Protecting sqlite database?

[ginda1]

Hi all

I was thinking about ways i could protect the data inside an sqlite database file. Does anyone know if this is possible on symbian! any code snippets would really be appriciated.

Thanks in advance

[petrib]

Depends on what you mean with "protect".

You can keep the database in the private directory in phone memory. Without hacking the phone, only applications with AllFiles capability can access it besides your own app.

You can encrypt the data before you store it (and decrypt when you need to use it). Of course, then you have an encryption/decryption key management problem to solve (and also how to search/index the database).

You can keep the data on a network server, and not store it locally at all. Then, of course, all accesses need a network round-trip, and you also have to secure the connection (at least use SSL/TLS, HTTPS).

You can also look into porting something like this to Symbian: http://sqlcipher.net/

[danhicksbyron]

What Petrib said --

Simply keeping the data in the application's private directory is pretty good protection.

Encrypting before you store is OK, but not real secure against someone who knows encryption unless you use some swizzles.

You can decrypt the entire DB when you open the app and re-encrypt it when you close. But if someone, eg, pulls the battery they can circumvent this.

Keeping the data on the server is good, and you can use SSL to keep it secure on the wire.

SQLCipher is the ultimate, but you'd have to port it. I did this for one customer's app, and it works well, but porting is non-trivial -- involved a fair amount of new code and lots of testing.

Of course, for any of these you have to figure out how to manage the key -- either it's entered every time or you use some scheme of "security by obscurity".