CODEWITHSUNDEEP
androidsqlitesecurityxamarin.android
Sean
Sean

Reputation: 882

Protecting Local SQLite Database (Android Application)

We have an Android application which stores its data in a local SQLite database; primarily for performance, but also to allow for working off-line (as we are often in areas with low signal).

At the moment, the data is stored in encrypted format (passed down from our web servers), but this in itself causes a performance issue, where for example, if we want to search records for a particular "surname", we need to decrypt ALL of the data, rather than using a straight SQL query, to include where surname='Smith'

We cannot (as it currently stands) store the data in a more friendly 'open-format', as it's possible to 'root' the device, take a copy of the MySQL database, open it and read the data.

Is there the means (perhaps someone can provide an example) to either password protect the local SQLite database or somehow apply encryption, so that we can (from an application perspective) have the database available in open format, but so that if any would-be hacker got hold of the device and rooted it ... they would have a hard time reading our data?

I have searched for a suitable solution and cannot find any options for the SQLite database, any 3rd party software or any examples of code that do this.

Upvotes: 6

Views: 2808

Answers (2)

Karan
Karan

Reputation: 2130

Remote Storage:

Your data is sensitive and needs to be accessed by the user on the go from different devices. If your app is a good one then the above line will hold true.

Security + Remote access from any device says you maintain your dB on a remote server.

Your flow can be :

User login --> Token --> Auth Token in every call --> Process request and get/put data in/from dB

Local Storage:

Let's say that you only want to store data locally and don't want to store it on the server. For this you can use public-key cryptography

You can use a public Key in your app to encrypt the data and store it. Now, you want to access the data. Request the private key from the server and decrypt it.

Again, to get access to private key you should use some form of authorization (or anyone can access your key).

Without the private key, even if a hacker roots the phone and gets his/her hands on the dB, the data would be useless.

Upvotes: 1

Abhishek
Abhishek

Reputation: 1345

SqlCipher, this will might work in your case

Upvotes: 1

Related Questions