Question

I am developing a Java based desktop application. There are some data generated from the application object model that I need to persist (preferably to a file). There is also a requirement to protect the persisted file so that others can’t derive the object model details from the data. What’s the best strategy for doing these? I was in the impression that these requirements are very common for desktop apps. However, I haven’t been able to found much useful info on it. Any suggestion appreciated.

Answer 1

Your question has two parts. 1st: How to persist data? 2nd: How to protect them?

There is a lot of ways how to persist data. From simple XML, java serialization to own data format. There is no way how to prevent revers engineering data just by ‘plain text’. You can just make it harder, but not impossible. To make it quite impossible you need to use strong encryption and here comes a problem. How to encrypt data and don’t reveal secure token. If you are distributing secure token with your application it is just a matter of time to find it and problem is solved. So entering a secure token during installation is not an option. If user has to authenticate to use application it should help, but it is the same problem. The next option is to use custom protected bijection algorithm to obfuscate data. And the last option is to do nothing just keep the data format private and don’t publish them and obfuscate your application to prevent from reverse engineering.

At the best value comes simple obfuscation of data (XOR primenumber) with custom data format and obfuscated application.