5

I'm tasked with adding a backup feature to our software. This backup feature should store the customer's database on external memory. One of the requirements for this feature is that the backup should be encrypted. The goal of this encryption is that the customer database is relatively safe when someone leaves a USB-drive with a backup on it laying around. These are not the most stringent security requirements so the backup and encryption features were easy to implement but the real trouble is that encrypting/decrypting the backup requires a key. I'm not sure how we should manage customer keys.

  • The customers know absolutely nothing about IT
  • Entering an encryption key in the control panel of the software is a big hurdle.

It would be nice if the key could be derived from something. For example from the computer's hardware. But that would make the backups useless if they computer breaks down and needs to be replaced. Its also dubious how safe such a derived key could be.

  • In any case the client should definitely not be the one responsible for the generation or safekeeping of the key

They will definitely forget it so the key should come from us or the computer

  • Its preferred that only the customer has easy access to that data, but I do not see how we could both manage the key for the client, and not know the key.

Does anybody know of a (standardized) solution to storing keys for customers? Preferably something that minimizes any administrative hassle?

Improve this question

1 Answer 1

Reset to default
3

I personally recommend Hardware Key stores for these type of tasks. there small USB devices that work like a smart card that store the actual key information on it. than the software just uses as encryption key. you can use 2, 1 in a safe and 1 at the client.

These tokens are not very expensive and solve many of the issues you would have when using a password based encryption.

2 examples I know of:

There are more of these but I find there more expensive where I live.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .