android 生物识别_将生物识别提示与cryptoobject一起使用

最新推荐文章于 2024-02-19 13:45:00 发布

weixin_26727575

最新推荐文章于 2024-02-19 13:45:00 发布

阅读量1.6k

点赞数

文章标签： python android 语音识别人工智能安卓

原文链接：https://medium.com/androiddevelopers/using-biometricprompt-with-cryptoobject-how-and-why-aace500ccdb7

版权

本文翻译自Medium，探讨如何在Android应用中结合使用BiometricPrompt和CryptoObject进行生物识别验证，旨在增强安全性并理解其背后的原因。

摘要由CSDN通过智能技术生成

android 生物识别

Biometrics and Cryptography are not the same thing. They are in fact completely independent of each other:

生物识别和密码学不是一回事。它们实际上是彼此完全独立的：

Cryptography is about hiding information from an adversary and validating the authenticity of that information. In cryptography, an adversary cannot read encrypted data without the secret key. Also, most cryptographic techniques have anti-tamper mechanisms.
密码学是关于从对手隐藏信息并验证该信息的真实性。在密码术中，没有密钥，对手无法读取加密的数据。同样，大多数密码技术都具有防篡改机制。
Biometrics, on the other hand, is for verifying personal identity using bodily measurements. In biometrics, a fingerprint, face, or other aspects of who you are can be used for authentication.
另一方面， 生物识别技术用于通过身体测量来验证个人身份。在生物识别技术中，可以使用指纹，面部或其他身份信息进行身份验证。

There are many systems on Android that work together to secure data. Since Android 4.4, the contents of the user’s data partition are encrypted by default. Generally Jetpack Security is a sufficiently developer-friendly option which does the heavy lifting of handling key generation in the AndroidKeyStore and provides abstractions for encrypting Files and SharedPreferences.

Android上有许多可共同保护数据安全的系统。从Android 4.4开始，默认情况下会加密用户数据分区的内容。通常， Jetpack Security是一个对开发人员来说足够友好的选项，它极大地减轻了AndroidKeyStore中密钥生成的负担，并提供了用于加密文件和SharedPreferences的抽象。

Even though cryptography doesn’t depend on biometrics, there are cases where it makes sense to use biometrics to protect your encryption key to provide an extra layer of security. These use cases include: enterprise, government, financial, and healthcare. This post explores several places where the Biometric Library’s CryptoObject comes in handy for these use cases. Android’s biometric APIs support the following cryptographic operations — Cipher, MAC, and Signature. In this post, we’ll focus on Cipher.

即使加密不依赖于生物识别，在某些情况下，使用生物识别来保护您的加密密钥以提供额外的安全性也是有意义的。这些用例包括：企业，政府，金融和医疗保健。这篇文章探讨了生物识别 库的CryptoObject在这些用例中非常有用的几个地方。 Android的生物识别API支持以下加密操作-密码，MAC和签名。在本文中，我们将重点介绍Cipher。

To understand how the two systems come together, let’s first dive a bit into how cryptography works on Android. Then, we will show how biometrics can be used for an added layer of security to make your app more resilient against potential attackers.

为了了解这两个系统是如何结合在一起的，让我们首先深入研究密码学在Android上的工作方式。然后，我们将展示如何将生物识别技术用于附加的安全层，以使您的应用对潜在的攻击者更具弹性。

Android上的密码学和密钥管理 (Cryptography and key management on Android)

At the core of the Java Crypto API is a Cipher, an object that can be used to perform encryption and decryption of data. To apply a cipher, you need a SecretKey object that references the underlying cryptographic secret key. Only someone with this secret key can use the cipher to decrypt your data. On Android, secret keys should be kept in a secure system called the Android Keystore. The purpose of the Android Keystore is to keep the key material outside of the Android operating system entirely, and in a secure location sometimes referred to as the Trusted Execution Environment (TEE) or the Strongbox. Wherever the key material exists, there’s a potential for an attacker to gain access to it. Therefore the Android Keystore keeps the key material as closely restricted as possible and ensures that the app, the Android userspace, and even the Linux kernel have no access to the material.

Java Crypto API的核心是Cipher ，该对象可用于执行数据的加密和解密。要应用密码，您需要一个引用基础加密密钥的SecretKey对象。只有拥有此密钥的人才能使用密码解密您的数据。在Android上，秘密密钥应保存在称为Android Keystore的安全系统中。 Android密钥库的目的是将密钥资料完全保留在Android操作系统之外，并保存在有时称为“ 可信执行环境 (TEE)”或“ 保险箱”的安全位置。无论关键材料存在于何处，攻击者都有可能获取它。因此， Android密钥库会尽可能严格地限制密钥资料，并确保应用程序，Android用户空间甚至Linux内核都无法访问该资料。

Say you wish to encrypt your app’s data on Android. When your app asks the Android KeyStore to create a secret key, the Keystore never actually gives your app the value of the SecretKey. That’s because the SecretKey is never allowed to leave the secure area. The actual process goes like this:

假设您希望在Android上加密应用程序的数据。当您的应用程序要求Android KeyStore创建密钥时，密钥库实际上不会为您的应用程序提供SecretKey的值。这是因为绝不允许SecretKey离开安全区域。实际过程如下：

Your app asks the Android KeyStore for a SecretKey
您的应用要求Android KeyStore提供SecretKey
The Android Keystore creates the secret key in the secure location (Strongbox or TEE).
Android密钥库在安全位置(保险箱或TEE)中创建密钥。
The Keystore returns an alias to your app. Only the Keystore knows how to map this alias to your newly-created SecretKey.
密钥库将别名返回到您的应用程序。只有密钥库知道如何将此别名映射到您新创建的SecretKey 。
When your app wants to perform encryption, it asks the Keystore system to do it.
当您的应用程序想要执行加密时，它会要求Keystore系统进行加密。
The Keystore system takes in the plaintext and the alias, and it returns encrypted data, called ciphertext. (Note that Cipher is just one example. Other artifacts include Signature, Mac, and IdentityCredential.)
密钥库系统采用纯文本和别名，并返回称为密文的加密数据。 (请注意， Cipher只是一个示例。其他工件包括Signature ， Mac和IdentityCredential 。)
When your app wants to perform decryption, the Keystore system takes in the ciphertext and the alias and returns decrypted data, or plaintext.
当您的应用程序想要执行解密时，Keystore系统将接收密文和别名，并返回解密后的数据或纯文本。