I’m developing an application that will run on a private, on premises network. The application will be accepting requests through an API, read some encrypted data from the disk, decrypt them, do some processing on them and return the result.
Both the data and the key have to be stored on the same device somehow, since an internet connection is not always guaranteed.
I understand that it’s impossible to hide the key from someone who has access to the machine, but I’m looking for a way to make it reasonably difficult for someone with access to the machine to get their hands on my data.
Where and how can I store the key to make it difficult for a user with local admin access to decrypt the data? If this is not possible, how can I make it difficult for other users to decrypt my data?
The application is written in .NET, but I’m open to any solutions that would help to secure my data. It will run on both Windows 7 and Windows 10.