2

I want to create a secure script that grants access to files based on specific conditions. The access should be controlled by both time-based and API-based conditions. The script should only allow file access if:

  1. A specific query from an API returns true.
  2. The current time is within a predefined range.

Additionally, the script must ensure that users cannot access the files directly and can only do so through the script. Here are the key requirements:

  1. Time-Based Condition: Access should only be allowed during a specified time range.
  2. API-Based Condition: Access should only be granted if a certain condition from an API response is met.
  3. Security Measures: Users should not be able to bypass the script to access the files directly.

Questions:

  1. How should I design this script to ensure it checks both time-based and API-based conditions before granting access to files?
  2. What security measures should I implement to ensure that the files can only be accessed through this script and not directly by the user?
  3. How can I obfuscate this code to prevent users from modifying it and bypassing the system?

Environment:

  • Operating System: Windows 11
New contributor
edge selcuk is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
6
  • you can do this but you need an intermediate layer. When you say "script" im getting the feeling you don't know what this would require. Can you explain what you mean, what programming languages you know, what protcol you want the file access to work on etc etc?
    – Ewan
    Commented Jun 8 at 20:10
  • I know python pretty well, I tried to implement it with python but hasn't worked thus far. Was curios if there is a better way of going about it. I tried the cryptography package in python and wrote some code which is not functional. I was getting the feeling that I should use Batch instead and it will be easier to implement. I want a conditional protocol where the piece of code will determine based on the current time and the API query if the file access to the user is granted or not to the user Commented Jun 8 at 20:19
  • You need to host your script and expose access to it via some protocol. ie a REST service running on a web server. The the client machine can download the file from the website but only if the conditions are matched when the webpage runs on the server.
    – Ewan
    Commented Jun 8 at 20:27
  • Thanks for the help @Ewan . I have never set up a web service like this before from your experience what is a service with a cheap solution and easy to setup and learn? Commented Jun 8 at 20:35
  • Not python, maybe c# or nodejs, learn.microsoft.com/en-us/aspnet/core/tutorials/…
    – Ewan
    Commented Jun 8 at 20:55

2 Answers 2

3

To be honest, if you give the program to the user, they can find some way to bypass security so long as the have file permissions. Security through obscurity is never enough. It can be one layer of your cyber security defenses, but do not rely on that technique as your main defense.

I see two general solutions to this problem, but none of them are easy:

  1. Create console application that is a compiled binary (e.g. an .exe file), which is capable of decrypting files the user has access to. If the user has access to the files, but shouldn't read them, then encryption is your only choice.
  2. Create a RESTful web API that performs all of these checks. Now you are free to build a web UI or "script" that makes these calls to get and list files. Authentication and permissions become an issue. A common solution is to use a JSON Web Token for this.

None of these solutions are easy, nor are they "just a script". Unfortunately, I think you might have underestimated the complexity of this problem. Security sounds like a concern here, so it would be best to take it seriously and build in real checks and balances. A script, in my opinion, is woefully insufficient for the requirements.


A thought I just had is to require users to be connected to a VPN to access the file share in which these files are stored. You can configure the VPN gateway to only allow people to be connected during certain times of day. You might even be able to achieve this with a VPN group separate from the main group users connect to. What you want to achieve is definitely possible, I just didn't think a script is a suitable tool.

3
  • Thanks for the in depth answer Commented Jun 8 at 21:21
  • Depending on requirements, it's often sufficient to just put in enough controls that you wouldn't be able to bypass them on accident, particularly for B2B/enterprise scenarios. From there, the legal team/HR would take over should controls bypass be detected. However, that does bring up one way on how to improve your solution: add in some extra "trap" code to the files/readers to flag if the controls are bypassed. Commented 2 days ago
  • @DyllonGagnier, that is a potentially dangerous suggestion. There are technical solutions to this problem that shouldn't require lawyers or HR policy. For truly sensitive information, put in proper technical safeguards first. Also make sure policies are in place. You really need both in some situations, but relying on policy alone is a great way to get hacked. I don't want to think about the blowback the company might receive if someone finds out there could have been a technical solution that wasn't implemented. Unless I misunderstood your comment. Commented yesterday
1

The most secure way to do this would almost certainly be an RDP VM (though even this is imperfect). Instead of controlling the files, control the machines which have any access to the files in the first place. As soon as the time expires for accessing those files, you can shutdown the VM and revoke access for that user.

Obviously, Windows RDP allows for copy/paste by default, but you can turn that off for files https://answers.microsoft.com/en-us/windowserver/forum/all/how-to-prevent-copying-files-from-remote-desktop/c3a4212e-1014-4956-b7f8-5f8447ea003c and I recall that some remoting solutions can completely disallow all data movement from the client machine to the remote machine and vice versa besides keyboard and mouse.

New contributor
Dyllon Gagnier is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • I may have misunderstood your comment on my answer, but I was leaving towards this kind of solution too. Basically create a sandbox for the user and restrict access. Commented yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.