I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data within the app yet it will be served from public app stores (multiple platforms are targeted).

I'm looking for thoughts on an authorisation method which is not dependent on a back end service such as a registration facility. All the data in the app is self-contained and once the app is downloaded there's no expectation (and in many cases, no facility) for internet connectivity.

One option would be a single "unlock" code that could be provided to target recipients of the app but there's a concern that if this was redistributed it would obviously circumvent the access control for anyone who obtained the code. Of course there's also the risk that any code contained within the app could be reverse engineered but then again, so could the data which we're trying to protect in the first place.

Ultimately I need to find a balance here between security and practicality. The data being protected is not commercially sensitive rather the access controls are due to regulatory obligations so the requirement to protect it is more about implementing "sufficient measures" rather than aiming for bulletproof.

Can anyone share some ideas on how the app may be served from a public app store and unlocked without the risk of a single secret such as a pass code being redistributed?


It seems like you're trying to both make the data publicly available as well as restrict it to a limited set of people, which is a contradiction in terms.

If you're just after UI-level access control in the app, you could come up with any ridiculous scheme, but somebody could then extract data from the app with likely little more than an unzip utility, depending on the data and how it's stored.

If you can use a single password, you could use key derivation to decrypt any encrypted data stored inside the app, however you already discounted 'a single "unlock" code'. Unless you have a list of codes, but that doesn't address the issue you outlined.

The only option I can think of which satisfies all the listed requirements would be two-factor: a device ID whitelist in conjunction with key derivation and encryption. There's almost no way that would make it past Apple and Microsoft, though.

It just doesn't seem particularly feasible to me.


Your requirements appear to be quite contradictory. I am going to suggest a scheme which may or may not be feasible for you to implement. You decide.

I suggest that the app you submit to the public app stores not contain any of the sensitive information. Instead, the application should provide a means to download data from your own backend servers in a secure fashion. The app can save the data into the device storage so the download only needs to happen once. You could supply each legitimate user with a distinct code that allows the app to download that data once. This provides two benefits: it allows you to confirm who is downloading the data from your server as well as provide a means to update the app with new data.

To protect the data in the event the device is stolen, you must use encryption. There is no way around it. Performing client-side encryption with a key derived from a password of the user's choosing using a strong key derivation function should be sufficient. This also fulfills your requirement of not allowing the data to be unlocked by a single pass code being redistributed, as each user will have his own password.

Being unfamiliar with the rules of the Apple or Microsoft app stores, I am not sure if they will allow such apps into the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.