SecureStorageLabJava

Android application developed in Java to demonstrate secure local data persistence on Android. The lab covers SharedPreferences, EncryptedSharedPreferences, internal files, cache storage, app-specific external storage, and secure data cleanup.

Learning Objective

The objective of this lab is to understand the different forms of local persistence available on Android while applying fundamental security practices.

The application demonstrates:

• writing and reading non-sensitive data with SharedPreferences;
• the difference between apply() and commit();
• securely storing a token with EncryptedSharedPreferences;
• using a MasterKey based on Android Keystore;
• writing and reading UTF-8 internal files;
• saving and loading a local JSON file;
• using the cache directory with cacheDir;
• exporting a file to app-specific external storage;
• completely clearing local application data;
• verifying that secrets are never exposed in plaintext through Logcat.

Demo Video

demo8.mp4

Application Overview

The application contains a single screen with:

• a username field;
• a language list containing fr, en, and ar;
• a dark-theme switch;
• a masked token field;
• buttons for saving and loading data;
• buttons for managing JSON files;
• buttons for exporting and reading an app-specific external file;
• a button for completely clearing local data;
• an area for displaying operation results.

Features

Feature	Description
SharedPreferences	Saves the username, language, and theme
apply()	Saves preferences asynchronously
commit()	Saves preferences synchronously and returns a boolean result
EncryptedSharedPreferences	Stores the token in encrypted form
MasterKey	Generates an encryption key based on Android Keystore
Internal files	Saves note.txt using UTF-8 encoding
Local JSON	Saves a list of students in students.json
Cache	Writes a temporary last_ui.txt file to cacheDir
App-specific external storage	Exports an export.txt file to the application's external directory
Data cleanup	Deletes preferences, internal files, cache files, and the external export
Security	Never displays the token in plaintext in the interface or Logcat

Project Architecture

app/src/main/java/com/example/securestoragejava/
│
├── ui/
│   └── MainActivity.java
│
├── prefs/
│   ├── AppPrefs.java
│   └── SecurePrefs.java
│
├── files/
│   ├── InternalTextStore.java
│   └── StudentsJsonStore.java
│
├── cache/
│   └── CacheStore.java
│
├── external/
│   └── ExternalAppFilesStore.java
│
└── model/
    └── Student.java

File Descriptions

File	Role
MainActivity.java	Manages the main interface and user actions
AppPrefs.java	Stores non-sensitive preferences
SecurePrefs.java	Stores the token using EncryptedSharedPreferences
InternalTextStore.java	Reads and writes UTF-8 internal files
StudentsJsonStore.java	Saves and loads a list of students in JSON format
CacheStore.java	Manages a temporary file in cacheDir
ExternalAppFilesStore.java	Exports and reads an app-specific external file
Student.java	Model representing a student

Dependency

The lab uses AndroidX Security Crypto for encrypted storage:

implementation("androidx.security:security-crypto:1.1.0-alpha06")

This dependency provides:

• MasterKey;
• EncryptedSharedPreferences.

Android Concepts

Concept	Usage
SharedPreferences	Simple key-value storage
EncryptedSharedPreferences	Encrypted key-value storage
MasterKey	Keystore-backed encryption key
MODE_PRIVATE	Storage private to the application
openFileOutput()	Writes data to internal storage
openFileInput()	Reads data from internal storage
cacheDir	Temporary cache directory
getExternalFilesDir(null)	App-specific external storage
org.json	Creates and reads JSON data
Logcat	Verifies logs for the absence of secret leakage

Stored Data

Data	Location	Sensitive?	Protection
Username	SharedPreferences	No	MODE_PRIVATE
Language	SharedPreferences	No	MODE_PRIVATE
Theme	SharedPreferences	No	MODE_PRIVATE
Token	EncryptedSharedPreferences	Yes	Encryption
note.txt	Internal storage	Non-sensitive	MODE_PRIVATE
students.json	Internal storage	Non-sensitive	MODE_PRIVATE
last_ui.txt	Cache	Temporary	Private cache
export.txt	App-specific external storage	Non-sensitive	Application directory

Applied Security Measures

The following security rules were applied:

• the token is never displayed in plaintext in the interface;
• the token is never written in plaintext to Logcat;
• only the token length is displayed through tokenLength;
• standard preferences use MODE_PRIVATE;
• secrets are stored using EncryptedSharedPreferences;
• internal files remain private to the application;
• the cache is used only for temporary data;
• external exports are limited to the app-specific directory;
• a button allows complete data cleanup;
• exceptions are handled without exposing secrets.

Tests Performed

Test	Expected Result
Application startup	The main screen is displayed
Save preferences	The username, language, and theme are saved
Load preferences	Values are restored from SharedPreferences
Save token	The token is stored in encrypted form
Load token	Only tokenLength is displayed
Save JSON file	students.json and note.txt are created
Load JSON file	The note and students are displayed
External export	export.txt is created in app-specific external storage
Read external export	The content of export.txt is displayed
Clear all	Preferences, files, cache, and external export are deleted
Logcat	The plaintext token is never leaked

Verification with Device File Explorer

After running the application, the files can be inspected using Android Studio.

Internal files path:

/data/data/com.example.securestoragejava/files/

Expected files:

note.txt
students.json

Cache path:

/data/data/com.example.securestoragejava/cache/

Expected file:

last_ui.txt

Preferences path:

/data/data/com.example.securestoragejava/shared_prefs/

Expected files:

app_prefs.xml
secure_prefs.xml

App-specific external export path:

/storage/emulated/0/Android/data/com.example.securestoragejava/files/export.txt

Screenshots

Create the following directory:

docs/screenshots/

Add the following screenshots:

docs/screenshots/01_home_screen.png
docs/screenshots/02_save_prefs.png
docs/screenshots/03_load_prefs.png
docs/screenshots/04_logcat_no_token.png
docs/screenshots/05_save_json.png
docs/screenshots/06_load_json.png
docs/screenshots/07_device_file_explorer_files.png
docs/screenshots/08_shared_prefs_secure.png
docs/screenshots/09_external_export.png
docs/screenshots/10_clear_all.png

Example README integration:

![Main screen](docs/screenshots/01_home_screen.png)
![Save preferences](docs/screenshots/02_save_prefs.png)
![Load preferences](docs/screenshots/03_load_prefs.png)
![Logcat without token](docs/screenshots/04_logcat_no_token.png)
![Save JSON](docs/screenshots/05_save_json.png)
![Load JSON](docs/screenshots/06_load_json.png)
![Device File Explorer](docs/screenshots/07_device_file_explorer_files.png)
![Secure SharedPreferences](docs/screenshots/08_shared_prefs_secure.png)
![External export](docs/screenshots/09_external_export.png)
![Data cleanup](docs/screenshots/10_clear_all.png)

Git Commands Used

git init
git remote add origin https://github.com/bgoussama/SecureStorageLabJava.git
git add .
git commit -m "Add SecureStorageLabJava Android project"
git push -u origin feature/M6-frontend

If the remote already exists:

git remote set-url origin https://github.com/bgoussama/SecureStorageLabJava.git

Running the Project

1. Clone the repository:

git clone https://github.com/bgoussama/SecureStorageLabJava.git

2. Open the project in Android Studio.

3. Synchronize Gradle.

4. Run the application on an emulator or Android device.

5. Test the following features:

   • saving preferences;
   • loading preferences;
   • encrypted token storage;
   • saving JSON data;
   • exporting to external storage;
   • completely clearing local data.

Results

The application works without an Internet connection and demonstrates several Android local persistence mechanisms.

It shows how to store standard preferences, protect a token through encryption, write internal files, manage temporary cache data, export a file to app-specific external storage, and securely clear stored data.

Conclusion

This lab validates the fundamentals of secure local persistence on Android using Java.

It highlights the difference between non-sensitive and sensitive data and demonstrates why tokens must never be stored in plaintext or displayed in Logcat.

The solution follows key security practices: MODE_PRIVATE, EncryptedSharedPreferences, no sensitive logging, private internal files, temporary cache usage, and complete data cleanup.