Home/ Questions/Q 6732879
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-26T10:42:10+00:00

The issue I am facing is an interesting one and my knowledge of security

  • 0

The issue I am facing is an interesting one and my knowledge of security is strong, but my understanding is weak. That is, I understand the theory, but have had little practical application in this particular regard. I have stored passwords, transmitted them using salt, verified them a hash, etc. My needs here are similar but specific.

I have one application that other external application may “hook” into via a ContentProvider URI. External applications may be developed by anyone, thus I do not have control over them. However, I want to limit some access to subscribers. To facilitate this, each “subscribed” application will have a key registered to its package name. The ContentProvider then needs to verify this key as valid.

My issue is this:
Since it is passed via URI, it is easily possible to intercept the key in transit. Additionally, my subscribers need a method by which they can store their own key without having to connect to a secure server. They cannot store the key as a literal within their app, of course, as this makes for easy vulnerability. I am trying to provide as much of a solution as possible without having to “trust” the security of these other applications.

So, how do we store a key in both my database and their external application, and allow them to send it to me for specifically verified queries? I think my issue in understanding how to do this is the aspect of persistent storage and how it affects the model. That is, with a password model, the password is typed and not typically stored.

FuzzicalLogic

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Process the key in an encrypted challenge / response.

    Client requests challenge value encrypted with a predetermined per application public key.
    If the client then returns the correct value to the server encrypted using the client specific server’s public key then the handshake was a success.

    Using a per application private key / public key and something like a guid for challenge value, it would be very hard to duplicate.

    and the keys never change hands except when registering the application developer initially.

    • 0