備份的安全性建議
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
OWASP 類別：MASVS-CODE：程式碼品質
總覽
應用程式備份功能旨在保留使用者資料，以便日後還原至新裝置，或在資料遺失時使用。有關應用程式備份的現有安全性建議，安全性建議因 Android 版本和裝置製造商而異。這些建議的共同主題，就是確保不會有任何機密資料外洩。
標準 Android 備份系統提供最安全、最可靠且最簡單的解決方案，可讓應用程式將資料備份到雲端，或透過自動備份 (預設為啟用，無需任何實作工作，且可擴充) 和鍵/值備份，將資料轉移到新裝置。我們建議使用這個解決方案，因為它會將產生的備份資料儲存在其他第三方應用程式無法存取的目錄中，並且可協助進行靜態資料加密、傳輸中加密，以及設定可從備份中排除機密資料。
假使應用程式實作的備份解決方案不依附標準 Android 備份系統，可能會提高導致機密資料外洩的可能性。非標準備份解決方案會暴露使用者資料外洩的情形，包括提供「匯出」或「備份」功能的應用程式，在可由其他應用程式讀取的目錄中建立應用程式資料副本，因而容易外洩 (無論是直接或透過其他安全漏洞)。
影響
設定應用程式備份時，請遵循安全性建議，避免備份可能包含的機密資料外洩。視實際資料和攻擊者的意圖而定，機密資料外洩可能會導致資訊外洩、使用者冒用和財務損失。
因應措施
使用標準 Android 備份系統
標準 Android 備份系統一律會加密傳輸中的備份資料和靜態資料。無論您使用的 Android 版本，以及裝置是否設有螢幕鎖定，系統都會套用這項加密機制。自 Android 9 起，如果裝置已設定螢幕鎖定功能，備份資料不僅會加密，而且會使用 Google 無法得知的金鑰加密 (螢幕鎖定密碼會保護加密金鑰，因此可啟用端對端加密)。
一般而言，請務必遵守資料儲存空間和安全性指南。
如果備份檔案包含特別機密的資料，建議您排除這類資料，如果無法排除，請按照下文所述要求端對端加密。
從備份中排除資料
您可以使用名為 backup_rules.xml 的規則檔案，指定要從備份中排除哪些資料，並存放在 res/xml 應用程式資料夾中。備份規則的設定方式會因使用的 Android 版本而有所不同：
- 針對 Android 12 (API 級別 31) 以上版本，請在
AndroidManifest.xml 中的 <application> 元素中加入 android:dataExtractionRules 屬性：
- xml
xml
<application android:name="com.example.foo" android:dataExtractionRules="@xml/backup_rules_extraction">
…
</application>
接著，按照更新後的設定格式，根據應用程式的資料持久性和安全性需求設定 backup_rules.xml 檔案。
backup_rules.xml 檔案設定檔所需的格式可讓開發人員為 Cloud 和裝置對裝置 (D2D) 轉移定義自訂備份規則。如果未設定 <device-transfer> 屬性，系統會在 D2D 遷移期間轉移所有應用程式資料。請特別注意，即使目標應用程式指定 Android 12 以上版本，仍必須為搭載 Android 11 (API 級別 30) 以下版本的裝置指定含有另一組備份規則的個別檔案。
- 適用於 Android 11 以下版本：請在
AndroidManifest.xml 中的 <application> 元素中新增 android:fullBackupContent 屬性：
- xml
xml
<application android:name="com.example.foo" android:fullBackupContent="@xml/backup_rules_full">
…
</application>
接著，使用備份使用者資料文章中回報的語法，根據應用程式的資料持續性和安全性要求設定 backup_rules.xml 檔案。
必須要求端對端加密
如果您無法從備份中排除敏感資料，建議您要求端對端加密，也就是只在 Android 9 以上版本中允許備份，且必須設定鎖定畫面。您可以使用 requireFlags="clientSideEncryption" 標記達成此目的，但需要將其重新命名為 disableIfNoEncryptionCapabilities，並從 Android 12 開始將其設為 true。
如果您無法使用標準 Android 備份系統
如果您無法使用標準 Android 備份系統，則安全儲存備份資料，以及指定要從備份中排除哪些資料，會變得更加複雜。這項資訊必須在程式碼層級指定，因此容易發生錯誤，導致資料外洩。在這種情況下，建議您定期測試實作方式，確保預期的備份行為不會受到影響。
資源
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2025-07-26 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-26 (世界標準時間)。"],[],[],null,["# Security recommendations for backups\n\n\u003cbr /\u003e\n\n**OWASP category:** [MASVS-CODE: Code Quality](https://mas.owasp.org/MASVS/10-MASVS-CODE)\n\nOverview\n--------\n\nApp backups aim to preserve users' data so that it can later be restored to a\nnew device or in case of data loss. Existing security recommendations regarding\napp backups are nuanced, varying between Android versions and device\nmanufacturers. The common theme is that these recommendations aim at ensuring\nthat no sensitive data is leaked.\n\nThe Standard Android Backup system provides the most secure, robust, and easiest\nsolution for apps to back up their data to the cloud or to transfer data to a\nnew device through [Auto Backup](/identity/data/autobackup)(which is [enabled by default](/identity/data/backup), requires\nno work to implement and can also be extended) and [key-value backup](/guide/topics/data/keyvaluebackup). We\nrecommend using this solution because it stores the resulting backup data in\ndirectories that cannot be accessed by other 3p apps, as well as facilitating\nencryption at rest, encryption in transit, and configurations allowing for the\nexclusion of sensitive data from backups.\n\nIf instead an app implements a backup solution that is not reliant on the\nStandard Android Backup system, this could increase the likelihood of mistakes\nleading to leaks of sensitive data. Examples of non-standard backup solutions\nexposing user data to leaks include apps offering an \"export\" or \"backup\"\ncapability that creates a copy of the app data in directories readable by other\napps, and which is hence prone to being leaked (either directly or through other\nvulnerabilities).\n\nImpact\n------\n\nFollowing security recommendations when setting up app backups prevents the\npotential leak of sensitive data that backups might include. Depending on the\nactual data and on the attacker's intentions, sensitive data leak may lead to\ninformation disclosure, user impersonation, and financial loss.\n\nMitigations\n-----------\n\n### Use the Standard Android Backup system\n\nThe Standard Android Backup system always encrypts backup data in transit and at\nrest. This encryption is applied regardless of the Android version in use and of\nwhether your device has a lock screen. Starting from Android 9, if the device\nhas a lock screen set, then the backup data is not only encrypted, but encrypted\nwith a key not known to Google (the lock screen secret protects the encryption\nkey, thus enabling end-to-end encryption).\n\nIn general remember to follow the [data storage](/training/data-storage) and [security\nguidelines](/privacy-and-security/risks/sensitive-data-external-storage).\n\nIf your backup includes particularly sensitive data, then we recommend to either\nexclude this data or, if you cannot exclude it, require end-to-end encryption as\ndescribed in the following section.\n\n#### Excluding data from backup\n\nYou can specify which data to exclude from a backup using a rules file,\nconventionally called `backup_rules.xml`and placed in the `res/xml` app folder.\nThere are some differences in how backup rules are configured depending on the\nversion of Android that's used:\n\n- [For Android versions 12 (API level 31) and higher](/guide/topics/data/autobackup#include-exclude-android-12), add an `android:dataExtractionRules` attribute to the `\u003capplication\u003e` element within the `AndroidManifest.xml`:\n- xml `xml\n \u003capplication android:name=\"com.example.foo\" android:dataExtractionRules=\"@xml/backup_rules_extraction\"\u003e\n ...\n \u003c/application\u003e`\n\nThen, [configure](/guide/topics/data/autobackup#include-exclude-android-12) the `backup_rules.xml` file according to the\ndata persistence and security requirements of the application, following the\n[updated configuration format](/guide/topics/data/autobackup#xml-syntax-android-12).\n\nThe format required for the `backup_rules.xml` file configuration allows\ndevelopers to define custom backup rules for both Cloud and [Device-To-Device\n(D2D) transfers](/about/versions/12/behavior-changes-12#xml-changes). If the `\u003cdevice-transfer\u003e`attribute is not set, all the\napplication data will be transferred during a D2D migration. It is important to\nhighlight that even if the target application targets Android 12 or higher, a\nseparate file with [an additional set of backup rules](/identity/data/autobackup#include-exclude-android-11) should always be\nspecified for devices running Android 11 (API level 30) or lower.\n\n- [For Android versions 11 and lower](/guide/topics/data/autobackup#include-exclude-android-11), add an `android:fullBackupContent` attribute to the `\u003capplication\u003e` element within the `AndroidManifest.xml`:\n- xml `xml\n \u003capplication android:name=\"com.example.foo\" android:fullBackupContent=\"@xml/backup_rules_full\"\u003e\n ...\n \u003c/application\u003e`\n\nThen, configure the `backup_rules.xml` file according to the data persistence\nand security requirements of the application using the syntax reported in the\n[back up user data](/guide/topics/data/autobackup#include-exclude-android-11) article.\n\n#### Requiring end-to-end encryption\n\nIf you can't exclude sensitive data from your backup, then we recommend\nrequiring end-to-end encryption which means allowing backups only on Android 9\nor higher and only when the lock screen is set. You can achieve this by using\nthe `requireFlags=\"clientSideEncryption\"`flag, which needs to be renamed to\n`disableIfNoEncryptionCapabilities` and set to `true` starting from [Android\n12](/identity/data/autobackup#include-exclude-android-12).\n\n### If you can't use the Standard Android Backup system\n\nIf you can't use the Standard Android Backup system, then securely storing your\nbackup data as well as specifying which data to exclude from your backup is more\ncomplex. This needs to be specified at code level and is consequently\nerror-prone, risking data leaks. In this scenario, it is also recommended to\nregularly test your implementation to ensure that there has been no alteration\nto the expected backup behavior.\n\nResources\n---------\n\n- [Description of the allowBackup attribute](/guide/topics/manifest/application-element#allowbackup)\n- [File-Based Encryption](https://source.android.com/docs/security/features/encryption/file-based)\n- [D2D transfer behavior changes](/about/versions/12/behavior-changes-12#functionality-changes)\n- [Back up user data with Auto Backup](/identity/data/autobackup)\n- [Back up key-value pairs with Android Backup Service](/identity/data/keyvaluebackup)\n- [Control backup on Android 12 or higher](/guide/topics/data/autobackup#include-exclude-android-12)\n- [Control backup on Android 11 and lower](/guide/topics/data/autobackup#include-exclude-android-11)\n- [Understanding PII in Google's contracts and policies](https://support.google.com/analytics/answer/7686480)\n- [Test backup and restore](/identity/data/testingbackup)\n- [Cryptography](/guide/topics/security/cryptography)\n- [Android Keystore system](/training/articles/keystore)\n- [ADB](/tools/adb)\n- [Developer options](/studio/debug/dev-options)"]]
