0

I have recently started a project where I need to make extensive use of videos and books. And all of them are needed to be stored locally.

I want to be able to search all these books and get access to them as quickly as possible.

I don't want users of my application to have access to the content (books and videos) outside my app that would allow them to copy the files or view them in another software.

In short, I don't want the files to be stored openly in the file system, I want to obscure them or somehow restrict access to the content so it cannot be accessed outside my application.

This is like an encyclopedia project, where I have copyrighted materials.

I am using Java as the main language for this project.

6
  • Are you asking for hardware recommendation? Aug 29, 2016 at 6:24
  • No. I am talking about a software project. I don't want to store these files as normal files in local disk. That's what my question is about. Do I need to store them in a database, maybe? I don't know, however, you people while working with projects, let us say, an encyclopedia software, how do you store all these files?? Aug 29, 2016 at 6:46
  • Is it a good idea to store large files in a database? are there another solutions? Aug 29, 2016 at 6:54
  • Edit your question and make clear what you are asking before it gets closed. Give the encyclopedia example. State that you don't want the files to be stored openly in the file system, that you want to obscure them of somehow restrict acces to the content so it cannot be accessed ouside the application. Aug 29, 2016 at 7:07
  • Thanks. That's what I actually I need. You have well understood me. Aug 29, 2016 at 7:09

2 Answers 2

2

You probably want to encrypt the content (or at least obfuscate it). You then have to trust the encryption and the procedures related to it.

But advanced users could bypass your Java code and access to the encrypted form.

BTW, with enough efforts (including forcing the encryption), your mechanism could be bypassed. Remember that security through obscurity is a fallacy.

Storing data outside of files (e.g. in some database) does not hide it at all. An advanced user (like a motivated enough me) would find your database and could query it outside of your application. It could change a Java class loader to modify or at least trace your application's behavior, or it could even patch the JVM running your thing (or use some different, e.g. academic JVM, to run your thing). It could e.g. trace the system calls done by your app (on Linux, I'm using strace(1) on most foreign binary software I might have to install). Read perhaps Operating Systems: Three Easy Pieces.

Also, a given content (video or book) could be legally available on the consumer's computer outside of your app. Do you require that content to be duplicated (wasting resources on the consumer's computer, assumed to legally belonging to him)?

At last, as a consumer, I would never buy or use your software, because I don't trust DRM. Information wants to be free. See https://www.defectivebydesign.org/ (which also have technical arguments related to your issue that you should know, even if you disagree with the opinions there).

Read about trusted computing base.

Explain to your client that someone (outside of US law juridiction, perhaps some Chinese, Russian, French developer or hacker, more generally outside of legal reach from your client ....) will eventually reverse engineer any software trick you'll implement, and publish his understanding of your tricks on some website or forum. It is just a matter of time. Read about libdvdcss as a past example etc...

I want to obscure them or somehow restrict access to the content so it cannot be accessed outside my application.

You won't technically be able to fully restrict (that is, make impossible any) access to content on another computer (on which the OS, the JVM, the hardware etc... could be "hacked" or "compromised" or "improved" or "patched"); you just could make that difficult (using encryption or obfuscation techniques). So you have a cost-effectiveness tradeoff: how much work & resource can your client afford to make it very difficult? Or is "barely difficult" enough?

12
  • That's interested. I didn't know about this. So where does the problem lay out? in the JVM that interprets the java language, or the mechanisms used to encrypt the content? On the other hand, the decision isn't mine when it comes to contents. The party that I work with request that the contents should be hidden. And that's, in fact, put me in a difficult situation. Aug 29, 2016 at 7:35
  • That is your social problem, and it has no technical solution. Your client is incredibly naive. Aug 29, 2016 at 7:37
  • 1
    @labirpinima One thing you can do besides encrypting is obscuring the storage structure, like naming the files "da39a3ee5e6b4b0d3255bfef95601890afd80709" instead of "machine working.mpeg" and having an iPod like folder structure, i.e., random folder names like F4C2, M_zK etc. But as @basile-starynkevitch says, that will not prevent hackers or very motivated persons to discover and cooy the files. Aug 29, 2016 at 7:59
  • 2
    what surprises me is that there are still people assuming that everything should be free...
    – jwenting
    Aug 29, 2016 at 8:22
  • 1
    Not everything. However, read Piketty & Tirole (economists) about these issues. But a content I have bought or obtained legally is mine, and I don't expect apps to hide it or duplicate it on my computer. Not every property (particularly digital content) needs to be protected by DRM. Sometimes, law is enough. Aug 29, 2016 at 8:25
0

I would simply store my content in a cloud environment and let them access it at runtime. At runtime it will be retrieved from the cloud encrypted while streamed to the user's computer and decrypted when the streaming is done. the encryption key should be 128 bit and rotate - it may even come from the service as well.

1
  • OP said "And all of them are needed to be stored locally." Aug 31, 2016 at 19:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.