How to ensure the integrity of application data?

Question

I know that Android supports MODE_PRIVATE flag when creating a file so that no other application can access it, however is there a way to like add a digital signature or something that the application can check on startup?

I'm developing an app that acts as a support feature of an online service, so it has an ability to download data from the server that service is running on. However that should be executed before working with the application and only if the data on the device differs from the up-to-date data (held on the server).

My initial thoughts are to check if the file sizes match or the dates they were last modified. So if I use a FileOutputStream and set the flag MODE_PRIVATE when opening file(s) for writing, will that prevent the user from accessing/deleting the file(s) from file manager or any other app?

If not, could you suggest a method to add a digital signature to the file(s) in the onDestroy() method of the MainActivity and a method to check if the signature in the file(s) matches with the one that the application made (although that would've also been saved to a file, perhaps sharedpreferences.xml) ?

Answer 1

I know that Android supports MODE_PRIVATE flag when creating a file so that no other application can access it

This is the default behavior for internal storage.

however is there a way to like add a digital signature or something that the application can check on startup?

You are welcome to create a digital signature for a file. Anyone who modifies the file is welcome to modify the digital signature.

will that prevent the user from accessing/deleting the file(s) from file manager or any other app?

Ordinary users will not be able to access files on internal storage. Users who root their device are able to access internal storage if they choose to.

If not, could you suggest a method to add a digital signature to the file(s) in the onDestroy() method of the MainActivity and a method to check if the signature in the file(s) matches with the one that the application made (although that would've also been saved to a file, perhaps sharedpreferences.xml) ?

That would be useless, as the person modifying the file can modify the signature to be valid. After all, your app is the one doing the signing, and so the private key must exist in the app or on the device, which means that whoever can get to the file can get to the key.

For files that you are not modifying, but are merely downloading, you could have a digital signature for the file created on the server (with a private key held there). Then, your app would only need the public key to validate the signature. However, this does not work if your app is modifying the file.