0

My application is a (Windows) desktop application that is required to operate fully offline. To enable this, I have a local data cache that keeps a synced copy of server data.

How can I secure this local data from any access other than my software?

I know that for fully offline software, this is impossible; any encryption aspects like key, salt, password, etc. that my software used would have to be embedded in the software itself, and this could be recovered from the executable.

But my application also has a requirement that it connects to the home server at least every 5 days for updates, during which time it could download anything.

Is there an algorithm that would allow the application to encrypt the data, using an encryption key that's downloaded every so often, based on information that only the server would know?

Improve this question
4
  • why not use public key encryption?
    – schroeder ♦
    Commented Dec 25, 2019 at 20:55
  • "during which time it could download anything" - can you explain this? This does not follow from what you have described.
    – schroeder ♦
    Commented Dec 25, 2019 at 20:57
  • 1
    What is your threat model exactly? It's not really possible to completely secure data from other software that has ill intent. However, if you're more interested in preventing access to data after a given time it may be a good idea search for things like how to auto expire data as a key management option, and/or if you're interested in mitigating unauthorized users from recovering data then Security Tokens might also be an option to consider.
    – S0AndS0
    Commented Dec 25, 2019 at 21:20
  • @schroeder: i mean that the software must connect with the home server every so often, so could this be leveraged to provide an injection of information to make the offline data store more reliably secure.
    – Joshua Frank
    Commented Dec 26, 2019 at 17:06

1 Answer 1

Reset to default
1

This is just as impossible for partially offline software as it is for fully offline software. For example, someone could image the computer on day 1, and then restore the image and set the clock back on day 5, repeating this process forever. Doing this reduces it to the fully offline case, which you already know is impossible. If you want to actually secure the data from the user, then you absolutely need to be fully online, and keep the data on the server.

Improve this answer
1
  • That's a good point about the clock.
    – Joshua Frank
    Commented Dec 28, 2019 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .