Sqlite database security

Question

I'm developing an application which will be storing user sensitive data. My issue is using other applications that a user can view that stored data with. Then I need to provide better security for the data in general.

Is there any way to provide better security for SQLite database and tables?

Wadesworth

Answer 1

The author of sqlite offers a version that encrypts data. It's not free though

Vamp

@Vamp is correct -- the license is a perpetual license for $2000 USD. – Takahashi

Answer 2

Encrypt your data before you enter it in the database. As far as I know, the SQLite database is kept in a single file somewhere in the /data/ directory. What is more, your data is kept in plain text format. This means that it will always be possible for someone to extract that data by rooting the phone, obtaining the .db SQLite file and opening it with a text editor.

So, encrypt your data :)

-- Okay, maybe not a text editor, but a simple hex editor. Anyways...

Ballocks

Anyone capable of rooting their phone is capable of decompiling the APK and getting the decryption key. – Case

@CommonsWare: Well, yes, but propose a better way. We are talking about securing an SQLite database. If the question was about overall data security, then storing the data on a backend server somewhere (communicating over a secure connection) would be a better approach. – Ballocks

There is no "better way". Anyone capable of rooting their phone is capable of decompiling the APK and getting the decryption key. Encrypting the database may secure you against some percentage of people (those who know how to root but do not bother hunting for the decryption key). It is a fairly fundamental rule of security that you cannot completely secure data against a user that holds the device in question. – Case

@CommonsWare: I completely agree with you. However, when we limit ourselves to the actual question (concerning data, that is being stored in a SQLite database and a 'way to provide better security for sqlite database and table' is being sought), then, do you propose a better way of improving the security? Apart from that, yes, physical access is root access. – Ballocks

using a one way hash and not actually storing it on the device is a better approach. Just compare the data in question after hashing it. This way if the device is lost, they may have your information from the phone, but they are going to be hard pressed to get anywhere else with it. I like md5, but theres lots of hash algorithms.. – Tattle

Answer 3

Check out SQLCipher for Android. It's free (Apache 2 and BSD licences).

PS.: Some ORMs also support SQLCipher now, e.g. our greenDAO.

Punner

Answer 4

You could encrypt the data using a user specific salt retrieved from your server. That way, even with root access you would need the users salt to decrypt the database. Since you have control over the salt you provide an extra layer of security, however, your user will always need a network connection to access their data.

Whortleberry

Answer 5

why are you keeping sensitive data on the phone? If its sensitive, why not send it back to the server where you have control over things. If the user roots their phone, they can basically do what they want. Other than that, encrypting like Shade mentioned would probably be your only option...

Genic

Answer 6

Good way to protect the the Database is to use the password Protected database and you can create it by using

1- android Sql3 wrapper library

2- libsqlite3_jni.so

also please read the article below are make your search on the option above, i hope this would help much.

http://www.findbestopensource.com/product/sqlite3-android

Kreisler