Dash SDK: Local Encryption

Unsecured app data can leave your organization and your users at risk. Android developers typically store sensitive information in unsecure locations. Dash provides methods to easily encrypt and secure local storage locations.

Conceptual Overview

  • What Does The Dash SDK Encrypt?

    • SharedPreferences

      SharedPreference objects allow Android developers to store collections of key-values for use in app. Developers often store session, user data, and settings in SharedPreferences, making them valuable to hackers.

    • SQLite Databases

      SQLite allows Android developers to locally store structured data, by defining a database schema and executing read and write queries. Sensitive data is often stored in SQLite.

    Dash provides functionality for encrypting your apps SharedPreferences and SQLite databases with just a few simple methods.
  • How Does Dash Encryption Work?

    Dash encrypts storage locations using industry standard protocols (AES-256). The encryption key used to secure these locations is created through a key exchange at initialization. Through Dash's encryption process, we allow developers to seamlessly encrypt data.

  • Why Does Encryption Matter?

    Loss/theft issues

    Mobile devices can be lost or stolen. When this happens, 3rd parties have the potential to access unsecured data, and unencrypted data is at high risk of being stolen.

    Protecting session and user data

    Most developers store some kind of session data and identifiers in SharedPreferences. In cases of loss, theft, and tampering these preferences can be used to gain user account access or compromise apps.

    HIPAA compliance/other compliance

    HIPAA requires covered entities to put best effort toward safeguarding Protected Health Information (PHI). Unsecured session/app/patient data may become compromised and lead to a breach of HIPAA.

    Confidential or sensitive corporate data.

    Data shared between companies and employees may contain sensitive data. Often it is important to safeguard this data to protect customers, brand, and intellectual property.

Encrypting SharedPreferences

SharedPreferences are often used by developers store session data and key user data. These preference files can be accessed by an user who has a rooted device, unless encrypted.

We can secure this data and prevent 3rd party access, by implementing encryption as shown below:

//Import the Dash SDK
import com.dashsdk.Dash;

//Edit your preferences, like you normally do
sharedPreferences = getSharedPreferences("sharedPreferenceName", 0);
editor = sharedPreferences.edit();
editor.putString("name", "arav");
editor.putFloat("age", 22.2f);
editor.putLong("long_val", 12l);
editor.putBoolean("bool_val", false);
editor.putInt("int_val", 1);

//Encrypt your SharedPreferences

//Easily decypt SharedPreferences with one method

Encrypting SQLite

SQLite databases are one of the primary ways developers can store structured data locally in Android apps. SQLite databases kept in plaintext can be read and altered in several ways.

We can protect against malicious database actions by encrypting our databases, as shown below:

import com.dashsdk.Dash; //Import the Dash SDK

//Perform database operations, like you normally do
ContentValues contentValues = new ContentValues();
contentValues.put("Password", password);
db.insert("TableName", null, contentValues);

//Encrypt your SQLite database

//Decrypt your SQLite database

Encryption & The App Lifecycle

By default Dash encryption works around the nuances involved in the app lifecycle:

  • Encryption is not affected by app crashes

    If an app crash occurs, any open database/preference connections are closed and data remains encrypted.

  • Data is encrypted on app close

    When an app is closed, Dash automatically closes database/preference connections and encrypts the data.