For our web application we are maintaining some data, pertaining to our subscribers, on our server. Some of this data is sensitive and we would like to implement some "security measures" for this data. One is encryption, and we know how to do that. The other is non-repudiation of the content, and we don't know how to implement that.

Specifically we would like to handle the following use case. On day X customer stores some data on our server. On day Y they claim that the data was not stored by them (and implying that someone else stored the data). How can we guard against that kind of repudiation challenge from a customer?

Can we use some kind of hash or something? Keep in mind that customers may occasionally forget their passwords, and passwords may have to be regenerated upon customer request.

  • $\begingroup$ I guess implementing role based access control along with a temporary verification(like an email otp) mechanism could work, but there is always going to be some or the other way this could be compromised (like someone else using the customers devices where credentials are saved). And of course you need to maintain an audit trail of all such actions. $\endgroup$
    – Rinkesh P
    Jan 28, 2022 at 7:33
  • $\begingroup$ Please read security.stackexchange.com/q/1786/971 first, then define more precisely what you mean by non-repudiation. What do you mean by "guard against"? What do you want to achieve? What are your requirements? $\endgroup$
    – D.W.
    Jan 28, 2022 at 22:59
  • $\begingroup$ Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. To get the most helpful answers you should tell us: what assets you are trying to protect; who uses the asset you're trying to protect, and who you think might want to abuse it (and why); what steps you've already taken to protect that asset; what risks you think you still need to mitigate. $\endgroup$
    – D.W.
    Jan 28, 2022 at 23:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.