Need to implement some kind of File Security

[hendra@ngms]

CVI 2019

I have an application that upon launch reads in a couple files of parameters needed to operate a data acquisition and control system.  If the files are not there to read, hard coded defaults are used, and new files are saved based on the defaults.

Problem is, if the file already exists I cannot allow anyone to modify it outside the application.  If someone were to log onto the computer, and modify numbers in a file, it could cause severe, dangerous conditions. 

Since the file is read upon launch, and can be modified legitimately from within the application, I don't know how Read/Write permissions would work to provide any protection.  There is no way I can determine that it has been tampered with, it is just a text file with records of floating point numbers.

Any ideas out there?

[altenbach]

You could append (or prepend) a hash (e.g. MD5) of the contents and reject the file if it does not match anymore.

[RobertoBozzolo]

Your question reminded me this discussion that you may want to consider since it describes a situation very similar to yours. 

[hendra@ngms]

Roberto,

Thank you for the heads up on the other discussion.  Yes, there is a lot of similarity with what I am trying to do.  Good information there.

I don't think encryption is the direction I want to go.  Creating a hash, including it in the file header, and comparing that with a generated hash when reading the file seems the better way to go.  That makes it easy to discard a file that has been changed.

I get an Access Denied message when I try to view https://forums.ni.com/t5/Archive-TKB/Integrating-Windows-hashing-functions-into-CVI/ta-p/3493340.  I think I need to read that to learn how to implement hashing in my application.  How can I get to it?

Thanks... Gary

[RobertoBozzolo]

Hello Gary, I receive the same error as well! I suppose this has to do with the example not being in a correct folder. I'll have to contact NI for this.

Anyway, attached you will find my examples on hashing: the old version is a CVI7 project that uses CryptHashMessage and works on all systems. The new one uses the Cryptography Next Generation subsystem and should work only on Win7 systems and up.

[hendra@ngms]

Excellent.  I will dig into this.  Thanks very much...

[hendra@ngms]

Roberto,

The old code seems to work fine for small examples.  The new code is set up for 16 char max, like passwords.  In fact if you enter something longer than 16 chars it generates a library error.  I selected MD5 in the new gui which from inspection is what the old code is doing too.  The old code does a save and check, which is what I need to implement.  So building the code for my application from the old code appears to be easier than the new code. 

It will require some more experimentation, as the text file I need to hash is like 30 lines, each line has a character string and four floating point numbers with line feeds at the end of each.

[RobertoBozzolo]

I contacted NI and the link to the example I provided has been fixed and is now active again.

[RobertoBozzolo]

Gary,

the error you are seeing depends on that I allocated a 16-byte string to read user-entered text: if you modify that allocation line the example works even for long texts. Nevertheless there must be something to be fixed in there since it constantly gives two different hashes if repeatedly called with the same text: I'll have to dig into this but I have no time at the moment to examine the code 😒. I suppose this is why I never published the "new" code 😉

[hendra@ngms]

Roberto,

Thank you very much for your support.  I'm busy with other things so it will be probably many days before I dive into this.  But I will -- looks like the proper solution.

Gary