Question

I’ve around 1GB of structured text data, (which is currently stored in database MySQL, mroe than 1million records) used by software. I’ve to ship this data along with the software.

I also need to protect this data. This data shouldn’t be not accessible for users for other purposes. This software is just like an interface to data. like any database client.

Whats the best method to do so? Also kindly tell me pros and cons of these methods available so that I can decide myself next time.

EDIT::

I think my question is not clear. My software operates on this data. It provides query interface for this data. It shows data according to user according to his needs by querying the DBMS which has this data. My major concern here is not the size of the software (along with this data). I don’t want user to redistribute this data. So, storing encrypted data in a zipped file is not a solution.

1. So, I must use embedded DBMS like sqlite. But how to secure this? So, that user cannot distribute.

Answer 1

1. Ship it on a DVD accompanying your product.
2. Make it available for download from a website.
3. If bandwidth allows, provide a web service and have all your users connect to your central database via the web service instead of having standalone instances of your data.

Once you distribute data, it’s more or less out of your control. You can do things like encode or encrypt it, but it’s not a foolproof solution. The only real, sure-fire way to protect your data is to not give it out.

That having been said, there are a few possibilities:

• Encrypt the database in some way. If the database isn’t for reporting and doesn’t need to have a lot of general queries run against it, you can encrypt at the row or field level. This will REALLY slow down the system, though.
• If using an embedded database, encrypt the entire file. This will significantly slow down startup and shutdown time for your app, though.

Unfortunately, once you distribute your data, it’s a losing battle to try to secure it. A better bet, if you can, is to provide a query web service so that your data are never archived en toto by a user – you just send them query results over the wire. You can adopt a user authentication strategy to verify that only legitimate users use the system, and maintain tighter control over your data that way.

EDIT: see my final paragraph. If you’re distributing your data, you no longer have explicit control over who can come into possession of it, so any “control” of your data must be due to encryption or a similar protection. Unfortunately, you have to distribute a key at some point to the user (or the software the user’s operating) in order to access the data. A sufficiently sophisticated user will then be capable of capturing the key and breaking your data protection. But, given that complete security is an impossibility once your data are in the hands of the user, you can give it your best effort by applying encryption. Your only two real options at that point are to encrypt data per row (or field?) or to encrypt the entire embedded database file.