iOS のセキュリティ: iOS 10

Transcription

1 ios ios

2 4 5 Secure Enclave Touch ID 10 Safari 19 App App App App HomeKit SiriKit HealthKit ReplayKit Apple Watch 30 TLS VPN Wi-Fi Bluetooth AirDrop 34 Apple Pay Apple Pay Apple Pay Secure Element Apple Pay NFC Apple Pay 2

3 Apple Pay App Apple Pay Web 41 Apple ID imessage FaceTime icloud icloud Siri Continuity Safari Spotlight # News News 55 ios MDM ipad Apple School Manager Apple Configurator Apple

4 ソフトウェア データ保護クラス App のサンドボックスユーザパーティション ( 暗号化 ) OS パーティションファイルシステム Apple ios ios ios ios ios ios ios IT Touch ID ハードウェアおよび ファームウェア Secure Enclave カーネル 暗号化エンジン Secure Element ios ios iphone ipad ipod touch ios デバイス鍵 グループ鍵 Apple ルート証明書 App App Apple Pay Apple Apple ios ios 4

5 DFU DFU Apple DFU USB 8 DFU Apple ios Secure Enclave ios ios ios App Apple ios Boot ROM Boot ROM Apple CA iboot iboot Apple Apple iboot ios S1 A9 A 1 Boot ROM Low-Level Bootloader LLB iboot 1 itunes Boot ROM LLB DFU USB itunes support.apple.com/ja-jp/ht1808 Secure Enclave Secure Enclave Apple Secure Enclave 5

6 Apple ios itunes Apple ios ios Secure Enclave Secure Enclave Secure Enclave ios itunes OTA Over The Air itunes ios OTA ios macos Server ios Apple ios itunes OTA Apple iboot OS cryptographic measurements ID ECID ECID ECID Apple Apple ECID ios 6

7 Secure Enclave Secure Enclave Apple S2 Apple A7 A Secure Enclave Secure Enclave Secure Enclave Apple L4 Secure Enclave A9 A UID ID UID Apple UID Secure Enclave Apple A7 Secure Enclave Secure Enclave UID Secure Enclave Touch ID Touch ID Secure Enclave Secure Enclave Touch ID Secure Enclave AES Touch ID Secure Enclave AES-CCM Touch ID Touch ID Touch ID 7

8 Touch ID Touch ID Touch ID Touch ID Touch ID 4 5 Touch ID Touch ID Touch ID Touch ID Touch ID 50,000 1 Touch ID 5 Touch ID Touch ID Apple Apple Pay Apple Pay App API Touch ID App Touch ID Touch ID Secure Enclave App API Touch ID ios 9 Touch ID API App Touch ID 2 Secure Enclave ECC Touch ID Secure Enclave Secure Enclave App SecKey SecKey Secure Enclave Secure Enclave Touch ID itunes Store App Store ibooks Store Apple ID Store Secure Enclave itunes Store Secure Enclave ios 10 Store Touch ID Secure Enclave ECC 8

9 Touch ID Touch ID Secure Enclave Secure Enclave Secure Enclave Apple icloud itunes Touch ID ios Touch ID Secure Enclave Complete Touch ID Secure Enclave Touch ID Touch ID Touch ID Touch ID 48 Touch ID 5 Secure Enclave 9

10 Effaceable Storage App ios IT ios DMA AES 256 A9 A DMA ID UID ID GID Secure Enclave UID GID AES 256 AES UID GID Secure Enclave UID GID Secure Enclave AES UID Apple Apple GID Apple A8 AES UID GID JTAG UID UID UID UID GID CTR_DRBG RNG Secure Enclave CTR_DRBG ios Effaceable Storage NAND 10

11 Apple ios App ios 7 App ios 256 Per File AES AES AES CBC A8 AES-XTS IV Per File SHA-1 Per File RFC 3394 NIST AES Per File Per File Per File AES AES Secure Enclave Secure Enclave AES Secure Enclave ios Effaceable Storage Exchange ActiveSync icloud ハードウェア鍵 ファイルシステム鍵 パスコード鍵 クラス鍵 ファイルのメタデータ ファイル鍵 ファイルの内容 11

12 Per File Per File UID Per File ios 6 4 UID Touch ID Touch ID 1 ios Touch ID 10 MDM Exchange ActiveSync Secure Enclave Secure Enclave ios App Complete Protection NSFileProtectionComplete UID 10 Touch ID 12

13 Protected Unless Open NSFileProtectionCompleteUnlessOpen Curve25519 ECDH Per File NIST SP A Diffie-Hellman Per File NIST SP A Concatenation Key Derivation Function Approved Alternative 1 AlgorithmID PartyUInfo PartyVInfo SHA-256 Per File Protected Unless Open Per File Per File Protected Until First User Authentication NSFileProtectionCompleteUntilFirstUserAuthentication Complete Protection App No Protection NSFileProtectionNone UID Effaceable Storage ios Class A Complete Protection NSFileProtectionComplete Class B Protected Unless Open NSFileProtectionCompleteUnlessOpen Class C Protected Until First User Authentication NSFileProtectionCompleteUntilFirstUserAuthentication Class D No Protection NSFileProtectionNone App ios SQLite 1 securityd App API App Keychain-access-groups applicationidentifier application-group 1 App App Apple Developer Program App Apple Developer Program 13

14 SHA-1 ACL Per Item plist Per Item SecItemAdd AES 128 GCM Galois/Counter Mode GMAC API NSFileProtectionComplete ksecattraccessiblewhenunlocked NSFileProtectionCompleteUnlessOpen NSFileProtectionCompleteUntilFirstUserAuthentication ksecattraccessibleafterfirstunlock NSFileProtectionNone ksecattraccessiblealways ksecattraccessible WhenPasscodeSetThisDeviceOnly App ksecattraccessibleafterfirstunlock ksecattraccessiblewhenpasscodesetthisdeviceonly ksecattraccessiblewhenunlocked icloud UID Apple ios VPN ios Wi-Fi Exchange VPN LDAP CalDAV CardDAV Handoff icloud iphone itunes Safari Safari VPN Bluetooth Apple Push Notification service icloud 14

15 imessage SIM PIN ACL Touch ID Touch ID ACL Secure Enclave Safari ios App Safari 2 API SecRequestSharedWebCredential SecAddSharedWebCredential App Web App App Safari Web Web App App com.apple.developer. associated-domains App ios Web TLS /apple-app-site-association App App Web App 2 API App ios icloud NSFileProtectionComplete No Protection plist Effaceable Storage AppleKeyStore AppleKeyStore 15

16 ios ios Per File ios itunes UID itunes PBKDF itunes UID itunes MDM itunes MDM itunes MDM itunes Protected Until First User Authentication itunes OTA Secure Enclave UUID Secure Enclave UID Secure Enclave 20 Secure Enclave Effaceable Storage 20 16

17 Secure Enclave 8 icloud Protected Unless Open Curve25519 icloud No Protection icloud icloud itunes UID icloud ios support.apple.com/ja-jp/ht ISO Apple Apple School Manager icloud imessage FaceTime Apple ID itunes U ISO v1.0 Apple ISO IS FIPS ios ios 6 FIPS ios 10 ios 9 ios 8 Apple ios Apple App ios Apple App App ISO Apple ios CCC 3 Mobile Device Fundamental Protection Profile v2.0 MDFPP2 VID10695 ios 9 VPN IPSecPP1.4 Client Protection Profile VPNIPSecPP1.4 VID10714 Extended Package for Mobile Device Management Agents v2.0 MDMAgentEP2 VID10725 Apple ios 10 ios Apple International Technical Community ITC cpp Apple PP Commercial Solutions for Classified CSfC Apple Commercial Solutions for Classified CSfC ios ios 9 IPSec VPN IKEv2 IKEv2 VPN MDM Agent MDMAgentEP2 Apple CSfC 17

18 Apple ios 18

19 App App 1 App ios App App App ios ios App App ios App App ios Apple Safari App Apple App Apple OS App App App ios Apple Apple Developer Program Apple App App App Store App Store App App App Apple App ios App App App App Apple Team ID 10 1A2B3C4D5F 19

20 App D-U-N-S Apple Developer Enterprise Program ADEP Apple ADEP App App App ios MDM App App App App App App Apple ios App Web App App App ios App App App App App App ios App ios App mobile OS App API App ios App icloud App UNIX ID App App API App ASLR App ASLR return-to-libc ios Xcode ASLR 20

21 ios ARM Execute Never XN App Apple 1 mmap Safari JavaScript JIT ios App App App App App API App App App App App App App App App App API Open Access Managed Open In MDM App App App App 21

22 App App App Apple Developer Portal App App App App 1 Apple Developer Portal App App ID App ios Software Development Kit SDK App API NSFileManager CoreData NSData SQLite API API App Safari App Protected Until First User Authentication App App Protected Until First User Authentication Made for iphone/ipod touch/ipad MFi ipod Accessories Protocol iap MFi Lightning Bluetooth ios Apple Apple Apple Lightning Bluetooth IC UART AirPlay Apple IC AirPlay CarPlay MFi-SAP Secure Association Protocol AES-128 CTR Station-to-Station STS ECDH Curve25519 IC 1024 RSA 22

23 HomeKit HomeKit icloud ios Apple HomeKit HomeKit Ed25519 Ed25519 HomeKit ios HomeKit ios ios icloud HomeKit HomeKit ios Ed25519 ios HomeKit Secure Remote Password ios HKDF-SHA-512 ChaCha20-Poly1305 AEAD MFi ios HomeKit Station-to-Station Curve25519 HKDF-SHA-512 IP Bluetooth Low Energy HomeKit ios HomeKit HomeKit Protected Until First User Authentication HomeKit itunes HomeKit HomeKit icloud icloud 1 ios HomeKit HomeKit BLOB BLOB icloud HomeKit ios icloud HomeKit ios HomeKit Ed25519 Station-to-Station 23

24 HomeKit icloud Apple TV HomeKit icloud 2 Apple TV Ed25519 icloud Apple TV Station-to-Station ios HomeKit Apple TV Ed25519 Apple TV HomeKit Apple TV HomeKit ios HomeKit icloud App App App ios App developer.apple.com/homekit HomeKit HomeKit Siri Siri Siri Siri Siri HomeKit Apple Siri HomeKit icloud HomeKit Bluetooth Wi-Fi icloud ios icloud Apple HomeKit icloud icloud ios Apple icloud icloud icloud icloud ios Built for HomeKit Apple prime256v1 X.509 ios icloud 24

25 HomeKit icloud ios icloud URL icloud icloud icloud icloud HomeKit icloud icloud icloud HTTP/2 TLS 1.2 AES-128-GCM SHA-256 icloud ios SiriKit Siri ios App Siri ios App App ios Siri App ios Siri PaymentApp 10 App App App ios App ios MessageApp Siri App TCC App App Siri Siri SiriKit App Siri 25

26 HealthKit HealthKit App HealthKit Bluetooth LE ios HealthKit Complete Protection Touch ID HealthKit App HealthKit App Protected Until First User Authentication Protected Unless Open icloud itunes itunes App IETF RFC 5652 CMS App HealthKit API App App App App App ios App App App App App App App App 26

27 ID App ID ID No Protection ID ReplayKit ReplayKit App ReplayKit App 1 App 8 App ReplayKit replayd App ReplayKit App ReplayKit UI UI ios replayd ReplayKit com.apple.broadcast-services 2 UI App ReplayKit ReplayKit App UIActivityViewController UIRemoteViewController SPI ReplayKit App 27

28 2 MP4 MP4 MP4 replayd ReplayKit replayd NSExtension SPI XPC replayd XPC IOSurface XPC XPC IOSurface App ios macos icloud Web 16 PBKDF2 SHA256 AES-GCM Core Data CloudKit Web Touch ID 3 Touch ID 3 icloud CloudKit 28

29 Apple Watch Apple Watch ios iphone UID Apple Watch iphone OOB BTLE Apple Watch iphone BTLE 4.1 BTLE BTLE Apple Watch iphone imessage IDS Bluetooth Apple Watch iphone IDS BTLE Wi-Fi 15 App FaceTime iphone IDS Apple Watch Apple Watch iphone Apple Watch Bluetooth Wi-Fi Apple Watch iphone Apple Watch Wi-Fi Apple Watch iphone iphone Apple Watch Apple Watch Apple Watch Apple Pay Apple Pay iphone Apple Watch App Apple Watch iphone Apple Watch iphone Apple Watch Apple Watch iphone iphone Apple Watch App Apple Watch iphone 1 iphone Apple Watch iphone iphone Apple Watch Apple Watch Apple Watch Apple Watch Apple ID 29

30 ios ios ios ios Wi-Fi ios Telnet Web ios TLS ios Transport Layer Security TLS v1.0 TLS v1.1 TLS v1.2 AES 128 SHA-2 DTLS Safari App API CFNetwork App TLS API SecureTransport CFNetwork SSLv3 Safari WebKit App SSLv3 ios 10 macos Sierra RC4 SecureTransport API TLS RC4 RC4 RC4 App App Transport Security App Transport Security CFURL NSURLSession API App App Transport Security Forward Secrecy GCM CBC ECDHE_ECDSA_AES ECDHE_RSA_AES App Forward Secrecy RSA_AES TLS 1.2 Forward Secrecy 2048 RSA 256 SHA-256 App App Transport Security App Transport Security ios 9 App 30

31 VPN ios ios VPN IKEv2/IPSec RSA ECDSA EAP-MSCHAPv2 EAP-TLS SSL-VPN App Store App Cisco IPSec RSA SecurID CRYPTOCard L2TP/IPSec MS-CHAPV2 RSA SecurID CRYPTOCard PPTP ios 9.3 ios VPN IT VPN ios Per App VPN VPN MDM App Safari ios VPN MDM Apple Configurator Device Enrollment Program Wi-Fi VPN VPN IP IKEv2 Wi-Fi ios WPA2 Wi-Fi WPA2 128 AES Wi-Fi ios 802.1X RADIUS iphone ipad 802.1X EAP-TLS EAP-TTLS EAP-FAST EAP-SIM PEAPv0 PEAPv1 LEAP ios w PMF WPA2 PMF iphone 6s ipad Air 2 ios Wi-Fi Wi-Fi Media Access Control MAC Wi-Fi App App Wi-Fi Wi-Fi 31

32 Wi-Fi ios Preferred Network Offload epno MAC epno App Wi-Fi MAC Wi-Fi MAC Apple ios Wi-Fi MAC Apple MAC Wi-Fi Wi-Fi MAC iphone 4s iphone 6S Wi-Fi Wi-Fi SSID Service Set Identifier ios SSID Bluetooth ios Bluetooth ios Encryption Mode 3 Security Mode 4 Service Level 1 ios Bluetooth Hands-Free Profile HFP 1.5 Phone Book Access Profile PBAP Advanced Audio Distribution Profile A2DP Audio/Video Remote Control Profile AVRCP Personal Area Network Profile PAN Human Interface Device Profile HID support.apple.com/ja-jp/ht ios SSO SSO Kerberos SSO Safari App PKINIT ios SSO SPNEGO HTTP Negotiate Kerberos Kerberos Windows SSO Heimdal AES128-CTS-HMAC-SHA1-96 AES256-CTS-HMAC-SHA1-96 DES3-CBC-SHA1 ARCFOUR-HMAC-MD5 32

33 Safari SSO ios API App SSO SSO ios MDM Active Directory Kerberos SSO App Safari Web URL AirDrop AirDrop ios Bluetooth Low Energy BLE Apple Wi-Fi OS X AirDrop Mac Wi-Fi Wi-Fi AirDrop 2048 RSA Apple ID AirDrop AirDrop Bluetooth Low Energy AirDrop AirDrop AirDrop AirDrop Wi-Fi Bonjour AirDrop AirDrop AirDrop TLS icloud AirDrop App AirDrop 33

34 Apple Pay ios Apple Watch Apple Pay App Safari Web Apple Pay Apple Pay Apple Pay Secure Element Secure Element Java Card NFC NFC Secure Element Secure Element POS Wallet Wallet Apple Pay Wallet Apple Pay Secure Enclave iphone ipad Apple Watch Series 1 Series 2 Secure Enclave Secure Enclave Touch ID Apple Watch Secure Element Secure Enclave Apple Pay Server Apple Pay Server Wallet Secure Element Apple Pay Server Apple Pay Server App Apple Pay Secure Element Secure Element Apple Pay Secure Element Secure Element NFC Secure Element 34

35 Apple Pay NFC NFC Secure Element POS NFC Touch ID Apple Watch Secure Element NFC NFC App Web Apple Pay Server Secure Element Apple Pay Apple Apple Pay Apple Pay 3 Required Fields Check Card Link and Provision Apple Pay SSL Apple Secure Element Apple Web Secure Element ios watchos Apple icloud Apple Watch iphone Apple Watch App Apple Watch Apple Watch Bluetooth Apple Watch Apple Watch Secure Element Apple Pay 3 Apple Pay itunes Store Apple Pay App Apple Pay CVV Wallet App Apple Watch App isight 35

36 Check Card CVV Apple Pay Server Check Card ID Apple Apple ID CVV Link and Provision Link and Provision Apple itunes App Store itunes Apple Pay ios Apple Pay Link and Provision 2 Wallet Secure Element App URL Secure Element Apple Pay itunes Store Apple Pay itunes Apple ID itunes Check Card Apple Pay ID Link and Provision itunes App App Apple Pay App ios CVV App Wallet Apple Watch App App 36

37 Secure Enclave Secure Element Secure Enclave iphone ipad Touch ID Touch ID Touch ID 3 5 Touch ID Apple Pay Apple Watch Secure Enclave Secure Element Secure Element NFC Secure Enclave Secure Element AES Secure Enclave UID Secure Element Secure Enclave Secure Enclave HSM HSM Secure Element App Authorization Random AR Secure Enclave Secure Element AR Secure Enclave Apple Pay Secure Enclave AR Secure Element Secure Element AR Secure Element AR Secure Element AR ios Secure Enclave icloud Apple Watch Apple Watch Apple Watch iphone Secure Element AR Secure Enclave App 37

38 1 NFC App Apple Pay iphone NFC Wallet App Touch ID Apple Watch Apple Apple Apple Pay Apple Apple Pay App Apple Pay ios App watchos 3 Apple Watch App Apple Pay App Apple Apple Pay App Apple Pay Apple Pay Server Apple Pay Server App App API Apple Pay App App Apple Pay ios Apple Pay App App App Touch ID Apple Pay 38

39 Apple Pay Server NFC Apple Secure Element Secure Element Apple Pay Server Secure Element ID API App App Apple API ID App Secure Element App App PKPaymentRequest applicationdata applicationdata Apple Pay Web Apple Pay Web ios 10 iphone ipad Web Apple Pay macos Sierra Apple Pay Mac icloud Apple Pay iphone Apple Watch Web Apple Pay Web Apple Apple TLS Apple Pay Web HTTPS Web Apple TLS Apple Apple Web Apple Pay macos ios Safari Apple Pay App Mac iphone Apple Watch Apple Pay IDS Mac IDS Apple Apple Pay iphone Apple Watch Apple icloud iphone Touch ID Apple Watch Web iphone Apple Watch Mac Web Bluetooth Low Energy 39

40 ios 9 NFC VAS Apple Pay VAS Apple NFC VAS Apple Pay NFC 1 ECDH P-256 iphone iphone ipad watchos 3 Apple Watch Apple Pay iphone icloud.com Wallet Apple Pay Apple Watch icloud iphone Apple Watch App Apple Watch Wi-Fi Apple Pay Apple Pay iphone ios Secure Element Secure Element Apple Pay Server Secure Enclave AR Secure Element Apple Pay Server 40

41 Apple ID Apple ID icloud FaceTime imessage 8 3 Apple imessage FaceTime Siri Spotlight icloud icloud icloud ios ios Apple ID Apple ID icloud imessage FaceTime itunes Store ibooks Store App Store Apple Apple ID Apple 8 3 Apple 3 Apple Apple ID Apple ID Apple 2 Apple 2 2 Apple ID 1 2 iphone ipad Mac Apple ID Apple ID Apple 41

42 2 Apple ID Apple ios macos tvos watchos Apple Web 2 2 support.apple.com/ja-jp/ht Apple 2 2 Apple ID icloud imessage FaceTime Game Center itunes Store ibooks Store Apple Store 14 Apple ID 2 support.apple.com/ja-jp/ht Apple ID ios 9.3 Apple ID Apple ID FaceTime Apple ID Touch ID Apple Pay icloud HomeKit iphone Apple Apple ID help.apple.com/schoolmanager Apple ID Apple ID IT Apple ID Apple School Manager Apple ID 7 icloud CloudKit Apple School Manager Apple ID Apple ID Apple ID ios icloud Apple ID Apple ID 2 2 Apple ID icloud FaceTime icloud 42

43 imessage Apple imessage ios Mac imessage imessage Apple Push Notification service APNs Apple Apple imessage 2 RSA 1280 NIST P-256 ECDSA 256 Apple IDS IDS APNs imessage APNs Confirmation Link SIM imessage imessage IDS APNs IDS APNs RSA IDS 88 HMAC-SHA AES CTR 40 AES RSA-OAEP SHA-1 ECDSA APNs APNs APNs TLS APNs ios 4 KB 16 KB 256 AES CTR icloud AES URI Uniform Resource Identifier SHA-1 imessage imessage 43

44 ランダムな鍵で暗号化された添付ファイル icloud APNs 署名および暗号化されたユーザ 2 へのメッセージ ( 添付ファイルの URI および鍵を含む ) ユーザ 1 ユーザ 2 ユーザ 2 の公開鍵と APNs トークン ユーザ 1 の公開鍵と APNs トークン IDS APNs icloud APNs APNs imessage 30 FaceTime FaceTime Apple FaceTime imessage Apple Push Notification service APNs FaceTime Apple FaceTime STUN Session Traversal Utilities for NAT ICE Internet Connectivity Establishment APNs STUN Salt AES-256 Secure Real Time Protocol SRTP 44

45 icloud icloud icloud App App Apple ID icloud icloud Drive icloud IT icloud AES-128 SHA-256 Apple icloud Amazon S3 Windows Azure icloud Drive icloud Drive icloud icloud icloud Drive icloud Drive icloud Drive icloud icloud icloud icloud Drive icloud Drive CloudKit App CloudKit icloud CloudKit App CloudKit App CloudKit icloud Drive icloud CloudKit Per File CloudKit CloudKit CloudKit icloud icloud CloudKit サービス鍵 CloudKit ゾーン鍵 CloudKit レコード鍵 ファイルのメタデータ ファイルチャンクリスト ファイルチャンク 収束暗号化 45

46 icloud icloud App App Wi-Fi icloud icloud Wi-Fi ios icloud App icloud ios icloud itunes Store App Store ibooks Store Apple ID ios ios ios 8.1 Mac OS X v icloud icloud icloud App App imessage SMS MMS SIM Visual Voic SIM HomeKit HealthKit Per File icloud icloud No Protection icloud Curve25519 Per File icloud icloud icloud icloud icloud icloud icloud UID Apple 46

47 icloud icloud icloud Per File icloud Safari icloud Safari Web Apple Apple icloud Apple ios Mac icloud icloud 2 Apple icloud icloud icloud icloud 2 icloud P256 icloud Salt icloud icloud icloud icloud icloud icloud icloud icloud icloud icloud icloud 47

48 2 icloud Apple icloud 1 VPN ID ksecattrsynchronizable Apple Safari Wi-Fi HomeKit App ksecattrsynchronizable Apple Apple 1 Safari Web Apple icloud icloud 4 ios icloud icloud HSM icloud 4 icloud SMS 48

49 icloud icloud HSM icloud SMS icloud HSM Secure Remote Password SRP icloud Apple icloud icloud 10 Apple 10 HSM HSM HSM Siri Siri Siri Siri Siri Siri Siri Siri Siri Siri HTTPS Siri Siri 10 49

50 Siri Apple Watch Apple Watch iphone Siri Apple Siri Siri Siri 6 6 Apple Siri 2 Siri 2 Siri Siri Siri Siri Apple Siri Continuity icloud Bluetooth Wi-Fi Continuity Continuity Handoff Handoff Mac ios Handoff Handoff icloud 2 Apple Push Notification service APNs Bluetooth Low Energy 4.0 imessage 256 AES Bluetooth Low Energy GCM AES-256 icloud Bluetooth Low Energy Bluetooth Low Energy 4.0 imessage Bluetooth Low Energy APNs imessage 50

51 App Web Handoff Handoff ios App App Web App Web Web App App Web Web Web Safari App Handoff App Web Handoff Handoff API Web Web Handoff Handoff Handoff App App Handoff App Web URL App Handoff App App URL Handoff App Handoff API Handoff App URL URL App Handoff App Handoff Apple Wi-Fi AirDrop API App Handoff API App 2 Handoff Bluetooth Low Energy Wi-Fi TLS icloud Handoff 1 Handoff App App App icloud App 51

52 Mac Bluetooth Low Energy Wi-Fi Apple Watch Mac icloud Mac Apple Watch 2 TFA Apple Watch Mac ID Mac Apple Watch Apple Watch Apple Wach Mac Bluetooth Low Energy Apple Watch 2 Mac Apple Watch Wi-Fi 2 Mac Mac Apple Watch iphone Mac ipad ipod iphone Wi-Fi iphone icloud FaceTime Apple ID Apple Push Notification service APNs imessage UI 2 iphone Bluetooth Low Energy 4.0 icloud Handoff Apple Push Notification service APNs iphone FaceTime iphone iphone iphone SMS ipad ipod touch Mac Apple ID imessage SMS iphone 6 52

53 iphone imessage SMS iphone iphone SMS Instant Hotspot Instant Hotspot ios Bluetooth Low Energy icloud OS X Yosemite Mac Instant Hotspot ios ios Wi-Fi icloud Bluetooth Low Energy icloud DSID Destination Signaling Identifier icloud Bluetooth Low Energy imessage Bluetooth Low Energy Safari Spotlight # News News Safari Spotlight # News News Wikipedia itunes Store App Store Safari Spotlight # News News HTTPS Apple 15 Apple Apple IP Spotlight Safari 3 App Apple App 3 App 53

54 Apple Apple Spotlight Apple 15 ID Apple 18 2 Microsoft Bing Apple IP HTTPS Apple IP IPv4 8 IPv6 80 App 54

55 ios BYOD MDM ios PIN Touch ID 6 4 MDM Exchange ActiveSync Touch ID developer.apple.com/library/ios/featuredarticles/ iphoneconfigurationprofileref 55

56 ios ios ios ios 9 ios RSA 256 SSL itunes Xcode Wi-Fi USB ios 9 6 support.apple.com/ja-jp/ht6331 com.apple.pcapd USB com.apple.file_relay Apple support.apple.com/ja-jp/ HT5868 ios XML ios Wi-Fi VPN Exchange LDAP CalDAV Web 56

57 CMS RFC DES AES- 128 ios MDM App Apple Configurator Safari MDM MDM ios MDM iphone ipad MDM Apple Push Notification service APNs ios APNs MDM APNs IT MDM ios ipad ipad ipad ipad 1 ipad ipad Apple ID ipad ipad UNIX Apple ID Apple SRP UNIX ID Apple icloud icloud icloud icloud icloud 57

58 Apple School Manager Apple School Manager MDM itunes U Apple School Manager Web IT Device Enrollment Program DEP Apple Apple ios Apple School Manager MDM Web MDM MDM MDM Apple HTTPS SSL MDM MDM App help.apple.com/deployment/business help.apple.com/schoolmanager Apple Configurator 2 MDM macos Apple Configurator 2 Apple Configurator App Apple Configurator 2 Apple School Manager Device Enrollment Program MDM Apple School Manager Device Enrollment Program Apple Configurator MDM Apple Configurator 2 help.apple.com/deployment/ios 58

59 App App FaceTime App Store Siri itunes Store icloud AirPlay Spotlight Spotlight Spotlight Handoff AirDrop Safari Safari Web JavaScript Safari Cookie icloud icloud icloud Apple TLS Touch ID Apple Watch App AirDrop App icloud imessage App HTTP AirPlay AirDrop 59

60 App App itunes App VPN Apple Watch App Apple Music Radio App App Store App App News App Apple Watch MDM developer.apple.com/library/ios/featuredarticles/iphoneconfigurationprofileref ios Effaceable Storage MDM Exchange icloud MDM icloud Exchange Exchange Server App ios 9.3 MDM 60

61 iphone Apple ID Apple ID MDM MDM iphone MDM MDM iphone MDM iphone iphone Apple School Manager Apple ID Apple ID Apple ID 61

62 Apple ios App GPS Bluetooth Wi-Fi 1 App App App App App App Apple ios Siri Spotlight ios App App Twitter Facebook HomeKit Bluetooth icloud App icloud Drive icloud App ios MDM App App Apple 62

63 Apple Apple Apple Apple PoC ios Apple Apple $200,000 Secure Enclave $100,000 $50,000 Apple icloud $50,000 $25,000 63

64 Apple ios App ios ios Apple ios ios App Apple ios App Safari OCSP EV S/MIME S/MIME S/MIME imessage FaceTime App App Store ios App ios IT Apple Apple Apple Apple Forum of Incident Response and Security Teams FIRST Apple 64

65 ASLR Apple Push Notification service APNs Boot ROM DFU ECID Effaceable Storage ID GID HSM iboot Identity Service IDS IC Joint Test Action Group JTAG ios ios 5 App App ios Apple Apple ios App API Boot ROM USB DFU itunes itunes ipad itunes ipad ios 64 Bluetooth Low Energy 4.0 icloud Handoff NAND Effaceable Storage Effaceable Storage UID LLB XNU imessage APNs Apple icloud ios 5 3 icloud UUID HMAC UID PBKDF2 Salt UUID UID UID Low-Level Bootloader LLB ios App API 1 ios RFC 3394 NIST AES Boot ROM iboot 65

66 Per File System on a chip SoC Uniform Resource Identifier URI ID UID XNU AES 256 Per File App ios Apple App App ID 1 Secure Enclave Apple A7 SoC UID PBKDF2 UID AES PRF Web AES 256 AES UID UDID ios macos ASLR 66

67 ios 10 HomeKit ReplayKit SiriKit Apple Watch Wi-Fi VPN Apple Pay Apple Pay Web Safari ios 9.3 ios 10 Web support.apple.com/ja-jp/ht Apple ID Apple ID 2 Apple School Manager ipad ios 9 ios 9.3 Web support.apple.com/ja-jp/ht Apple Watch Touch ID API A8 AES-XTS App Safari App Transport Security VPN HomeKit icloud Apple Pay Apple Pay App Spotlight ios Apple Configurator 2 ios 9 Web support.apple.com/ja-jp/ht

68 2017 Apple Inc. All rights reserved. Apple Apple AirDrop AirPlay Apple Music Apple Pay Apple TV Apple Watch Bonjour CarPlay FaceTime Handoff ibooks imessage ipad ipod ipod touch isight itunes itunes U Keychain Lightning Mac OS X Safari Siri Spotlight Touch ID watchos Xcode Apple Inc. iphone HomeKit macos tvos Apple Inc. App Store icloud icloud Drive icloud Keychain itunes Store Apple Inc. ibooks Store Apple Inc. IOS Cisco Bluetooth Bluetooth SIG, Inc. Apple Java Oracle