How to Design a Secure Script for Conditional File Access Based on Time and API Conditions?

Question

I want to create a secure script that grants access to files based on specific conditions. The access should be controlled by both time-based and API-based conditions. The script should only allow file access if:

1. A specific query from an API returns true.
2. The current time is within a predefined range.

Additionally, the script must ensure that users cannot access the files directly and can only do so through the script. Here are the key requirements:

1. Time-Based Condition: Access should only be allowed during a specified time range.
2. API-Based Condition: Access should only be granted if a certain condition from an API response is met.
3. Security Measures: Users should not be able to bypass the script to access the files directly.

Questions:

1. How should I design this script to ensure it checks both time-based and API-based conditions before granting access to files?
2. What security measures should I implement to ensure that the files can only be accessed through this script and not directly by the user?
3. How can I obfuscate this code to prevent users from modifying it and bypassing the system?

Environment:

• Operating System: Windows 11

Answer 1

To be honest, if you give the program to the user, they can find some way to bypass security so long as the have file permissions. Security through obscurity is never enough. It can be one layer of your cyber security defenses, but do not rely on that technique as your main defense.

I see two general solutions to this problem, but none of them are easy:

1. Create console application that is a compiled binary (e.g. an .exe file), which is capable of decrypting files the user has access to. If the user has access to the files, but shouldn't read them, then encryption is your only choice.
2. Create a RESTful web API that performs all of these checks. Now you are free to build a web UI or "script" that makes these calls to get and list files. Authentication and permissions become an issue. A common solution is to use a JSON Web Token for this.

None of these solutions are easy, nor are they "just a script". Unfortunately, I think you might have underestimated the complexity of this problem. Security sounds like a concern here, so it would be best to take it seriously and build in real checks and balances. A script, in my opinion, is woefully insufficient for the requirements.

---

A thought I just had is to require users to be connected to a VPN to access the file share in which these files are stored. You can configure the VPN gateway to only allow people to be connected during certain times of day. You might even be able to achieve this with a VPN group separate from the main group users connect to. What you want to achieve is definitely possible, I just didn't think a script is a suitable tool.

Answer 2

The most secure way to do this would almost certainly be an RDP VM (though even this is imperfect). Instead of controlling the files, control the machines which have any access to the files in the first place. As soon as the time expires for accessing those files, you can shutdown the VM and revoke access for that user.

Obviously, Windows RDP allows for copy/paste by default, but you can turn that off for files https://answers.microsoft.com/en-us/windowserver/forum/all/how-to-prevent-copying-files-from-remote-desktop/c3a4212e-1014-4956-b7f8-5f8447ea003c and I recall that some remoting solutions can completely disallow all data movement from the client machine to the remote machine and vice versa besides keyboard and mouse.