Security

Data Protection overview

In iOS and iPadOS, Apple uses a technology called Data Protection to protect data stored in flash storage on the device. Data Protection allows the device to respond to common events, such as incoming phone calls, but also enables a high level of encryption for user data. Key system apps, such as Messages, Mail, Calendar, Contacts, Photos and Health data values use Data Protection by default, and third-party apps installed on iOS 7 or later and iPadOS 13.1 receive this protection automatically.

Implementation

Data Protection is implemented by constructing and managing a hierarchy of keys, and builds on the hardware encryption technologies built into each iOS and iPadOS device. Data Protection is controlled on a per-file basis by assigning each file to a class; accessibility is determined according to whether the class keys have been unlocked. With the advent of the Apple File System (APFS), the file system is now able to further subdivide the keys into a per-extent basis (where portions of a file can have different keys).

Architecture

In iOS and iPadOS, storage is divided into two APFS volumes:

System volume: System content is stored on the System volume and user data is stored on the Data volume.
Data volume: Every time a file on the data volume is created, Data Protection creates a new 256-bit key (the per-file key) and gives it to the hardware AES engine, which uses the key to encrypt the file as it is written to flash storage. The encryption uses AES128 in XTS mode where the 256-bit per-file key is split to provide a 128-bit tweak and a 128-bit cipher key.

Helpful?

Apple Platform Security

Data Protection overview

Implementation

Architecture