书 指纹或是
the fingerprint, for example, or the user’s lock screen password

368
00:15:45,900 –> 00:15:48,310
用户的解锁密码
into a place that it could do and exhaust

369
00:15:48,310 –> 00:15:50,280
也不会泄露
over the strength of that credential.

370
00:15:54,060 –> 00:15:57,181
因此你需要思考的就是如何利用好验证
So you want to think about how to use authentication.

371
00:15:57,181 –> 00:15:59,430
我们提供了一些指纹的 API
We’ve provided some APIs so that it’s possible for you

372
00:15:59,430 –> 00:16:01,860
你可以直接调用
to directly invoke the fingerprint APIs.

373
00:16:01,860 –> 00:16:05,770
我们也提供了一些 API 让你可以控制
We’ve also provided APIs that allow you to control the user

374
00:16:05,770 –> 00:16:06,940
相关的用户体验
experience around that.

375
00:16:06,940 –> 00:16:09,550
你不一定必须描述
So you’re not constrained in how you would represent

376
00:16:09,550 –> 00:16:10,830
你将用验证来干什么
what it means to authenticate.

377
00:16:10,830 –> 00:16:13,530
但我们还是建议你提供
This is again, you get to offer context

378
00:16:13,530 –> 00:16:16,060
说明来解释你为什么需要验证
for why it is that you’re requesting authentication.

379
00:16:16,060 –> 00:16:17,250
因为我们认为应用体验中
We think that’s a really important part

380
00:16:17,250 –> 00:16:19,680
一个非常重要的部分
of the application experience is that you are effectively

381
00:16:19,680 –> 00:16:22,490
就是你以何种方式告诉用户
in control over how it is that you represent to the user what

382
00:16:22,490 –> 00:16:23,710
你将要干什么
you’re going to do.

383
00:16:23,710 –> 00:16:26,860
所以在这个实例中 UI 描述出了
So in this instance, that UI describing

384
00:16:26,860 –> 00:16:31,000
Google Play 如何使用指纹识别
how fingerprint is taken place is being drawn entirely by Google Play.

385
00:16:31,000 –> 00:16:32,875
他们需要描述接下来要做的事情
They get to describe, we’re going to do this.

386
00:16:32,875 –> 00:16:35,590
这就是我们如何使用它的做法 如果你也想这样
And here’s how we’re going to use it, if they want to do that.

387
00:16:35,590 –> 00:16:37,589
你也可以在你的应用中这样做
And you can do that in your application as well.

388
00:16:39,880 –> 00:16:43,740
这里提供一个快速示例 非常直观的
Just to give a quick example, very, very straightforward how

389
00:16:43,740 –> 00:16:51,340
展示如何把应用与指纹绑定
you create a key in this instance and then bind that to a fingerprint.

390
00:16:51,340 –> 00:16:53,590
在这个实例中 我想特意强调的是
In this instance, the thing that I wanted to highlight

391
00:16:53,590 –> 00:16:57,836
你事实上创建了一个回调
is that you’re actually creating a callback, a wrap based

392
00:16:57,836 –> 00:16:59,210
一个基于密钥的包装
on the key, and you’re only going

393
00:16:59,210 –> 00:17:02,884
如果用户验证成功了你只需要解密就行了
to do the decryption if the user has successfully authenticated.

394
00:17:02,884 –> 00:17:04,550
所以你现在知道与你应用
So you now know that the data associated

395
00:17:04,550 –> 00:17:06,630
相关的数据都是包装在密钥中的
with your application that’s been wrapped in that key

396
00:17:06,630 –> 00:17:09,254
只有通过验证的用户
simply doesn’t exist and is not accessible until after the user

397
00:17:09,254 –> 00:17:10,690
才能够访问这些数据
is authenticated.

398
00:17:10,690 –> 00:17:15,945
我再花几分钟时间说一下直接启动
I’ll talk in a couple of minutes about how we’re doing direct to boot.

399
00:17:15,945 –> 00:17:18,690
它有一个相似的模块 就是应用数据
And it has a similar model, where application data is not

400
00:17:18,690 –> 00:17:22,880
只有在用户已经被验证过了之后才能被获取
available until the user has already been authenticated.

401
00:17:22,880 –> 00:17:26,079
最佳范例
So a couple of best practices, I think

402
00:17:26,079 –> 00:17:30,680
我认为这对于
that there’s a real opportunity to auth-bound keys

403
00:17:30,680 –> 00:17:36,100
验证密钥锁屏和安全锁屏的使用
to drive both adoption of the use of authentication

404
00:17:36,100 –> 00:17:38,030
来说是一个真正的机会
on the lock screen and secure lock screen.

405
00:17:38,030 –> 00:17:40,010
同时也简化了用户与
And also to simplify the way that the user

406
00:17:40,010 –> 00:17:42,051
应用之间的交互方式
is going to be interacting with your application.

407
00:17:42,051 –> 00:17:44,720
因此当用户使用你的应用时
Then you don’t need to have a check for pin or password

408
00:17:44,720 –> 00:17:45,930
你就没有必要再让用户做出 pin 码或是密码检查了
when a user comes in to your application,

409
00:17:45,930 –> 00:17:46,830
即使应用中包含很多敏感数据
no matter how sensitive it is.

410
00:17:46,830 –> 00:17:49,455
因为你知道他们在解锁屏幕时
Because you know that they very recently have gone through that

411
00:17:49,455 –> 00:17:51,310
已经验证过身份了
authentication already at the lock screen.

412
00:17:51,310 –> 00:17:53,770
所以我是明确鼓励使用上述机制的
So I would definitely encourage using that mechanism.

413
00:17:53,770 –> 00:17:55,140
你可以设定一个时间上限
You can time bound it and say, if they’ve

414
00:17:55,140 –> 00:17:57,310
可以是一分钟 五分钟 十分钟
logged in the last minute, the last five minutes, the last 10

415
00:17:57,310 –> 00:17:59,610
只要是符合你应用的
minutes, whatever’s appropriate for your application

416
00:17:59,610 –> 00:18:03,891
安全规范就好
to drive good security practices consistent with your application.

417
00:18:03,891 –> 00:18:05,890
另一件我鼓励的事
The other thing that I would encourage you to do

418
00:18:05,890 –> 00:18:09,710
当然就是指纹解锁了
is certainly favor fingerprint.

419
00:18:09,710 –> 00:18:12,830
如果设备上有一个
You know the evidence seems to be that a fingerprint

420
00:18:12,830 –> 00:18:14,040
指纹识别器
readers exist on a device.

421
00:18:14,040 –> 00:18:16,130
那么用户总是倾向于使用它的
That’s going to be the mechanism that users are going to want to use.

422
00:18:16,130 –> 00:18:18,379
所以我也鼓励你
So I would encourage you to use that as your mechanism

423
00:18:18,379 –> 00:18:21,850
把指纹解锁
to do binding of authentication credentials

424
00:18:21,850 –> 00:18:24,400
加进你的解锁机制里
to key material inside of Keystore.

425
00:18:24,400 –> 00:18:26,414
如果指纹解锁
If that’s not available, then falling back

426
00:18:26,414 –> 00:18:28,830
不可用的话
to doing something like create confirmed device credential

427
00:18:28,830 –> 00:18:32,624
那就做点类似创建确认设备凭据
intent as a means to bind to whatever other secure lock

428
00:18:32,624 –> 00:18:34,040
之类的事
screen they have on the devices is

429
00:18:34,040 –> 00:18:36,110
用来安全的
a perfectly reasonable fallback for those devices where

430
00:18:36,110 –> 00:18:37,276
解锁设备
fingerprint isn’t available.

431
00:18:40,146 –> 00:18:42,020
其实我们已经谈到很多了
So we’ve covered a couple of features so far.

432
00:18:42,020 –> 00:18:44,620
下面我们来说一下加密部分
We’re going to get now into the crypto section.

433
00:18:44,620 –> 00:18:48,167
我们先来讨论一下网络安全 之后是安全存储
Talk first about secure networking and then get into secure storage.

434
00:18:54,860 –> 00:19:01,400
我很好奇究竟多少的细微改变
It’s amazing to me how often simple changes can make

435
00:19:01,400 –> 00:19:04,590
才能引发一个安全方面巨大的变革
a huge difference in security.

436
00:19:04,590 –> 00:19:08,210
我们花了一分钟思考
We spent a minute thinking about users and how many of them

437
00:19:08,210 –> 00:19:11,609
为什么有些用户选择不在锁屏上加密码
choose not to have a lock screen.

438
00:19:11,609 –> 00:19:12,650
因为这很复杂
Because it’s complicated.

439
00:19:12,650 –> 00:19:15,820
而且很麻烦 同样地
Because it’s difficult. In the same way,

440
00:19:15,820 –> 00:19:17,880
我们发现部分应用的开发者
we find that application developers often

441
00:19:17,880 –> 00:19:21,320
也同样选择不使用安全的网络传输
choose not to use secure networking because a little bit

442
00:19:21,320 –> 00:19:22,746
因为它太麻烦了
too difficult.

443
00:19:22,746 –> 00:19:25,120
所以我们在最近的几个发布版本中
So what we’ve been doing over the last couple of releases

444
00:19:25,120 –> 00:19:27,780
试着让它变得简单一点
is trying to make that simpler.

445
00:19:27,780 –> 00:19:29,672
麻烦的地方在于我们发现
One of the complexities that we found

446
00:19:29,672 –> 00:19:31,130
应用的开发者
is that application developers just

447
00:19:31,130 –> 00:19:34,650
不知道他们现在使用的网络传输是否安全
don’t know whether they’re using secure traffic or not.

448
00:19:34,650 –> 00:19:37,860
一个很普遍的例子是 他们在应用中
A good example might be, they’ve incorporated an advertising

449
00:19:37,860 –> 00:19:40,190
加入了广告包
library into their application.

450
00:19:40,190 –> 00:19:44,340
为了使广告内容
Does that advertising library use HTTPS to request assets

451
00:19:44,340 –> 00:19:46,680
个性化
when it sends up device identifiers or user identifiers

452
00:19:46,680 –> 00:19:48,555
发送设备标识或是用户标识时
in order to request those advertisements that

453
00:19:48,555 –> 00:19:50,490
广告包是否用的是HTTPS请求
have been personalized for that application?

454
00:19:50,490 –> 00:19:51,856
你知道吗
Do you know?

455
00:19:51,856 –> 00:19:54,230
Android Marshmallow 的其中一个特点就是
And so one of the features that was introduced in Android

456
00:19:54,230 –> 00:19:57,040
允许应用控制网络请求
Marshmallow was the ability for an application to say,

457
00:19:57,040 –> 00:20:00,430
我可以选择使用明文通信
you know what, I want to use clear-text traffic.

458
00:20:00,430 –> 00:20:05,010
或是相反地 我不想选择明文通信
And conversely, I don’t think that I need to use clear-text traffic.

459
00:20:05,010 –> 00:20:07,319
如果你在使用一个类似 gmail 的应用
If you’re an application like gmail,

460
00:20:07,319 –> 00:20:09,610
你可以说我知道我所有的连接
you can say I know that all my connections are going up

461
00:20:09,610 –> 00:20:10,210
都将上传到 Google 服务器中
to a Google server.

462
00:20:10,210 –> 00:20:11,300
这也是一种保护的手段
And that’s the one that’s been protected.

463
00:20:11,300 –> 00:20:11,410
当然
And.

464
00:20:11,410 –> 00:20:14,280
我也可以说 嗯 我不想使用任何明文通信
I can say, whoop, I’m going to not use any clear-text traffic.

465
00:20:14,280 –> 00:20:15,290
如果你是另一个应用
If you’re a different application,

466
00:20:15,290 –> 00:20:17,498
那么你就需要知道它是否
then you need to go through the process of evaluating

467
00:20:17,498 –> 00:20:18,440
在使用明文通信
whether it’s there.

468
00:20:18,440 –> 00:20:20,690
这就是我们做的
So this is a feature that was put in place to simplify

469
00:20:20,690 –> 00:20:22,648
快速明确你的应用是否
understanding whether your application actually

470
00:20:22,648 –> 00:20:23,890
在使用明文通信
uses clear-text traffic.

471
00:20:23,890 –> 00:20:26,710
而且能让用户知道
And to give users visibility into whether you think

472
00:20:26,710 –> 00:20:29,410
他的应用是否在使用明文通信
you use clear-text traffic.

473
00:20:29,410 –> 00:20:32,600
当然 这用起来也很简单
So, it’s really straightforward, very easy to use.

474
00:20:32,600 –> 00:20:34,730
它就在你的 manifests 中
Inside your manifests, it’s very simple.

475
00:20:34,730 –> 00:20:36,120
你使用明文通信了吗
Do you use clear-text traffic?

476
00:20:36,120 –> 00:20:38,160
没有
No.

477
00:20:38,160 –> 00:20:43,060
接着是 API 例如一个 URL
And then API, such as URL– yeah,

478
00:20:43,060 –> 00:20:48,160
HTTP://URL 连接 如果它不使同 HTTPS 是不会正常工作的
HTTP://URL Connect, where it’s not using HTTPS will simply not work.

479
00:20:48,160 –> 00:20:50,140
所以这些 API 被用于
So those APIs that are known to be

480
00:20:50,140 –> 00:20:52,959
保证通过网络传输的用户数据
insecure in transmitting user data across a network simply

481
00:20:52,959 –> 00:20:53,750
的安全
no longer function.

482
00:20:53,750 –> 00:20:55,083
它们将返回一个安全错误
They’ll return a security error.

483
00:20:55,083 –> 00:20:57,090
你就可以摆脱困境了
And you can bail out.

484
00:20:57,090 –> 00:20:59,290
这多方便
So that’s great.

485
00:20:59,290 –> 00:21:01,540
只可惜这导致了大部分的应用是安全的
Except that it turns out most applications

486
00:21:01,540 –> 00:21:03,695
而一小部分是不安全的
do some stuff secure and some stuff not secure.

487
00:21:03,695 –> 00:21:05,945
所以我们知道我们需要提供更强的灵活性
So we knew that we needed to provide more flexibility.

488
00:21:05,945 –> 00:21:07,570
所以我们在 Android N 中
And so that’s one of the things that we

489
00:21:07,570 –> 00:21:10,520
致力于更加精细的控制
began focusing on in Android N is how do we

490
00:21:10,520 –> 00:21:13,930
尤其是当我们了解到
have more granular controls while recognizing

491
00:21:13,930 –> 00:21:16,810
存在于 SSL 和 TLS 栈中的粒度
that the granularity that’s existed in SSL and TLS

492
00:21:16,810 –> 00:21:20,140
已经成为了在实现部署中
Stacks and the SSL APIs has been a source

493
00:21:20,140 –> 00:21:24,370
难以置信的复杂与困难的来源
of incredible complexity and incredible difficulty in deployment.

494
00:21:24,370 –> 00:21:27,010
所以我们想在网络安全配置方面做的工作就是
And so what we want to do with network security config

495
00:21:27,010 –> 00:21:30,710
让身为应用开发者的你在使用安全传输时
is make it really easy for you, as an application developer,

496
00:21:30,710 –> 00:21:33,700
更容易
to know where you’re using secure transports.

497
00:21:33,700 –> 00:21:35,207
而且在这过程中
And then to control those transports

498
00:21:35,207 –> 00:21:37,540
不会使你的代码变得更复杂
in a way that doesn’t make your coding really difficult.

499
00:21:37,540 –> 00:21:38,970
它非常清晰
So it’s entirely declarative.

500
00:21:38,970 –> 00:21:40,300
因为它全在 manifest 里
And it’s all in the manifest.

501
00:21:40,300 –> 00:21:43,170
现在让我们谈谈一些基础功能
So let’s talk about some of the basic capabilities.

502
00:21:43,170 –> 00:21:45,520
这是一个很简单的例子
Well here’s a really simple one.

503
00:21:45,520 –> 00:21:49,110
原来 我没有在每个地方都使用安全通路
It turns out, I don’t use secure traffic everywhere.

504
00:21:49,110 –> 00:21:51,822
但是我知道我正在 secure.example.com 上使用它
But I know that I use it on secure.example.com.

505
00:21:51,822 –> 00:21:54,160
这样我就可以使用 domain-config
And so I can use a domain config.

506
00:21:54,160 –> 00:21:59,060
我把它配置在使用安全通路的地方
I set up where this domain is one that uses secure traffic.

507
00:21:59,060 –> 00:22:03,560
当我指定为 false 时 它使用明文通信
OK, so it does use clear-text traffic, specifies it as false.

508
00:22:03,560 –> 00:22:06,340
而且我没有对任何要与我的应用交互的
And I don’t make any claims about any other domains

509
00:22:06,340 –> 00:22:09,030
域名做任何的要求
that my application might be interacting with.

510
00:22:09,030 –> 00:22:11,175
这样你就可以保持
So you can keep that advertising library

511
00:22:11,175 –> 00:22:12,800
广告库的不变
that otherwise would have prevented you

512
00:22:12,800 –> 00:22:14,870
也不用担心你应用的其他功能
from being confident about the rest of the functionality

513
00:22:14,870 –> 00:22:15,703
有任何的变化
of your application.

514
00:22:19,870 –> 00:22:22,210
这仅仅
So that’s the start of the types of things

515
00:22:22,210 –> 00:22:23,610
是开端
that you’d want to be able to do.

516
00:22:23,610 –> 00:22:25,401
我们发现的另外一件事情
Another thing that we’ve found is that it’s

517
00:22:25,401 –> 00:22:28,540
就是调试困难
very difficult to do debugging.

518
00:22:28,540 –> 00:22:31,100
这种情况很常见
We see that in the context of Google on a regular basis.

519
00:22:31,100 –> 00:22:32,980
我们在调试设备上的交互方式
The way that we interact with our debug infrastructure

520
00:22:32,980 –> 00:22:35,563
与真实发布设备上的交互方式
is different from the way that we do interact with our release

521
00:22:35,563 –> 00:22:36,450
非常不同
infrastructure.

522
00:22:36,450 –> 00:22:38,074
他们的密钥材料是不一样的
We have different key material on them.

523
00:22:38,074 –> 00:22:40,552
不是所有的 Android 设备中
We might not come from a certificate authority that’s

524
00:22:40,552 –> 00:22:43,380
都有权威机构的认证
a well known certificate authority that’s on all the Android devices.

525
00:22:43,380 –> 00:22:45,046
因为这仅仅是一个测试设备
Because it’s just a test infrastructure.

526
00:22:45,046 –> 00:22:47,240
而且你也不想为复杂而又昂贵的SSL
And you don’t want to have to pay for and maintain

527
00:22:47,240 –> 00:22:50,540
付费和维护
that sort of complex or costly SSL infrastructure.

528
00:22:50,540 –> 00:22:52,670
价格虽然不是那么高
Not that it’s that costly, but that’s the mindset

529
00:22:52,670 –> 00:22:54,049
但这是很多开发者的真实想法
of a lot of developers.

530
00:22:54,049 –> 00:22:57,100
所以我们要做的就是把它变得简单点
And so one of the things that we want to do is make it really simple.

531
00:22:57,100 –> 00:22:59,730
在过去 开发者的方法是
Because in the past, the way that developers have done this,

532
00:22:59,730 –> 00:23:02,340
他们必须通过一系列的自定义代码
is they’ve had to go through a lot of custom code

533
00:23:02,340 –> 00:23:04,680
来改变 SSL 在应用中的
to change how SSL handling took place

534
00:23:04,680 –> 00:23:06,380
操作模式
inside the context of their application.

535
00:23:06,380 –> 00:23:08,140
因此我们把网络安全配置的事
So we’re going to do that all in the manifest now with network

536
00:23:08,140 –> 00:23:09,357
全都放在了 manifest 中
security config.

537
00:23:09,357 –> 00:23:11,190
这样做就与原来基于
So that should make it really, really simple

538
00:23:11,190 –> 00:23:14,640
发布设施的做法完全不同了
for you to test in a way that’s distinct from, entirely

539
00:23:14,640 –> 00:23:17,490
这将变得极为简单
independent from, your release infrastructure,

540
00:23:17,490 –> 00:23:20,380
而且你再也不用写任何的自定义代码了
but also not have to write any custom code to do that.

541
00:23:20,380 –> 00:23:22,600
感觉如何
So what does it look like?

542
00:23:22,600 –> 00:23:26,460
在 network-security-config 中可以直接修改
Here’s a pretty simple way to do it, network security config.

543
00:23:26,460 –> 00:23:28,250
你需要加上 debug-overrides
You declare debug overrides.

544
00:23:28,250 –> 00:23:30,950
当你在调试应用的时候
And you set a different set of trust anchors

545
00:23:30,950 –> 00:23:34,796
设置一个不一样的 trust-anchors
when your application is running in a debug environment.

546
00:23:34,796 –> 00:23:36,670
你指定 trust-anchors 是什么
And you specify what those trust anchors are.

547
00:23:36,670 –> 00:23:39,210
你完全可以在你的应用里这么做 像在这做的一样
You can include them in your applications, as is being done here.

548
00:23:39,210 –> 00:23:41,126
事实上它们在你的应用中
This is actually specifying that they’re going

549
00:23:41,126 –> 00:23:42,644
被具体指定了
to be in your application.

550
00:23:42,644 –> 00:23:44,560
而且当你的应用调试完成以后
And you now know that when your application is

551
00:23:44,560 –> 00:23:49,260
你不用修改任何的代码
no longer in a debug build, no change to your code at all.

552
00:23:49,260 –> 00:23:51,080
你用发布版本发布出来
You’ve released it in release mode.

553
00:23:51,080 –> 00:23:52,090
你上传它
You ship it.

554
00:23:52,090 –> 00:23:54,287
所有有关调试的重写代码
And all of the code related to this debug overrides

555
00:23:54,287 –> 00:23:56,620
都不会再展示在应用之中
is no longer going to be present inside the application.

556
00:23:56,620 –> 00:23:57,578
非常直观
Really straightforward.

557
00:24:02,414 –> 00:24:03,830
你也许想做
You may want to do things that are

558
00:24:03,830 –> 00:24:08,160
比域名等级限制更复杂的事
more sophisticated than just domain level restrictions,

559
00:24:08,160 –> 00:24:10,150
使用 certificate-authorities 中的 built
using the built in certificate authorities,

560
00:24:10,150 –> 00:24:13,929
或从调试硬件中区别出
or differentiating your debug hardware, debug

561
00:24:13,929 –> 00:24:15,970
调试设施和发布设施
infrastructure, from your release infrastructure.

562
00:24:15,970 –> 00:24:17,905
所以我们再谈论下这个问题
So let’s talk about that for just a second.

563
00:24:17,905 –> 00:24:19,280
有很多种不同的方法
Here’s a couple of different ways

564
00:24:19,280 –> 00:24:21,920
可以限制你需要与之交互的证书
that you can actually limit the set of certificates

565
00:24:21,920 –> 00:24:25,280
而且不需要写一个你自己的
that you interact with without needing to write your own SSL

566
00:24:25,280 –> 00:24:28,520
SSL 错误处理器或是 SSL 证书确认程序
error handlers and SSL certificate validation routines.

567
00:24:28,520 –> 00:24:32,240
这是一个很简单的域名
Really simple one, these are domains for which

568
00:24:32,240 –> 00:24:34,760
需要把我们应用中的
we are going to include the certificates that

569
00:24:34,760 –> 00:24:38,960
证书绑定上去
are tied to those domains in our application.

570
00:24:38,960 –> 00:24:42,870
所以我们指定了 secure.example.com 和 cdn.example.com
So we specify secure.example.com, cdn.example.com.

571
00:24:42,870 –> 00:24:45,120
而这些应用与证书
And these are apps, these are certs, that are actually

572
00:24:45,120 –> 00:24:47,230
都将直接在我的应用里
going to be directly in my app.

573
00:24:47,230 –> 00:24:49,710
所以不需要依赖系统证书
So don’t rely on the system certificates.

574
00:24:49,710 –> 00:24:53,500
我也不需要买一个证书或是别人的认证
I don’t need to go buy a certificate or validate with somebody else.

575
00:24:53,500 –> 00:24:55,970
我应用的信任凭据就在
My application’s trust is contained entirely inside

576
00:24:55,970 –> 00:24:56,830
应用里面
of that application.

577
00:24:56,830 –> 00:24:58,580
这样我就可以连接到服务器了
And then I can connect out to that server.

578
00:25:02,759 –> 00:25:04,550
另一个我们经常问到的就是
Another thing that we often get asked about

579
00:25:04,550 –> 00:25:06,990
怎样证书锁定
is, how do I do certificate pinning?

580
00:25:06,990 –> 00:25:09,050
证书锁定 如果你对
Certificate pinning, in case you’re not

581
00:25:09,050 –> 00:25:11,050
这个术语不熟悉 就是判断
familiar with the term, is to identify

582
00:25:11,050 –> 00:25:15,082
一个特定的证书 不是 CA 不是证书链
a specific certificate, not a CA, no a certificate chain,

583
00:25:15,082 –> 00:25:17,540
是一个你需要与一个特定服务器
but a specific certificate that you expect to be associated

584
00:25:17,540 –> 00:25:19,080
通信的证书
with a particular web service.

585
00:25:19,080 –> 00:25:21,320
所以我们要介绍的一个功能就是
So one of the capabilities that we introduced here

586
00:25:21,320 –> 00:25:24,500
指定 pin 当然同样是在 manifest 中
is the ability to specify a pin, again directly in the manifest,

587
00:25:24,500 –> 00:25:26,740
你不需要修改 SSL 代码
so you don’t have to manipulate the SSL code

588
00:25:26,740 –> 00:25:28,470
或是你自己的证书
or do your own certificate validation.

589
00:25:28,470 –> 00:25:31,840
如果你想的话可以迅速的做出改变
And you can very quickly make a change to that if you’d like to do so.

590
00:25:31,840 –> 00:25:36,740
我担心锁定和管理你自己的信任凭据
I would caution that pinning and managing your own trusts

591
00:25:36,740 –> 00:25:38,100
会比较棘手
can be a little bit tricky.

592
00:25:38,100 –> 00:25:40,840
所以我们明确地鼓励你使用内置插件
And so we definitely encourage you to use the built ins.

593
00:25:40,840 –> 00:25:43,390
但是我们也想保证你的
But we also wanted to make sure that you have the flexibility

594
00:25:43,390 –> 00:25:44,877
灵活性
to do things.

595
00:25:44,877 –> 00:25:46,960
如果你不想刁难自己的话
if you really want to cause yourself a little more

596
00:25:46,960 –> 00:25:50,120
你最好还是这样做
grief than you otherwise had to do.

597
00:25:50,120 –> 00:25:54,649
这是我幻灯片里想讲述的重点
So here’s how I would describe that in bullet points on a slide.

598
00:25:54,649 –> 00:25:57,190
我们在网络安全配置方面
There’s a bunch of changes that we made with network security

599
00:25:57,190 –> 00:25:59,590
做了很多的改变 而且我们认为这些改变
config and some best practices that we

600
00:25:59,590 –> 00:26:03,240
几乎适用于每个人
think are appropriate for nearly everyone.

601
00:26:03,240 –> 00:26:05,330
一个很好的例子就是
A good example of that is identifying

602
00:26:05,330 –> 00:26:06,920
在所有域名中识别出
what are the domains that you expect

603
00:26:06,920 –> 00:26:10,210
你想要确保安全的那些域名
all of the traffic on those domains to be secure.

604
00:26:10,210 –> 00:26:11,340
然后着重保证它的安全
And actually specify that.

605
00:26:11,340 –> 00:26:14,442
如果它用明文通信 那就把它设置为 false
Say it uses clear-text traffic and set it to false.

606
00:26:14,442 –> 00:26:16,650
这样你就能确保不会意外地
So that you can make sure that you don’t accidentally

607
00:26:16,650 –> 00:26:19,220
通过这些网络发送任何不安全的数据
send any insecure data over those networks.

608
00:26:19,220 –> 00:26:22,451
理想状况是 我们希望你把它用在每一个地方
Ideally, we would like you to do it for everything.

609
00:26:22,451 –> 00:26:23,700
当然我们现在还不是很完美
But we’re not there quite yet.

610
00:26:23,700 –> 00:26:24,366
我们知道
We realize that.

611
00:26:24,366 –> 00:26:25,492
这是一个递进的过程
So this is incremental.

612
00:26:25,492 –> 00:26:26,950
最后我们将在整个
And eventually we’ll get to a point

613
00:26:26,950 –> 00:26:28,408
Android 生态系统中
where it can be done for everything

614
00:26:28,408 –> 00:26:30,550
的每一点网络访问上
across the entire Android ecosystem

615
00:26:30,550 –> 00:26:33,380
都用上这个技术
as we are pushing to do the same across the broader web.

616
00:26:36,020 –> 00:26:38,420
另一个我们做出的重要改变是
Another important change that was made

617
00:26:38,420 –> 00:26:41,380
用户的安装证书不再是默认的了
was that user installed certificates are no longer

618
00:26:41,380 –> 00:26:43,590
之前使用此设备的用户
trusted by default. The user on a device

619
00:26:43,590 –> 00:26:46,377
有权利在
has the ability to go in, add a certificate,

620
00:26:46,377 –> 00:26:48,210
应用与服务器
and, previously, had the ability to then man

621
00:26:48,210 –> 00:26:50,410
中间
in the middle, traffic between your application

622
00:26:50,410 –> 00:26:52,150
添加一个证书
and your server infrastructure.

623
00:26:52,150 –> 00:26:54,690
他们想那么做的原因有很多
There’s a lot of reasons why they might want to do that.

624
00:26:54,690 –> 00:26:56,231
同样地 你也有相当多的理由
And there’s a lot of reasons that you

625
00:26:56,231 –> 00:26:58,400
把这功能放到你的应用中
might want to enable it in your application as well.

626
00:26:58,400 –> 00:27:01,522
另一方面 我们发现在
On the other hand, we thought and we found in conversations

627
00:27:01,522 –> 00:27:03,730
开发者的对话中 绝大多数的开发者
with developers, that the vast majority of developers

628
00:27:03,730 –> 00:27:05,150
就这个没什么预期
don’t anticipate that.

629
00:27:05,150 –> 00:27:06,800
如果他们能连接到自己的服务器
And if they’re connecting to their own infrastructure

630
00:27:06,800 –> 00:27:09,091
又连接不到别的地方 那么他们就没有什么特殊的理由
and to nowhere else, they don’t see a particular reason

631
00:27:09,091 –> 00:27:10,020
这样做了
to enable that.

632
00:27:10,020 –> 00:27:12,994
所以这就有了用户在无意中
And so there was a risk of users unintentionally

633
00:27:12,994 –> 00:27:15,990
安装了有可能导致中间人攻击的证书
installing certificates that could allow for a man in the middle.

634
00:27:15,990 –> 00:27:19,530
所以我们改变了这种默认的安装方式
And so we’ve changed the default to no longer have

635
00:27:19,530 –> 00:27:22,160
在默认情况下 允许在
user certificates be, by default,

636
00:27:22,160 –> 00:27:26,002
应用与终端之间拦截通信
able to intercept traffic between your application and your endpoint.

637
00:27:26,002 –> 00:27:27,460
如果你愿意的话你也可以做出改变
You can change that if you want to.

638
00:27:27,460 –> 00:27:28,924
可能在你应用中的某些情况下
There may be situations where it’s

639
00:27:28,924 –> 00:27:31,340
是适用的
appropriate to do that in the context of your application.

640
00:27:31,340 –> 00:27:31,780
有些则不适用
There may not.

641
00:27:31,780 –> 00:27:35,630
这取决于你
It’s something for you to take a look at and make a determination for.

642
00:27:35,630 –> 00:27:38,840
我们致力的另一件事就是简化调试
The other thing that we’ve tried to do is simplify debugging.

643
00:27:38,840 –> 00:27:41,230
我们建议你可以试一试
So I would encourage you to go look at your application.

644
00:27:41,230 –> 00:27:45,170
如果你使用了任何的 SSL 操作
If you have any SSL handling that you’ve implemented

645
00:27:45,170 –> 00:27:48,300
比如说自定义操作 自定义认证 或其他自定义的 SSL 操作
that’s custom handling, custom cert verification, custom SSL

646
00:27:48,300 –> 00:27:52,110
你可以用网络安全配置替换之
handlers, you probably can replace that with network security config

647
00:27:52,110 –> 00:27:53,630
这样做将更简单
and make it much easier to make sure that you

648
00:27:53,630 –> 00:27:54,838
而且不容易出错
don’t make a mistake in that.

649
00:27:58,950 –> 00:28:01,760
如果你还想做的更多
If you want to do something and you

650
00:28:01,760 –> 00:28:04,460
而且你觉得有信心
feel confident in your ability to manage

651
00:28:04,460 –> 00:28:06,414
管理你自己的证书 我们同样
your own certificates, we’ve provided that

652
00:28:06,414 –> 00:28:08,830
提供更简单的做法
and try to make that a little bit simpler for you as well.

653
00:28:08,830 –> 00:28:13,094
不过就像我刚才说的 这么做可能更复杂
But as I mentioned, this is a little bit more difficult

654
00:28:13,094 –> 00:28:14,510
而且更容易出错
and a little bit more error prone.

655
00:28:14,510 –> 00:28:16,635
这是你需要想清楚的地方
So it’s something that you’d want to think through.

656
00:28:20,870 –> 00:28:22,930
上述就是网络相关的内容
So we talked about networking.

657
00:28:22,930 –> 00:28:25,370
下面我们来聊聊我们经常提到的加密技术
Now let’s get into the thing that we so often just refer

658
00:28:25,370 –> 00:28:30,980
2016年的大型加密讨论
to as encryption, the big encryption debates of 2016.

659
00:28:30,980 –> 00:28:32,920
我花费了很多时间来谈论
I’ve been spending a lot of my time talking

660
00:28:32,920 –> 00:28:35,390
为什么存储加密对
about why it is that storage encryption is

661
00:28:35,390 –> 00:28:38,060
用户数据的保护如此的重要
so important for protecting user data.

662
00:28:38,060 –> 00:28:41,320
我们用类似 Android Pay 这样的应用
The benefits that it has accrued on the ecosystem where we’re

663
00:28:41,320 –> 00:28:44,350
让开发者能够在 Android 生态系统中获得收益
now able to deliver applications like Android Pay, where it’s

664
00:28:44,350 –> 00:28:47,560
因此对开发者来说 设备信息的
possible for a developer to rely on the integrity

665
00:28:47,560 –> 00:28:49,530
完整性和机密性
and the confidentiality of information

666
00:28:49,530 –> 00:28:51,890
是相当关键的
that’s critical to the application on the device.

667
00:28:51,890 –> 00:28:54,430
这就是我们在所有装载有 Marshmallow
That’s one of the reasons among many

668
00:28:54,430 –> 00:28:58,690
系统的设备上开始推广加密技术
that we’ve moved towards requiring encryption on all capable devices

669
00:28:58,690 –> 00:29:00,170
的原因
starting with Marshmallow.

670
00:29:00,170 –> 00:29:02,010
这是强制执行的
We made that mandatory.

671
00:29:02,010 –> 00:29:04,980
我们会把它变得越来越健壮
And we’ve been making that more and more robust.

672
00:29:04,980 –> 00:29:07,522
因为我们认为直接对用户设备的物理威胁
Because we think direct physical threats to the user’s device

673
00:29:07,522 –> 00:29:09,896
也是我们需要考虑的事情
are one of the things that we need to be concerned about.

674
00:29:09,896 –> 00:29:12,350
这就是我们开始推广的设备名单
These are devices that we move around in the world with.

675
00:29:12,350 –> 00:29:14,520
这也包括手环之类的设备
They are sometimes attached to your wrist.

676
00:29:14,520 –> 00:29:16,400
也包括你车中的设备
They’re sometimes in your car.

677
00:29:16,400 –> 00:29:19,610
有多种强存储加密方式
There’s a lot of different ways that having strong storage

678
00:29:19,610 –> 00:29:22,540
对 Android 的安全来说是非常重要的
encryption is really fundamental to Android security.

679
00:29:22,540 –> 00:29:24,850
但这不意味着我们不能把它变得更好
But that doesn’t mean we can’t make it better.

680
00:29:24,850 –> 00:29:26,370
也不意味着我们不能在用户体验的角度上
It doesn’t mean that we can’t improve it from a user

681
00:29:26,370 –> 00:29:27,360
把它变得更好
experience standpoint.

682
00:29:27,360 –> 00:29:29,360
Android N 的一个重大变化就是
And so one of the big changes with the Android N

683
00:29:29,360 –> 00:29:31,950
直接启动
is what we refer to as Direct Boot.

684
00:29:31,950 –> 00:29:34,140
我将分别从用户和开发者的角度说
I’ll talk about it both from a user perspective

685
00:29:34,140 –> 00:29:37,730
不过在开发者的角度上会多说一点
and then I’ll get into it a little bit from a developer’s perspective.

686
00:29:37,730 –> 00:29:40,020
从用户的角度来说 直接启动
From a user perspective, direct boot basically

687
00:29:40,020 –> 00:29:44,700
意味着我不需要重复的输入密码了
means I don’t go through two times putting in my user’s password.

688
00:29:44,700 –> 00:29:46,330
我不必输入两次
I don’t have to double enter that.

689
00:29:46,330 –> 00:29:49,205
因为在设备开启的时候
Because currently, the first time the device comes up,

690
00:29:49,205 –> 00:29:50,080
就已经输入过了
you have to enter it.

691
00:29:50,080 –> 00:29:51,430
然后设备就被解锁了
The device is then decrypted.

692
00:29:51,430 –> 00:29:54,650
然后你就可以与应用交互了
And then you get it again as you’re interacting with it.

693
00:29:54,650 –> 00:29:56,110
这也意味着在你第一次进入之后
It also means that all of the data

694
00:29:56,110 –> 00:29:58,276
所有的数据都被解锁了
is decrypted after you’ve entered it the first time.

695
00:29:58,276 –> 00:30:00,620
我再简单说两句
So we’ll talk about that more in just a second.

696
00:30:00,620 –> 00:30:04,440
全盘加密的另一个挑战就是
Another challenge that exists with full disk encryption

697
00:30:04,440 –> 00:30:09,460
所有的数据都一直处于保护之中
is it means that, yes, all the data is protected all the time.

698
00:30:09,460 –> 00:30:15,460
直到用户输入了他们的密码 你就完蛋了
But until the user has entered their password, you’re stuck.

699
00:30:15,460 –> 00:30:18,090
因为没有应用能访问数据
No application has the ability to access data.

700
00:30:18,090 –> 00:30:22,272
所以其中一个重要的改变就是设备现在就被启动了
And so one of the important changes is the device will now come up.

701
00:30:22,272 –> 00:30:24,480
还有运行在后台的东西
And things that are running in the background, things

702
00:30:24,480 –> 00:30:30,479
像是来电 短信
like inbound calls, inbound SMS, your alarm

703
00:30:30,479 –> 00:30:32,020
你要早起赶上
clock in the morning for those of you

704
00:30:32,020 –> 00:30:34,270
6点从旧金山
who had to get up earlier than the six o’clock shuttle

705
00:30:34,270 –> 00:30:36,432
开来的公交车
coming down from San Francisco, who

706
00:30:36,432 –> 00:30:38,890
别人都不像我运气这么好
didn’t have the fortune that I did of having a two-year-old

707
00:30:38,890 –> 00:30:42,430
因为我在三点就醒了 而这种情况持续了两年
wake you up at 3:00 so you were already awake.

708
00:30:42,430 –> 00:30:43,980
你依赖你的闹钟吗
You rely on your alarm clock?

709
00:30:43,980 –> 00:30:48,350
我已经超过六个月没这么做了
I don’t have to do that for another six or so months.

710
00:30:48,350 –> 00:30:51,240
所以我们开始了这项工作
And so we move towards making that work,

711
00:30:51,240 –> 00:30:53,694
即使用户还没有把它们放进凭据里
even if the user hasn’t put in their credential.

712
00:30:53,694 –> 00:30:55,860
以上就是站在用户角度上的讨论
So that’s what it looks like from a user standpoint.

713
00:30:55,860 –> 00:30:57,630
那从开发者的角度来说呢
What’s it look like from a developer standpoint?

714
00:30:57,630 –> 00:31:01,340
我们介绍关于存储加密的两种不同观念
We introduced two different concepts in terms of storage encryption.

715
00:31:01,340 –> 00:31:04,020
第一种就是你最熟悉的
The first is the one that’s most familiar to you

716
00:31:04,020 –> 00:31:06,750
凭据加密
right now, credential encryption.

717
00:31:06,750 –> 00:31:10,660
这意味着只有用户进入了他们的凭据之后
That means this data is only available after the user has

718
00:31:10,660 –> 00:31:12,940
才能访问数据
entered their credential.

719
00:31:12,940 –> 00:31:16,070
还有一种就是我们刚才提到的设备加密数据
We also have what we refer to as device encrypted data.

720
00:31:16,070 –> 00:31:21,720
这种数据只有用 TrustZone 中存储的密钥才能访问
This is data that’s available with a key that’s stored in TrustZone.

721
00:31:21,720 –> 00:31:24,740
这就是防止数据泄露的
So it’s protected in a variety of different mechanisms

722
00:31:24,740 –> 00:31:25,820
各种手段
against extractions.

723
00:31:25,820 –> 00:31:27,560
数据仍然是被加密的
The data is still encrypted, but it’s

724
00:31:27,560 –> 00:31:30,810
不过是被与设备相关联的密钥加密了
encrypted with a key that’s only tied to the device.

725
00:31:30,810 –> 00:31:32,880
默认情况下 应用还是运行在
Applications by default are going

726
00:31:32,880 –> 00:31:34,700
凭据加密环境下
to run in credential encrypted environment.

727
00:31:34,700 –> 00:31:37,328
所以如果你不做出任何改变 你所要做的就是
So if you don’t change anything, the behavior you have is going

728
00:31:37,328 –> 00:31:39,240
弄懂你的应用是如何工作的
to be exactly the way your application works now,

729
00:31:39,240 –> 00:31:41,590
用户一旦登入设备
which is once the user logs in, you can access the data

730
00:31:41,590 –> 00:31:43,860
你就可以用上述方式访问数据了
and you can kind of proceed along your way.

731
00:31:43,860 –> 00:31:48,030
但是如果你的应用在用户解锁设备之前
But if you have an application that requires access

732
00:31:48,030 –> 00:31:50,800
就需要访问数据的话
to information potentially before the user had entered

733
00:31:50,800 –> 00:31:54,220
你可以把你的应用标记为直接启动感知
their credentials, you can declare yourself to be direct boot aware.

734
00:31:54,220 –> 00:31:56,705
这样你在被声明为
And then you have access to the data

735
00:31:56,705 –> 00:31:58,830
直接启动感知的 activity 中
in the context of the activity that’s been declared

736
00:31:58,830 –> 00:31:59,947
就可以直接访问数据了
to be direct boot aware.

737
00:31:59,947 –> 00:32:01,530
当然你也可以直接与之交互
And you can actually interact with it.

738
00:32:01,530 –> 00:32:03,080
这就是 TalkBack 的工作原理
So that’s how TalkBacks works.

739
00:32:03,080 –> 00:32:04,880
这就是短信的工作原理
That’s how a SMS’ works.

740
00:32:04,880 –> 00:32:07,890
这就是闹钟
That’s how alarms store, this is an alarm,

741
00:32:07,890 –> 00:32:09,510
尤其是在重启后
and immediately upon reboot, I want

742
00:32:09,510 –> 00:32:11,010
的工作原理
to be able to execute on that alarm.

743
00:32:13,979 –> 00:32:16,810
怎样声明直接启动感知呢
What does it mean to declare yourself to be direct boot aware?

744
00:32:16,810 –> 00:32:18,184
非常直观
Pretty straightforward.

745
00:32:18,184 –> 00:32:19,850
上半部分在 manifest 里
The top half of this is in the manifest.

746
00:32:19,850 –> 00:32:22,000
你只需要说 我是直接启动感知就行了
You just say, I’m direct boot aware.

747
00:32:22,000 –> 00:32:25,890
然后 receiver 就被触发了
OK, and then that receiver can be triggered.

748
00:32:25,890 –> 00:32:29,270
这样一个 intent 就被触发了
In the event that a particular intent is fired like,

749
00:32:29,270 –> 00:32:32,566
也许是叫 boot complete 吧
I don’t know, boot complete, then your application

750
00:32:32,566 –> 00:32:36,470
然后你的应用就会根据特定的 receiver 运行
will start running in the context of that particular receiver.

751
00:32:36,470 –> 00:32:38,862
为了使用存储 你最可能干的事情
To use storage, which presumably is one of the things

752
00:32:38,862 –> 00:32:40,320
就是你需要
that you’d want to do, you’re going

753
00:32:40,320 –> 00:32:44,550
在设备保护存储中
to need to create storage that’s in the context of device

754
00:32:44,550 –> 00:32:45,330
开辟一块存储空间出来
protected storage.

755
00:32:45,330 –> 00:32:47,340
这是底部的一小段代码
And so there’s a little snippet of code down there at the bottom.

756
00:32:47,340 –> 00:32:48,530
你创建你应用的 context
You create your app context.

757
00:32:48,530 –> 00:32:49,571
你使用你应用的 context
You use your app context.

758
00:32:49,571 –> 00:32:52,480
你创建一个设备保护与存储的 context
And then you create a device protect and storage context.

759
00:32:52,480 –> 00:32:53,860
然后只需把它打开就行了
And then you just open it.

760
00:32:53,860 –> 00:32:56,330
你可以用任何你喜欢的方式与之交互
You interact with it exactly like you would any other way.

761
00:32:56,330 –> 00:32:59,920
当你按我刚才说的那么做时
When you are running in what I refer to as the device context,

762
00:32:59,920 –> 00:33:02,100
与之相反的是凭据保护
as opposed to the credential protected context,

763
00:33:02,100 –> 00:33:05,680
你仍然可以创建凭据保护的文件
you can still create files that are credential protected.

764
00:33:05,680 –> 00:33:06,770
你只是不能读取它们
You just can’t read them.

765
00:33:09,401 –> 00:33:11,400
但你仍然可以做很多事情
But there are lots of ways that could be useful.

766
00:33:11,400 –> 00:33:12,150
你可以往后附加
You can append.

767
00:33:15,030 –> 00:33:17,560
如果你收到一封邮件
So if you receive an inbound mail message.

768
00:33:17,560 –> 00:33:20,460
那你就需要转换成一个很糟糕的邮件
And you’ve got a really horrible mail storage

769
00:33:20,460 –> 00:33:22,500
存储格式 然后附加在后面
format where you just append.

770
00:33:22,500 –> 00:33:25,291
你可以仅拿到标题然后展示在锁屏界面上
You could just grab the headers and display that on the lock screen.

771
00:33:25,291 –> 00:33:27,160
然后获取真实的内容
And then take the actual content and push it

772
00:33:27,160 –> 00:33:29,197
并把它放到凭据保护存储里
into credential protected storage.

773
00:33:29,197 –> 00:33:31,280
你可能只是因为缓存才这么做
You’d probably want to do that just for the cache,

774
00:33:31,280 –> 00:33:32,857
而非针对所有的邮件
not for all of your mail.

775
00:33:32,857 –> 00:33:34,440
在需要有精致的用户体验地方
But you could do those kinds of things

776
00:33:34,440 –> 00:33:35,898
为了维护最佳的安全
where you have a sophisticated user

777
00:33:35,898 –> 00:33:38,810
你也可以这样做
experience while maintaining optimal security.

778
00:33:38,810 –> 00:33:42,020
下面我们来谈谈最佳范例
So let’s talk about some of those best practices.

779
00:33:42,020 –> 00:33:44,870
第一个我想说的就是使用默认值
The first thing I want to do is point out, just use the defaults.

780
00:33:44,870 –> 00:33:46,320
绝大部分的应用
The vast majority of applications,

781
00:33:46,320 –> 00:33:47,861
你是不希望在用户登录之前
you’re not expecting your application

782
00:33:47,861 –> 00:33:50,925
做太多事情的
to do much, if anything, prior to the user logging in.

783
00:33:50,925 –> 00:33:53,170
这就跟默认模式非常匹配了
And so it’s perfectly appropriate to use the defaults.

784
00:33:53,170 –> 00:33:55,727
从安全的角度来说这也是比较理想的
And that sort of optimal from a security standpoint.

785
00:33:55,727 –> 00:33:58,310
这也使你的开发更简单
It also makes your life a little bit simpler because you don’t

786
00:33:58,310 –> 00:34:00,880
因为你不需要想 我现在是不是要接入设备的内容啦
have to think, is this available to me now in the device context?

787
00:34:00,880 –> 00:34:02,480
我能够接入凭据吗
Am I able to access credentials?

788
00:34:02,480 –> 00:34:04,050
如果你运行起来 那么数据就在这
It’s there if you’re running.

789
00:34:04,050 –> 00:34:08,750
如果你没有直接启动感知 那就是上述这样
If you aren’t direct boot aware, everything’s there if you’re running.

790
00:34:08,750 –> 00:34:10,333
如果你是直接启动感知的
If you are direct boot aware, then you

791
00:34:10,333 –> 00:34:12,850
那你就要明确在何时
have to be direct boot aware of which things are going

792
00:34:12,850 –> 00:34:15,510
什么数据是可以被访问的
to be available at that time.

793
00:34:15,510 –> 00:34:17,630
另一个最佳实践是 仔细想想
The other best practice is, think very carefully

794
00:34:17,630 –> 00:34:19,300
如果你是直接启动感知的
about if you are direct boot aware,

795
00:34:19,300 –> 00:34:21,674
哪些东西应该放入设备加密
which things do you want to put into the device encrypted

796
00:34:21,674 –> 00:34:23,830
或是设备保护存储中
or device protected storage?

797
00:34:23,830 –> 00:34:27,601
请不要把有效时间过长的凭据放进来
Please don’t put long live credentials into that area.

798
00:34:27,601 –> 00:34:29,100
如果你不想切断
So you don’t want to have off tokens

799
00:34:29,100 –> 00:34:31,266
用于连接 service 的 token 的话
that are sitting there that could be used to connect

800
00:34:31,266 –> 00:34:34,370
即使用户还没有
to a service, even though the user hasn’t authorized that

801
00:34:34,370 –> 00:34:36,855
进入凭据给它授权
by entering their credential.

802
00:34:36,855 –> 00:34:38,730
我们需要考虑的另一件事是
One of the things that we want to think about

803
00:34:38,730 –> 00:34:41,320
你能否限制 token 的范围
is, can you limit the scope of tokens?

804
00:34:41,320 –> 00:34:44,429
如果你有一个类似邮件接收器的东西
So if you have something like a mail receiver, maybe

805
00:34:44,429 –> 00:34:45,864
可能你只是想阅读邮件
you just want to read mail.

806
00:34:45,864 –> 00:34:49,370
但那并不意味着你将要发送邮件
But that doesn’t necessarily mean that you’re going to send it.

807
00:34:49,370 –> 00:34:50,750
如果你不希望用户
If you don’t expect the user ever

808
00:34:50,750 –> 00:34:52,270
在还没有登录设备的时候
to be able to send mail when they haven’t actually

809
00:34:52,270 –> 00:34:54,120
就能发送邮件
logged onto the device, you certainly

810
00:34:54,120 –> 00:34:55,661
你应该也不希望他们 嗯 比如说
don’t expect them to be able to like,

811
00:34:55,661 –> 00:34:58,740
删除他们的账户 删除他们所有的信息
I don’t know, delete their account, delete all of their messages.

812
00:34:58,740 –> 00:35:00,156
这些都是你不希望在用户登录之前
These are not tasks that you would

813
00:35:00,156 –> 00:35:02,650
看到的景象
expect to happen before the user has logged in.

814
00:35:02,650 –> 00:35:04,510
所以你想
And so you would want to limit the scope

815
00:35:04,510 –> 00:35:05,640
通过限制 token 的能力范围
of the ability of the application

816
00:35:05,640 –> 00:35:08,014
来限制应用
to perform those behaviors by limiting the authentication

817
00:35:08,014 –> 00:35:11,310
能力的范围
tokens that it has available inside that scope.

818
00:35:11,310 –> 00:35:12,810
还有我想提醒你的是
And then the other one that I hinted

819
00:35:12,810 –> 00:35:15,018
如果你收到了一些你认为是敏感的数据
at there, which is, if you receive some data that you

820
00:35:15,018 –> 00:35:18,030
接收它 然后加密
think is sensitive, receive it, put it somewhere that’s encrypted.

821
00:35:18,030 –> 00:35:20,519
你可以用类似公钥的非对称加密
You can either encrypt it locally using

822
00:35:20,519 –> 00:35:22,810
当然前提是你有
asymmetric cryptography like public key, where you just

823
00:35:22,810 –> 00:35:25,350
设备保护存储的公钥
have the key that you have the public key

824
00:35:25,350 –> 00:35:27,520
或是用凭据保护存储中的
in device protected storage and the private key

825
00:35:27,520 –> 00:35:31,554
私钥加密
to be able to decrypt it inside of the credential protected storage.

826
00:35:31,554 –> 00:35:33,970
所以你知道读取邮件的权限
So you know that that key and the ability to read the mail

827
00:35:33,970 –> 00:35:37,150
需要用户登录他们的设备
requires the user to have entered their password.

828
00:35:37,150 –> 00:35:40,830
你可以做很多的事情
There’s a variety of things you can do there as well.

829
00:35:40,830 –> 00:35:43,110
我们也正在努力中
OK, we’re making good progress.

830
00:35:43,110 –> 00:35:44,800
我还有十分钟就要离开了
We’ve got about 10 minutes left.

831
00:35:44,800 –> 00:35:47,405
下面我们将要谈一谈 verified boot 和沙盒
We’re going to barrel through verified boot and sandboxing.

832
00:35:47,405 –> 00:35:50,552
在最后会有两到三分钟的
And I think we’ll have two or three minutes to talk questions

833
00:35:50,552 –> 00:35:51,260
问答时间
there at the end.

834
00:35:51,260 –> 00:35:52,730
我会预留出来
And I’ll hang out for a while.

835
00:35:52,730 –> 00:35:56,200
享受在旧金山没有的阳光
Enjoy the sunshine, which we don’t have up in San Francisco.

836
00:35:59,020 –> 00:36:03,780
verified boot 已经被介绍过很多次了
Verified boot was introduced over a couple of releases

837
00:36:03,780 –> 00:36:06,810
而且在 M 版本上的设备装载
and then became required on M for devices

838
00:36:06,810 –> 00:36:10,070
有能力提供 verified boot 的硬件已经是必须的了
that had hardware capable of providing verified boot, which

839
00:36:10,070 –> 00:36:12,570
这在线性加密中基本相当于
basically amounts to devices that met a performance

840
00:36:12,570 –> 00:36:16,680
每秒50兆的高级加密标准
threshold of about 50 megabits per second AES in line encryption.

841
00:36:16,680 –> 00:36:18,680
顺便说 这包括了绝大多数的设备
That’s the vast majority of devices, by the way.

842
00:36:22,020 –> 00:36:26,690
在 N 中我们把所谓的强制模式
In N we moved from what we called enforcing mode

843
00:36:26,690 –> 00:36:29,010
转换成了严格强制模式
to strictly enforcing mode.

844
00:36:29,010 –> 00:36:32,200
在 M 中警告用户然后继续启动
With M it was acceptable for a device to warn the user

845
00:36:32,200 –> 00:36:35,017
是可以接受的
and then proceed to boot, as a mechanism

846
00:36:35,017 –> 00:36:37,100
这也是我们验证实际
for us to begin to validate how frequently were we

847
00:36:37,100 –> 00:36:38,100
出错率的一种机制
seeing errors in the field?

848
00:36:38,100 –> 00:36:39,520
我们看到了什么问题
What kinds of problems were we seeing?

849
00:36:39,520 –> 00:36:41,850
并确保这里将要出问题
And making sure that there was going to be disruption.

850
00:36:41,850 –> 00:36:44,010
我认为一个很有意思的特点是
One of, I think, the more intriguing features

851
00:36:44,010 –> 00:36:47,520
错误更正
that was introduced in verified boot was error correction.

852
00:36:47,520 –> 00:36:50,590
它是在 N 中被介绍的 它可以帮我们探测出
It was introduced with Android N. This gives us the ability

853
00:36:50,590 –> 00:36:54,760
位级错误 实际上是大量的位级错误
to detect bit level errors, and actually lots of bit level errors.

854
00:36:54,760 –> 00:36:57,760
实际上它们在内核层
And they actually get corrected at the time those blocks are

855
00:36:57,760 –> 00:37:00,290
被读取的时候就被纠正了
being read at the kernel level.

856
00:37:00,290 –> 00:37:03,430
所以 当你正用低端硬件处理问题时
And so, when you’re dealing with very low-end hardware,

857
00:37:03,430 –> 00:37:06,710
位级错误就是我们会遇到的问题了
bit level errors were a problem that we might run into.

858
00:37:06,710 –> 00:37:09,000
我们至少看到了一个实例
We’ve also seen at least one instance

859
00:37:09,000 –> 00:37:12,740
测试它们做出的改变
of testing where there were actually changes made

860
00:37:12,740 –> 00:37:15,740
在设备被 root 之后
that were– after a device had been rooted,

861
00:37:15,740 –> 00:37:17,349
通过增加 SU
there were changes made to allow it

862
00:37:17,349 –> 00:37:20,170
或是其他手段等等
to continue to be rooted by adding SU and a couple of other things.

863
00:37:20,170 –> 00:37:22,790
错误更正消除了这些改变
An error correction actually erased those changes.

864
00:37:22,790 –> 00:37:25,217
所以它们仍在那 但是你不能执行他们
So they were still there, but you couldn’t actually

865
00:37:25,217 –> 00:37:26,800
这很令人震惊吧
get them to execute, which is amazing.

866
00:37:26,800 –> 00:37:30,320
这是一次意外 但也足够让人兴奋
Totally an accident, but pretty exciting.

867
00:37:30,320 –> 00:37:33,470
我们开始留意到底有多少种检查
We’re beginning to see how those kinds of checks

868
00:37:33,470 –> 00:37:36,248
可以提高安全性 并且是在我们意料之外的
could actually improve security in more than the expected ways.

869
00:37:39,530 –> 00:37:42,720
verified boot 可以让开发者的你
Verified boot is part of making it easier for you

870
00:37:42,720 –> 00:37:44,480
更容易了解到你所运行的环境
as a developer to understand that you’re

871
00:37:44,480 –> 00:37:47,600
是一个非常安全的环境
running in an environment that is a strong secure environment.

872
00:37:47,600 –> 00:37:49,690
另一件
And so there’s one other thing that we

873
00:37:49,690 –> 00:37:52,320
我们要讨论的是 SafetyNet API
want to talk about in this context, which is the safety

874
00:37:52,320 –> 00:37:54,770
和补丁程序级别字符串
net API and patch level strings, which

875
00:37:54,770 –> 00:37:56,802
都是为了让开发者
are both mechanisms designed to make it easier

876
00:37:56,802 –> 00:37:58,260
更容易的弄明白
for you as an application developer

877
00:37:58,260 –> 00:38:01,310
什么是运行设备中的
to understand what is the security context of this device

878
00:38:01,310 –> 00:38:02,619
安全背景
that I’m running on?

879
00:38:02,619 –> 00:38:04,160
SafetyNet API
So the safety net API– I’ll give you

880
00:38:04,160 –> 00:38:07,090
我将用几秒钟的时间举一个示例代码
an example code in just a second– basically looks

881
00:38:07,090 –> 00:38:10,020
它基于设备的特性 而且适配到 Jelly Bean
at the device characteristics– and this goes back all the way

882
00:38:10,020 –> 00:38:15,070
来试着说明这是否是真实的设备
to Jelly Bean– and tries to understand whether this is a real device.

883
00:38:15,070 –> 00:38:17,990
它基于大量的硬件属性
It looks at a bunch of hardware characteristics,

884
00:38:17,990 –> 00:38:20,190
包括 GPU 是怎么工作的
including like how does the GPU work?

885
00:38:20,190 –> 00:38:21,910
GPU 的编号是什么
Not what is the GPU’s serial number?

886
00:38:21,910 –> 00:38:24,837
GPU 的执行操作是什么
Not what is– but performs operations on the GPU

887
00:38:24,837 –> 00:38:26,670
用于确保它是以一种
to make sure that it’s executing in a manner

888
00:38:26,670 –> 00:38:28,830
我们认为与
that we would expect to be consistent with a piece

889
00:38:28,830 –> 00:38:30,914
正在运行的操作系统的硬件
of hardware that matches this specification that’s

890
00:38:30,914 –> 00:38:33,760
相匹配的方式运行的
being provided by the operating system that’s running on top of it.

891
00:38:33,760 –> 00:38:35,740
所以我们收集了很多数据
So we aggregate a whole bunch of that,

892
00:38:35,740 –> 00:38:37,850
分析它们 然后反馈给你 yes
analyze that, and make a statement back to you

893
00:38:37,850 –> 00:38:40,225
这看起来像是一个
that yes, this looks like a real piece of hardware that’s

894
00:38:40,225 –> 00:38:43,190
运行某版本 Android 的兼容设备
running a version of Android that is a CTS compatible,

895
00:38:43,190 –> 00:38:45,894
由 OEM 检测 然后提交到 Google
tested by OEM, and then submitted to Google

896
00:38:45,894 –> 00:38:48,310
这样我们就能确定这是一个真实的硬件
so that we can confirm that it’s a real piece of hardware.

897
00:38:48,310 –> 00:38:50,102
因此 SafetyNet API 的
So that’s one of the goals of SafetyNet API

898
00:38:50,102 –> 00:38:52,900
一个目标就是让你对这个功能充满信心
is to make it possible for you to have that kind of confidence.

899
00:38:52,900 –> 00:38:54,608
另一个我们要介绍的是
And then another thing that we introduced

900
00:38:54,608 –> 00:38:56,980
Android 补丁程序级别字符串
was called the Android patch level string.

901
00:38:56,980 –> 00:39:00,500
补丁程序级别字符串非常非常的简单
The patch level string is really, really simple.

902
00:39:00,500 –> 00:39:02,900
你可以检测它 这样你就可以看到
You can check it, and you can see

903
00:39:02,900 –> 00:39:06,480
上次设备安全更新的时间
when is the last time this device got a security update?

904
00:39:06,480 –> 00:39:11,010
如果历史可以借鉴
If history is any guide, we’ve released now

905
00:39:11,010 –> 00:39:14,590
我们发布月度安全更新的次数已经有10次了
10 monthly security updates.

906
00:39:14,590 –> 00:39:16,590
如果这个字符串已经过期一个月了
If that string is more than a month out of date,

907
00:39:16,590 –> 00:39:19,160
那说明这个设备已经有安全问题了
there are publicly known security issues that affect that device.

908
00:39:19,160 –> 00:39:20,930
所以我们和设备制造商共同努力
So we’re working with OEMs and carriers

909
00:39:20,930 –> 00:39:23,430
确保升级推送能按时推送
to make sure that they’re able to deliver updates very, very quickly.

910
00:39:23,430 –> 00:39:25,510
但是作为应用开发者的你
But you as an application developer

911
00:39:25,510 –> 00:39:28,580
可能想评估
might want to look at that and evaluate

912
00:39:28,580 –> 00:39:30,800
你对具体设备的信任程度
how much trust you have in that particular device.

913
00:39:30,800 –> 00:39:32,400
尤其在企业的环境中
Especially in an enterprise context,

914
00:39:32,400 –> 00:39:34,734
我们看到越来越多的企业有类似这样的政策
we’re seeing more and more enterprises set policies that

915
00:39:34,734 –> 00:39:36,650
如果这个设备过期超过60天了
say things like, if this device is out of date

916
00:39:36,650 –> 00:39:39,780
那就不适合我的企业环境了
more than 60 days, it’s not appropriate for my enterprise environment.

917
00:39:39,780 –> 00:39:42,113
而且我们也想把这变得简单点
And we wanted to make that a really simple thing for you

918
00:39:42,113 –> 00:39:44,850
你不用安装一大批的热修复和补丁包
have to do so you don’t have a table of hot fixes and service

919
00:39:44,850 –> 00:39:47,530
来确保设备是安全的
packs to figure out whether a device is secure.

920
00:39:47,530 –> 00:39:50,790
如果这是在 KitKat 或是更高的版本 它有一个最近的安全补丁级别
If it’s on KitKat or above, and it has a recent security patch

921
00:39:50,790 –> 00:39:52,570
你就知道该升级了
level, you know it’s up to date.

922
00:39:52,570 –> 00:39:53,600
这是非常简便的
It’s pretty simple.

923
00:39:53,600 –> 00:39:57,684
正则表达式发挥了很大作用
Regular expressions help me to make that determination.

924
00:39:57,684 –> 00:40:00,620
让我们再用几秒钟谈论一下 SafetyNet
But let’s talk about SafetyNet for just a second.

925
00:40:00,620 –> 00:40:03,030
这不是一个由平台级别提供的 API
This is an API that’s not provided at the platform level.

926
00:40:03,030 –> 00:40:06,690
它是由 Google Play 服务提供的
It’s provided by a Google Play Services.

927
00:40:06,690 –> 00:40:08,460
相对来说比较直观
Relatively straightforward.

928
00:40:08,460 –> 00:40:09,590
你创建一个回调
You create a callback.

929
00:40:09,590 –> 00:40:10,440
你调用它
You invoke that.

930
00:40:10,440 –> 00:40:12,590
然后你拿到结果
And you get back the result. This is a result

931
00:40:12,590 –> 00:40:13,732
这就是要被签名的结果
that’s going to be signed.

932
00:40:13,732 –> 00:40:15,940
你想要看一下 SafetyNet 文件
You want to go to look at the SafetyNet documentation

933
00:40:15,940 –> 00:40:18,270
来确认 key 被签名成什么样了
to see what the key is that it’s been signed with.

934
00:40:18,270 –> 00:40:20,990
我们鼓励你做离线确认
We encourage you to do offline verification of this.

935
00:40:20,990 –> 00:40:23,210
然后你就在你的应用中接收到它了
So you receive it in the context of your application,

936
00:40:23,210 –> 00:40:25,090
之后你把它上传到服务器
but then you send it up to your server.

937
00:40:25,090 –> 00:40:26,690
然后服务器作出判断
And your server makes a determination

938
00:40:26,690 –> 00:40:29,640
判别这是否是从 Google 发来的
about whether this is a legitimate, signed statement

939
00:40:29,640 –> 00:40:30,896
合法的带签名陈述
that came back from Google.

940
00:40:30,896 –> 00:40:34,140
在带签名陈述中你要寻找什么呢
What are the things that you’re looking for in that signed statement?

941
00:40:34,140 –> 00:40:36,450
第一件事就是这是一个 nonce
The first is that there’s a nonce that

942
00:40:36,450 –> 00:40:39,480
它创建于服务器 下发到客户端
was created on your server, sent down to your client,

943
00:40:39,480 –> 00:40:40,780
再返回到服务器
comes back to your server.

944
00:40:40,780 –> 00:40:43,650
这和你递交的一样
And it’s the same as the nonce that you submitted.

945
00:40:43,650 –> 00:40:45,880
所以你想确保它确实经历了相同的过程
So you want to make sure that it actually went

946
00:40:45,880 –> 00:40:48,840
并且被 Google 签名了
through that same process and was signed by Google.

947
00:40:48,840 –> 00:40:51,580
然后它告诉你是不是有什么东西需要匹配 CTS
And then it tells you is this something that matches CTS?

948
00:40:51,580 –> 00:40:53,965
那么 是否匹配 CTS 呢
So, CTS profile match true or false?

949
00:40:53,965 –> 00:40:55,340
这将告诉你
That will give you a sense for is

950
00:40:55,340 –> 00:40:58,460
这是一个真实的硬件设备
this a device, a real hardware device, that

951
00:40:58,460 –> 00:41:01,390
已经经历了完整的 CTS 确认过程
has gone through the full CTS validation process

952
00:41:01,390 –> 00:41:03,220
并且正在以最初提交的
and is continuing to operate in the manner

953
00:41:03,220 –> 00:41:04,725
方式继续运行
that it was originally submitted.

954
00:41:04,725 –> 00:41:06,350
这是一群其他的环境
There’s a bunch of other context that’s

955
00:41:06,350 –> 00:41:09,710
你可以从中辨别这是不是你想要的
provided so you can validate that these are what you’re expecting.

956
00:41:09,710 –> 00:41:12,480
是不是你的应用给服务器提交的数据
Was it your app that sent up to the server?

957
00:41:12,480 –> 00:41:14,770
类似这样
Things like that.

958
00:41:14,770 –> 00:41:18,480
我最后想说的是沙盒
The last thing that I want to talk about is sandboxing.

959
00:41:18,480 –> 00:41:21,700
我们对 Android 中的沙盒寄予希望
Sandboxing is an area that we’ve been investing in in Android.

960
00:41:21,700 –> 00:41:23,742
每一次的发布都带来新的功能
With every release we introduce new capabilities.

961
00:41:23,742 –> 00:41:25,116
有一些事情
These are some of the things that

962
00:41:25,116 –> 00:41:27,240
在 Android M 和 N 中变化非常的大
have changed pretty significantly in Android M

963
00:41:27,240 –> 00:41:30,445
对 SELinux 有相当大的改进
and N. Significant improvements to SELinux, especially

964
00:41:30,445 –> 00:41:32,070
尤其是与驱动程序的交互
in the way that interacts with drivers.

965
00:41:32,070 –> 00:41:34,377
我们现在非常关心内核安全
We’re very concerned about kernel security right now.

966
00:41:34,377 –> 00:41:37,520
所以我们改变了使用 SELinux 的 ioctl 过滤方式
So we’ve made changes to the way ioctl’s are filtered with SELinux.

967
00:41:37,520 –> 00:41:43,160
Seccomp 同样考虑到
Seccomp, which also allows for filtering of interactions

968
00:41:43,160 –> 00:41:43,907
与内核的交互过滤
with the kernel.

969
00:41:43,907 –> 00:41:46,240
我将再多花一点时间谈论 Seccomp
Seccomp I’m going to I talk about more in just a moment.

970
00:41:46,240 –> 00:41:48,020
因为作为应用开发者的你
Because you, as an application developer,

971
00:41:48,020 –> 00:41:49,706
可以自己使用它
can actually use it yourself.

972
00:41:49,706 –> 00:41:51,580
这和 SELinux 有一点不同
Which is a little bit different from SELinux,

973
00:41:51,580 –> 00:41:54,410
我们所做的全都是直接适合你的配置
where we’ve done all the configuration for you directly.

974
00:41:54,410 –> 00:41:58,090
我们在 Android N 中用了两种工具使媒体服务器强化了很多
We’ve used those two tools to do a lot of mediaserver hardening

975
00:41:58,090 –> 00:42:01,780
而且我们同样也做了许多别的改变
in Android N. And then we’ve made a number of other changes

976
00:42:01,780 –> 00:42:06,430
为的是增强沙盒的健壮性
that we think increase the strength of the sandboxing.

977
00:42:06,430 –> 00:42:07,920
我们仅仅贴出了目录
We just put out a blog post.

978
00:42:07,920 –> 00:42:08,860
我知道它字很小
I know this is tiny.

979
00:42:08,860 –> 00:42:11,920
我也不认为你能阅读它
I don’t actually think you can read it.

980
00:42:11,920 –> 00:42:13,050
好吧 确实可以看到内容
It is actually readable.

981
00:42:13,050 –> 00:42:14,500
我不确定在投影仪上
All right, I wasn’t sure if it was even

982
00:42:14,500 –> 00:42:17,314
它能否显示清楚
going have enough pixels on the projector to be able to read it.

983
00:42:17,314 –> 00:42:18,730
我们贴出的目录
The blog post that we just put out

984
00:42:18,730 –> 00:42:21,680
描述了我们怎样使用这些性能
that describes how it is that we use some of these capabilities

985
00:42:21,680 –> 00:42:26,070
增强并拆解
to strengthen and really break down

986
00:42:26,070 –> 00:42:28,050
媒体服务器中的性能
the capabilities inside of mediaserver

987
00:42:28,050 –> 00:42:30,970
然后用 Seccomp 和 SELinux 把它们隔离起来
and isolate them using Seccomp and SELinux.

988
00:42:30,970 –> 00:42:34,310
所以如果一个区域出了问题 譬如说编码解码器
So that a compromise in one area, e.g. in the codec,

989
00:42:34,310 –> 00:42:36,420
在媒体服务器的环境中
doesn’t lead to a compromise in other areas

990
00:42:36,420 –> 00:42:37,700
不会导致在其他区域出问题
in the context of mediaserver.

991
00:42:37,700 –> 00:42:39,950
在你的应用中可以做同样的事情
But you can do the same thing inside your application.

992
00:42:39,950 –> 00:42:44,000
如果你有一个很复杂的金融业务
If you have a complex financial transaction that’s

993
00:42:44,000 –> 00:42:46,030
并且其中还有图像处理
based on image processing, you might

994
00:42:46,030 –> 00:42:48,152
你可能想把这两件事情分开
want to separate those two things apart.

995
00:42:48,152 –> 00:42:49,610
我不知道你为什么要这么做
I don’t know why you would do that.

996
00:42:49,610 –> 00:42:51,540
不过同时 这也有很多
But, at the same time, there are lots

997
00:42:51,540 –> 00:42:53,484
给信用卡拍照的应用
of apps that take pictures of credit cards

998
00:42:53,484 –> 00:42:55,150
之后试着处理信息
and then try to process that information

999
00:42:55,150 –> 00:42:56,830
然后支付
and then use that as a payment.

1000
00:42:56,830 –> 00:43:01,650
这是一个应用要做的事情
So it’s actually a thing that applications do do.

1001
00:43:01,650 –> 00:43:06,250
我们也把它广泛应用到了 Chrome 硬件中
We’ve also been using this pretty extensively to harden Chrome.

1002
00:43:06,250 –> 00:43:09,510
因为这里储存了你最敏感的凭据
Because that is something that stores your most sensitive

1003
00:43:09,510 –> 00:43:12,500
而且处理了很多
credentials and does a lot of processing of data

1004
00:43:12,500 –> 00:43:14,090
从互联网来的数据
that comes from the Internet.

1005
00:43:14,090 –> 00:43:16,040
在浏览器中这两件事
It’s ironic how close those two things

1006
00:43:16,040 –> 00:43:17,546
是非常紧密的
are in the context of a web browser.

1007
00:43:17,546 –> 00:43:19,920
所以这类平台级的性能很重要
So it’s really important that these kinds of capabilities

1008
00:43:19,920 –> 00:43:21,690
为的是
exist at the platform level to make

1009
00:43:21,690 –> 00:43:25,780
能够让应用更加健壮
it easy for that application to harden itself.

1010
00:43:25,780 –> 00:43:30,000
这是用 Seccomp 的一个范例
Here’s a sample of what it looks like to use Seccomp.

1011
00:43:30,000 –> 00:43:32,500
我们在媒体服务器的环境中开发了一个库
we actually created a library in the context of mediaserver.

1012
00:43:32,500 –> 00:43:33,958
所以如果你想深挖 Android 开源项目的话
So if you would dig around in AOSP,

1013
00:43:33,958 –> 00:43:37,800
你可能会发现一个叫 Mini Jail 的东西
you’ll be able to find something that’s called Mini Jail.

1014
00:43:37,800 –> 00:43:42,080
它讲述如何放置过滤器
And it describes how we set specific filters

1015
00:43:42,080 –> 00:43:46,030
来限制 Seccomp 中的
to limit the set of capabilities that each

1016
00:43:46,030 –> 00:43:48,170
或是硬件角度上的媒体服务器中的
of the different elements inside of Seccomp

1017
00:43:48,170 –> 00:43:52,645
每一个不同元素的性能
or inside of mediaserver have access to from hardware standpoint.

1018
00:43:52,645 –> 00:43:54,520
我们还做了很多别的事情
There are a bunch of other changes that we’ve

1019
00:43:54,520 –> 00:43:57,800
比如说让设备更难被破解
made as well, that make it more difficult for a device

1020
00:43:57,800 –> 00:43:59,400
以及其他我们谈论
to be compromised, things that we

1021
00:43:59,400 –> 00:44:02,859
关于沙盒强化时的一些想法
think about when we’re talking about hardening of sandbox.

1022
00:44:02,859 –> 00:44:04,650
它们也可能会对你的应用产生影响
They may have effects on your applications.

1023
00:44:04,650 –> 00:44:07,890
我也鼓励你看看那些
So I would encourage you to take a look at those

1024
00:44:07,890 –> 00:44:10,300
将要到来的改变
and be conscious that these changes are coming.

1025
00:44:10,300 –> 00:44:14,130
在这里也同样发生很多改变
So there are a couple of these changes here.

1026
00:44:14,130 –> 00:44:16,120
这是两个其他的 API
There are two other APIs that we’ve also

1027
00:44:16,120 –> 00:44:20,780
是关于抑制权限的
been very actively looking at to restrain the capabilities.

1028
00:44:20,780 –> 00:44:23,970
因为它们与滥用权限有关
Because they’ve been associated with abuse, basically.

1029
00:44:23,970 –> 00:44:27,150
我们给了设备管理很多权力
We gave a lot of power to device administrators.

1030
00:44:27,150 –> 00:44:29,224
比如说用户正在和
And it happens that that same power

1031
00:44:29,224 –> 00:44:31,140
他们的设备交互
to manage the way that the user is interacting

1032
00:44:31,140 –> 00:44:33,362
用勒索软件
with their device can be used to harm them

1033
00:44:33,362 –> 00:44:34,570
损害用户的利益
in the context of ransomware.

1034
00:44:34,570 –> 00:44:36,697
你改变了用户的密码然后说
You change the user’s password and then you say,

1035
00:44:36,697 –> 00:44:38,780
除非你付我钱否则我是不会让你登录回设备的
I’m not going to let you log back into your device

1036
00:44:38,780 –> 00:44:41,590
这是勒索软件的
until you pay me, is sort of the most fundamental way

1037
00:44:41,590 –> 00:44:42,922
常用做法
that ransomware can work.

1038
00:44:42,922 –> 00:44:45,796
所以我们做出了一些改变
And so we’re making changes to make it more difficult for applications

1039
00:44:45,796 –> 00:44:48,330
让这种应用不那么容易的能够访问这些API
to access those APIs.

1040
00:44:48,330 –> 00:44:49,850
同时我们也限制了
And then we’ve also limited the way

1041
00:44:49,850 –> 00:44:51,750
应用通过系统警告窗口
that applications can overlay content

1042
00:44:51,750 –> 00:44:55,230
覆盖在另一个应用上的方式
onto another application through system alert windows.

1043
00:44:55,230 –> 00:44:58,164
这也是我们强化了的地方
So that’s an area that we’ve been hardening as well.

1044
00:44:58,164 –> 00:45:00,580
抱歉两分钟的提问时间已经没有了
I lied when I said I would have two minutes for questions.

1045
00:45:00,580 –> 00:45:03,080
时钟告诉我还有五秒钟
The clock now says five seconds.

1046
00:45:03,080 –> 00:45:06,130
不过我们试着覆盖了所有的要点
But we managed to cover all of these key elements.

1047
00:45:06,130 –> 00:45:08,440
我不想在这多讲其他的了
I did want to leave you with a couple of pointers

1048
00:45:08,440 –> 00:45:10,690
以免你们陷入
to some additional information that you

1049
00:45:10,690 –> 00:45:14,250
过多的细节中
can look at to try to get into some more of the details here.

1050
00:45:14,250 –> 00:45:17,947
我将出去逛逛并乐于解答
And I will hang out outside and happy to answer any questions

1051
00:45:17,947 –> 00:45:18,780
你提出的所有问题
that you might have.

1052
00:45:18,780 –> 00:45:19,613
非常感谢
Thank you very much.

1053
00:45:19,613 –> 00:45:20,990
享受今天吧
Enjoy the rest of your day.

1054
00:45:20,990 –> 00:45:28,180
[MUSIC PLAYING]