Consider an (Java) application that will be deployed on an off-the-shelf laptop in a public location. The laptop is not connected to any network or the internet. A USB barcode scanner is available as an additional input device. For the application to function properly, it needs access to a local (SQLite) database with personal information. Periodically, we import new data and destroy the old data.
Our greatest concern in protecting the data is physical theft of the laptop. Normally someone will be close by to keep an eye on the laptop, but there will be times that the laptop is out of sight. We are not able to physically secure the laptop to any nearby objects.
We are considering measures to protect the database programmatically, but are unable to find a solution that is both secure and practical.
Currently, we plan to encrypt the database (e.g. AES-256) and swap the encryption key every time new data is imported. The operator must enter the encryption key to unlock the application and access the data. To ease the login process, we provide the operator with a QR-code containing the encryption key that can be scanned with the attached barcode scanner.
Theoretically, the operator will log out of the application once they are done. However, in practice this is often forgotten, which leaves the application wide open for abuse. Data is not easily disclosed through the application, but as long as the user is logged in (we assume) the encryption key is saved somewhere in memory. A malicious person might steal the laptop, dump the memory, find the encryption key and access all data directly.
We are considering to logout the application automatically after a certain time of inactivity. This timeout would have to be rather short (say several minutes), otherwise a malicious actor can steal the laptop and keep giving it regular input while searching for the encryption key. However, a longer timeout would be preferable to prevent that the operator must login again and again, even when they are manning the laptop and simply have some downtime without regular input.
Are there any best practices or research concerning situations like these?