1

I am developing app, which uses sqllite db. I want to provide security to DB. Is there any ways to provide security to SQLite DB so that no one can read it by hacking device or something else.

Should we provide any encrytion or apple provides their own security? Which are ways to provide app DB security?

Thanks

Swapnil
  • 1,858
  • 2
  • 22
  • 49
  • If your application has to access it, then your application has to have the keys, so the keys have to be stored on the device. – Quentin Jun 13 '12 at 09:59

1 Answers1

1

@Quentin's comment is right - as long as someone has physical acces to your device, it's only a matter of time until it's cracked. However, you can make that amount of time take so long that it's not worth it.

If you were to encrypt your database, the decryption key would also have to be stored on the device (assuming you want it to work offline). You could use the keychain to store this key - then they have to crack the iPhone's keychain before they can get access to your data.

The other alternative is to only let your app work while online - store the key on your server and have the user login and authenticate before you pass the key back to the app. This s a bit more work from you but will ensure that the key and the data are stored in different locations.

Finally (and most securely), you could store everything on your server - that way you control the data nd the key yourself and deice theft won't make the slightest bit of difference. however, if your data set is big this might make the ui of your app more complicated. And it won't work offline, obviously :)

deanWombourne
  • 38,189
  • 13
  • 98
  • 110
  • Hi deanWombourne, what we need to do in case of Offline mode, since my app is for offline mode and I am populating data from DB only. How we can handle? – Swapnil Jun 13 '12 at 10:12
  • In that case, your only option is to store the decryption key in the keychain (I edited my question to add a link to the documentation). Take a look at this question http://stackoverflow.com/questions/8384789/encrypting-sqlite and this looks like a nice place to start http://sqlcipher.net/ – deanWombourne Jun 13 '12 at 10:16