1

I've a portable device with custom application written for it.

What I want, is to secure that application, to make it impossible or at least harder to run it(application, or OS itself it doesn't matter) on some other device e.g. if someone somehow stolen the application, they should not be able to run it on unauthorized device. Device will not connect to the internet and authorize with server, that I can do, but how to do it offline?

How should I approach this problem? Is there some general approach to this? Or I am left only with "enter the password" option with hashed password on the device?

EDIT: OS: Android Device: any type of table and/or unspecified "box" device without sim card. Something like a controller, or a very small server.

Improve this question
4
  • We need more information. What type of device? How does the application get installed on the device? What operating system?
    – Dan Landberg
    Apr 28, 2017 at 19:05
  • Well I did not post it on purpose, bc I did not know if I can provide such information, but I'll update the question
    – hocikto
    Apr 29, 2017 at 12:21
  • Actually, I do not need exact solution just some general approach how it is done no matter the device or operating system.
    – hocikto
    Apr 29, 2017 at 12:23
  • It's always possible to run the application in an emulator which emulates any hardware an attacker wants. So what you want isn't possible.
    – beroal
    Oct 17, 2021 at 15:37

3 Answers 3

Reset to default
1

The most secure option is to use TPM-assisted full-disk encryption along with secure boot , signed binaries , run-time TPM-"measured" kernel and applications. If your platform doesn't support that, some other approaches in order of decreasing strength :

  • use a TPM to decrypt/measure the application each time before it is run
  • use a dongle which communicates with the app (perhaps as TPM replacement)
  • hash/stretch serial numbers and other IDs , and always decrypt the app with the resulting key
Improve this answer
2
  • This sounds really good. About the last option - do you have any experience in encrypting/decrypting the app before running on android specifically?
    – hocikto
    May 1, 2017 at 6:25
  • No. But some Android devices already do all things i mentioned as features of the theoretically most secure platform. Their TPM is implemented as special firmware.
    – flakeshake
    May 1, 2017 at 19:11
0

Can you permanently mount an eMMC or micro SD card in the device somehow? If it's a small server, that seems possible. That could be used to store a key for dm-crypt. As long as users didn't have permissions to access it, it seems it would be fairly secure. A user could still potentially figure out that it was there, though.

Improve this answer
1
  • Hi, I am not sure yet, but I think I won't be able to modify the device on hardware level
    – hocikto
    May 1, 2017 at 6:21
0

Are there any device ID codes that cannot be spoofed? Maybe you can have it run only if a SHA authentication with some obscure device ID works out. To fool it, then the attacker would have to grab every ID they can think of.

Improve this answer
1
  • Well, I can only access ID's that are available from Android Operating system and it's not that many of em, is this what you meant? I mean, it is said that MAC address is still the same but it can be easily changed on software level. If I made a list of allowed MAC's it would have to be saved and encrypted on the device but IDK if this is safe.
    – hocikto
    May 1, 2017 at 6:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .