how to encrypt an existing database on assets folder android studio

885 Views Asked by At

I read many tutorial and topic about this about SqlCipher , but I didn't understand what should I do exactly! I have ready database in my assets folder . My database contains about 4 tables and 5000 records .I want to make it more secure.How I can do it ? Could somebody help me with this problem ? As I am novice with android , I need step by step solution . At the moment I use sqliteasset.SQLiteAssetHelper library to read database from assets folder.

1

There are 1 best solutions below

0
Maxim Sagaydachny On

Do not waste development time on encryption of client-side data - the data which should be accessible by the application in unattended manner (i.e. decrypted by application without user's input of any kind of password).

Here is an explanation of my statement:

Lets assume that you managed to protect(encrypt) your database by some encryption key and application upon startup should read all encrypted data. It means that your application should have built-in key required for the decryption. And any person with minimal reverse-enginering knowledge can extract both key and the database from your apk file and decrypt it.

When you design security mechanism to protect the data one of the first questions which you need to answer is:

  • How much time adversary will need to spend to open the data? If your answer is something like "It will require 10,000 years to brute force my protection" then your protection is probably ok.

But right now you are trying to implement security through obscurity and it newer works. Determined person can easily extract encryption key from your own code and decrypt your database in almost no time.

When you design client-server architecture there is only one way to protect trade secrets - place everything sensitive to the server side.

If your client-side application relies on some business sensitive information (like calling some paid APIs with your own API key) then your application has design flaw.

If your application relies on information which is not business sensitive then it does not make sense to encrypt this information.