I'm brainstorming a good architecture that allows me to store user generated data from my mobile app securely on my backend server, without forcing the user to remember an encryption password.
The data should only be accessible to the user who generated it, possibly personal data. I need to be able to decrypt it on multiple devices, since the user can log in on multiple devices.
I use Firebase Authentication for authentication. However, the data is stored on an external backend server.
I want the user data to be encrypted client-side (on the mobile app) before it is sent to my external backend server, and decrypted when it is received.
So the process would be as follows:
- user logs in to an identity provider (e.g. Google) and then authenticates using Firebase Authentication --> token is used to authenticate to the external backend.
- after successful login the Firebase Firestore database is checked if an encryption key exists, otherwise an encryption key is generated which is later used to encrypt and decrypt the data.
- the key is securely stored on the device and sent to the Firestore database with the correct security settings, so that only the authenticated user can access his own key.
- now when the user wants to send his data to the external server for backup, he uses the encryption key and then sends it to the external backend server.
Now the scenario when the user logs on to another device:
- the user logs in via the identity provider and authenticates using Firebase Authentication.
- then the stored encryption key is retrieved from the Firebase Firestore database and stored securely on the local device.
- the user downloads their encrypted data from the external backend server, decrypts it, and stores it in the database on their local device.
With this approach, a potential attacker would have to first hack my external backend server and then also hack the Firebase Firestore database to be able to use the encrypted data.
My only concern here is that the private key would have to be stored on Firebase. I mean, I could additionally encrypt it in the mobile app with a generic cipher known to each app instance, but that could also be easily undone if you really tried to hack the whole system. Can the Firebase Firestore database be considered a secure store for this key?
I know I could also give the user the option to use a "store password" or something similar so that the encryption key is generated with it, but I really want to avoid that. If the user loses that password, all the data is lost as well. Overall, this approach would also severely impact usability.
My question now is: Is this approach ok in terms of security (separation of encryption key and encrypted data on separate servers)? Or are there any other best practices for these kind of use cases or any additional options you could think of to improve the concept without affecting the user experience?