2

Consider an (Java) application that will be deployed on an off-the-shelf laptop in a public location. The laptop is not connected to any network or the internet. A USB barcode scanner is available as an additional input device. For the application to function properly, it needs access to a local (SQLite) database with personal information. Periodically, we import new data and destroy the old data.

Our greatest concern in protecting the data is physical theft of the laptop. Normally someone will be close by to keep an eye on the laptop, but there will be times that the laptop is out of sight. We are not able to physically secure the laptop to any nearby objects.

We are considering measures to protect the database programmatically, but are unable to find a solution that is both secure and practical.

Currently, we plan to encrypt the database (e.g. AES-256) and swap the encryption key every time new data is imported. The operator must enter the encryption key to unlock the application and access the data. To ease the login process, we provide the operator with a QR-code containing the encryption key that can be scanned with the attached barcode scanner.

Theoretically, the operator will log out of the application once they are done. However, in practice this is often forgotten, which leaves the application wide open for abuse. Data is not easily disclosed through the application, but as long as the user is logged in (we assume) the encryption key is saved somewhere in memory. A malicious person might steal the laptop, dump the memory, find the encryption key and access all data directly.

We are considering to logout the application automatically after a certain time of inactivity. This timeout would have to be rather short (say several minutes), otherwise a malicious actor can steal the laptop and keep giving it regular input while searching for the encryption key. However, a longer timeout would be preferable to prevent that the operator must login again and again, even when they are manning the laptop and simply have some downtime without regular input.

Are there any best practices or research concerning situations like these?

  • Can you get a cable lock? – Michael Nov 21 '19 at 20:36
3

First of all, let me say that your scenario is quite bad. Storing copies of personal information on an unsecured laptop that people could rob rings a number of bells, and my first instinct would be to ask why do you really need to do that?? It may be possible to handle it on a better way. And even if budget restrictions are a concern, do note that they need to be compared with the risk associated to improperly leaking that data (both monetary -someone sues you for 'losing' that data- and reputationally for the company).

Now, assuming that those restrictions hold, what you are describing doesn't sound too bad. Obviously, the QR code holding the password could be easily stolen by anyone with a smartphone, and the application, associated database and login password could be copied to a usb drive in minutes by an attacker that knew what to steal (hint: disable usb ports). Also, the AES key is most probably still stored in some memory allocated to the Java VM process.

The main suggestion I would make to your approach is to automatically lock/shutdown the laptop when it is taken outside the allowed area.

  • One way to do that would be if it carried a GPS received (common in smartphones, not so much on laptops).
  • Usually a check on available WiFi networks would serve well. You state that the laptop is not connected to any network, but perhaps there is a near network that it can take as a signal of being 'on the right location', even if it doesn't connect to it?
  • However, a more basic detection would be to rely on the power cord being connected. I assume that the laptop will have to be connected to the power in that public location. You could detect the event noting that it is running on battery as a signal to lock the application.
  • And the most simple way to force the laptop to lock if removed from the location would be to deploy it with no battery at all. Physical theft of the laptop would require disconnecting it from the power cord, which would automatically shutdown the laptop, locking the database.
  • +1 for "no battery" suggestion. I would couple that with full disk encryption (BitLocker if Windows), and maybe a BIOS boot password so that it's difficult for a thief to get the machine to boot after a powerdown, and even if they remove the hard drive, it's encrypted without the password. – Mike Ounsworth Nov 17 '19 at 3:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.