Search code examples
androidsecuritystoragekeychaintrial

Android secure persitent storage (app uninstall) with standard APIs


I have done some research how to actually implement a X day trial version without an external webserver for date checking. But did still not get to a clear solution.

Requirements in short:

  • Secure storage of small data amount (e.g. Install data)
  • Secure in the sense that it is only readable/writeable by that app. Even better hardend against device wiping, rooting?
  • Persistent over app uninstall
  • On app reinstall data can be regained
  • Working on Android 4.0.3+
  • Using standard APIs, no hacks which could break with time. [1]

I know these are high demands. Is there any way? Thanks.

[1] http://nelenkov.blogspot.de/2012/05/storing-application-secrets-in-androids.html


Solution

  • If you look at the available Storage Options in android, we can narrow down on the approach that can be used.

    You can't go for Network Connection as you don't want an external web-server

    You can't use SQLite Databases, Internal Storage or Shared Preferences as these are not 'Persistent over app uninstall'.

    So the only way to do this is External Storage.

    However, to make it 'Secure in the sense that it is only readable/writeable by that app' you'll have to encrypt the data file(s) so that only your app can read it. But you cannot make it immune to device wiping or deletion triggered by user herself.