Data protection on mobile devices.

Question

Hi,

I'm storing some healthcare data on a mobile phone and I'd like to know what the best system of encryption is, to keep the data secure. It's basically a bunch of model objects, that I'm serializing and storing using NSKeyedArchiver / the equivalent on Blackberry (the name eludes me for now)

Any tips? I don't want to make up security protocols as I go along, but one of the other threads suggested the following approach.

• Generate a public / private key pair
• Store the public key
• Encrypt the private key with a hash of the user's password.
• Use the public key to encrypt the byte stream.
• Decrypt the pvt key, keep it in memory, whenever the user logs in, and decrypt the stored data as needed.

Is there a more standard way of doing this?

Thanks,
Teja.

Edit: I appreciate it that you're trying to help me, but the things currently being discussed are business level discussions, on which I have no control of. So rephrasing my question, if you ignore that it's healthcare data, but some confidential data, say a password, how would you go about doing it?

Answer 1

http://en.wikipedia.org/wiki/HIPPA

Make sure you read and understand this!

edit: Sorry, didn't even bother to check to see where the OP is from, but even if they aren't from the USA there are still some good practices to follow in HIPPA.

Answer 2

HIPPA is a business practice and total system level privacy/security regulation. As such, an app can't comply by itself on random hardware for a random user. You need to determine how your app fits into a client health care provider's total regulatory compliance process before you can determine what algorithm might be found to comply with that process.

Answer 3

My best advice would be, don't store sensitive data in the user's mobile phone.

If that is not an option for you, then some kind of public/private key encryption, such as one you described, would be the next best option.

Answer 4

There might be an easier way for secure data storage. With iOS 4.0 apple introduced system provided encryption of application documents. This means that the OS is responsible for doing all the encryption and decyryption in a fairly transparent way.

Applications that work with sensitive user data can now take advantage of the built-in encryption available on some devices to protect that data. When your application designates a particular file as protected, the system stores that file on-disk in an encrypted format. While the device is locked, the contents of the file are inaccessible to both your application and to any potential intruders. However, when the device is unlocked by the user, a decryption key is created to allow your application to access the file.

So only when your app is active, the files can be read back in unencrypted format. But the nice thing is that they are always encrypted on disk. So even if someone jailbreaks the device, or backs it up, the retrieved files are worthless.

This was probably introduced to conform to some specific data security standard that is required. I can't find that anywhere though.

For more info see the iOS 4.0 release notes.