Unity序列化字段加密及BIS合规性咨询（Google Play安卓平台）

Great question—let’s break this down clearly since you’re targeting Google Play and have specific concerns around Unity’s serialization, encryption, and BIS compliance.

1. How SerializeField Works in Unity #

First, let’s dispel a common misconception: [SerializeField] does not encrypt or hide data from casual inspection—it’s purely a serialization directive.

Here’s the core mechanism:

• Unity’s serialization system normally only includes public fields in scene/prefab .asset files. The SerializeField attribute tells Unity to include private/protected fields in that serialization process too.
• Serialized data is stored in either a human-readable text format (if you enable "Force Text Serialization" in Project Settings) or a structured binary format. Neither is encrypted. Tools like Unity Studio or asset decompilers can easily extract and read these values—including your hidden joke/quiz answers—directly from the built APK or raw asset files.

For example, if you have:

[SerializeField] private string riddleAnswer = "A shadow";

This value will be stored as plaintext (in text serialization) or as unencrypted binary data. Anyone who digs into your APK can pull it out in seconds.

2. Does Unity Encrypt Serialized Data by Default? #

Short answer: No. Unity does not apply any encryption to serialized assets, scenes, or prefabs out of the box.

The binary serialization format is not human-readable at a glance, but it’s not encrypted—it’s just a structured byte layout that Unity’s engine can parse. If you need encryption for sensitive data, you have to implement it yourself using:

• Unity’s built-in Security API (for basic encryption/decryption functions)
• Third-party encryption libraries (like BouncyCastle)
• Custom encryption logic tailored to your needs

3. BIS Compliance for Google Play Apps #

Let’s tie this to BIS (Bureau of Industry and Security) export regulations, since you’re targeting Android:

• If you’re only using SerializeField (no encryption): You don’t need to worry about BIS’s encryption-related export rules, because you’re not using any encryption technology. Your main compliance check will be ensuring your app follows Google Play’s content policies, not BIS encryption controls.
• If you add custom encryption later: Most consumer-grade encryption (like AES-256) falls under the EAR99 category, which means no special export license is required for most countries (excluding sanctioned entities/nations). However, you will need to declare your use of encryption in the Google Play Console during app submission—this is a mandatory step to align with BIS requirements. Always double-check BIS’s latest EAR regulations, as policies can shift over time.

4. Practical Ways to Protect Your Answers #

Since SerializeField alone won’t secure your content, here are actionable steps for your Android game:

• Encrypt sensitive strings: Store encrypted versions of your answers in serialized fields, then decrypt them at runtime. For example, encrypt your answer strings with AES, store the ciphertext in SerializeField, and decrypt it when you need to reveal the answer.
• Obfuscate your code: Use Unity’s IL2CPP backend (instead of Mono) and enable managed code stripping + obfuscation (via Player Settings or third-party tools like Dotfuscator). This makes it far harder for reverse-engineers to find your decryption keys or logic in the compiled APK.
• Host answers remotely: If offline play isn’t critical, store answers on a backend server and fetch them via API when needed. This keeps sensitive data out of the APK entirely, though you’ll need to handle network reliability and API security.

内容的提问来源于stack exchange，提问作者Programmer000