0

I get requests from customers where they have an application dump files into the FS on linux and want those files to be automatically encrypted. Not in the sense of an enrypted FS, but in a way that no one, even root, can read these files. The data is also stored in an encrypted database (I know, that will also require some sort of "secure" key storage - but this is assumed to be safe. I know this is probably not true - but nothing I can change). For debugging purposes the data is also stored as plain files - and these must be secured as they contain sensitive data.

As far as my understanding goes, this is not really possible. A daemon watching the FS could pick up unencrypted files and encrypt them with a public key, where the private counter part is stored in a password vault. Of course, no automatic reading would be possible, but that would be ok. However, there will be a short moment where files are unencrypted.

Does anyone know a good solution for this problem? My take is that the application should take care of the encryption, but wanted to make sure I did not miss anything.

The application is custom made, so yes, it can be altered.

3
  • What is the goal of your customer here?
    – ceejayoz
    Mar 1, 2016 at 15:44
  • and can the application be modified? If so, just have it use GPG to encrypt for a public key of your choice.
    – ceejayoz
    Mar 1, 2016 at 15:45
  • The application user can use something like EncFS but that can still be bypassed by root if not very easily and that argument holds basically true for anything that isn't handled by the application itself.
    – HBruijn
    Mar 1, 2016 at 16:11

1 Answer 1

1

If you're not allowed to have unencrypted data on FS for even 1 seconds, you need to save already encrypted data. You will encrypt data in application (with some hardcoded, compiled in key) and storing those already encrypted data.

1
  • But don't forget there are data stored unencrypted in memory.... Mar 2, 2016 at 11:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .