How to prevent access of users to read and extract my binary files

Question

I have set of binary data files among one of my applications and for security issues I should encrypt and decrypt files for every use. This is quite well but the process is killing. I use Blowfish to perform ciphering and it's really slow in both functions. I can understand that if someone wants to extract my data from the binary files, he/she should have a recognition about my file pattern but I'm afraid that would be nothing hard to guess.

Is there any way to lock access for users to read binary files with use of encryption or other things?

Answer 1

The general rule is that whatever you give to the user is not yours anymore. When you encrypt the data, you keep the encryption key within your application and the key can be extracted. The only relatively reliable solution is to put the key to the hardware device (USB cryptotoken) but this is not acceptable in many scenarios. And it's only relatively reliable, as the data can be captured and there exist attacks on some USB tokens.

If you only want to protect the data from the average Joe, you can use encrypted ZIP as a container (double encryption would drive away more users). And you need to replace the algorithm - Blowfish is really very slow. AES would be faster.

If the amount of data is large, then it's better to employ on-the-fly encryption-ecryption, i.e. you should encrypt or decrypt only those blocks of data which are used and not the complete stream. This makes the task more sophisticated. Or you can use a virtual file system which supports encryption on lower level (our Solid File System is one of examples, and there exist some others).