How the platform protects itself.
WHAT THE LAYERS ARE
Hardware: a dedicated secure element storing keys
Secure boot: each stage verifying the next
A signed, read-only system volume Code signing, required for anything that runs Sandboxing, restricting what applications may access Privacy consent, controlling access to data and devices
WHAT THE SECURE ELEMENT DOES
Holds encryption keys and biometric data, isolated from the main processor.
WHY THAT MATTERS
Keys never leave it, and biometric data never reaches your application or Apple.
WHAT SECURE BOOT PREVENTS
Modified system software running.
WHAT THE READ-ONLY SYSTEM VOLUME PREVENTS
Modification of the operating system, including by software running as administrator.
WHAT CODE SIGNING PROVIDES
Proof of origin, and detection of modification.
WHAT SANDBOXING PROVIDES
Containment. A compromised application reaches only what it was permitted.
WHAT THE MODEL AMOUNTS TO
Defence in depth, with each layer assuming the one above may fail.
WHAT IT DOES NOT PROTECT AGAINST
A user persuaded to grant permission or install something.
