Ios – Remote wipe of application data in iOS

iosios4ipadiphone

I am working on an enterprise application, where the client has the requirement of wiping all the data stored by the application, from the device, remotely. That is, in the case when a user reports a lost device.

If we forget about the service side implementation of it, is it even possible to do a remote wipe of data stored in application sandbox. What about deleting files present in the application resources like sqllite files and certificates?

I was browsing the net for it and came along this site which claims to do so in their product.

If it can be done, how should we approach this problem?

Remote wipe feature has been added by Apple in iOS 4.2 onwards using mobile me. I don't think they are doing this through remote notifications. In that case there wouldn't be any sure shot guarantee, that the data is deleted from the device.

Best Answer

The best way would be to encrypt the data on the iPhones disk and only decrypt it in memory (since iOS 4 there is a similar mechanism built in). Before you let the user use the data, you ask a server if the iPhone is allowed to encrypt the data (a even better approach would be that the server gives the iPhone the key to decrypt the data, so a attacker won't find it in code). If the server denies the request, the App wipes all the stored data and you are done.

This of course only works when your app is allowed to require a internet connection (or at least a connection to the local intranet where it can communicate with the server)