2
$\begingroup$

My Problem

I want to serve sesible data for users as a webservice that is accessed by the user via the browser.

Restrictions:

  1. I may not be able to technically acces the data of the user
  2. Data is accessable for one or several users, number may change over time. Who has acces to the data is decided by one user for his data. He/she may add or remove other users.
  3. The user should be able to get his/her data anytime

Ideas

  1. Encryt the data at my server with a key, only known by the user.

    • Restriction 1 and 2 is fulfilled, if the user share the key
    • Once the user forgets/lost the key, restriction 3 does not hold...

  2. Data is stored encrypted at the users client, I only provide a nice user interface and the tools to encrypt or decrypt the data.

    • Restriction 1 holds
    • Restriction 2 and 3 are highly dependent on the ability of the users to cooperate and to backup their data...

Questions

  1. Do you have any ideas to improve one of ideas mentioned?
  2. Do you have complete other ideas to solve the problem by fulfilling the restrictions?
|improve this question
$\endgroup$
  • $\begingroup$ If the number of authorized users changes, do you authorize them or do your clients authorize them? And of course what is your threat model? $\endgroup$ – SEJPM♦ May 11 '16 at 15:55
  • $\begingroup$ That was indeed not clearly explained. I specified Restriction 2. Thanks for your hint. $\endgroup$ – Lukas May 13 '16 at 6:07
  • $\begingroup$ This looks like it should be in Security. $\endgroup$ – fkraiem May 13 '16 at 6:18
  • $\begingroup$ Yes it is about security, but it wouldnt be without cryptography. I have a background in IT-Security but if there is some kind of cryptography or key management that could serve me for this case, is beyond my knowledge. $\endgroup$ – Lukas May 13 '16 at 7:21
  • $\begingroup$ When you say "webservice", do you mean a service which must, should and / or will be accessed by browsers or are you talking about dedicated applications here (e.g. an application the user has to install / run outside the browser)? $\endgroup$ – SEJPM♦ May 13 '16 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.