Read and Write Confidential Data in Standalone Application

R2026b
Since R2026b

This example shows how to build an application that uses the encryptingURL function to perform I/O operations on encrypted data files.

The encryptingURL function requires a secret to encrypt files. At run time, the application retrieves the secret value and uses it to encrypt the I/O file operations using the AES-256-GCM encryption algorithm. The secret can be embedded in the application code archive or stored as an environment variable.

  • To set a fixed secret at compile time, embed the secret in the deployable archive using a secret manifest file.

  • For cases requiring flexibility, such as allowing the end user to set a password, store the secret as an environment variable on the end user machine. The environment variable name must match the secret name.

For more information on using secrets in deployment, see Handle Sensitive Information in Deployed Applications.

Write MATLAB Code to Deploy

Write MATLAB® code to package into a standalone application.

For example, save the following MATLAB code as secure_compare.m. The application compares the integer input n to the previous input value, which is stored in an encrypted MAT file, and logs the full comparison to an encrypted log file. The application displays the result of the comparison (higher, lower, or equal) without revealing the previous value.

The encryptingURL function creates secure paths to the encrypted log file and MAT file using the secret named secure_compare.password. You can use the paths to perform encrypted MATLAB read and write operations on the files. When you write data to a location using the encrypting URL, the write operation creates an encrypted file in that location if one does not already exist.

%   secure_compare(n) Compares integer n to prev_run stored in prev_run.mat
%   Output displays one of:
%     "Equal"   - if n == prev_run
%     "Higher"  - if n > prev_run
%     "Lower"   - if n < prev_run
function secure_compare(n)

if ~isscalar(n) || ~isnumeric(n) || n~=floor(n)
    error("Input must be an integer scalar.");
end

% Create encrypting URL for log file
logpath = fullfile(pwd,"secure_compare.log");
eLogpath = encryptingURL(logpath,"secure_compare.password");

% Create encrypting URL for MAT file
matpath = which("prev_run.mat");
eMatpath = encryptingURL(matpath,"secure_compare.password");

% Open log file for appending
[fileID,errmsg] = fopen(eLogpath,'a');
if fileID == -1
    error('Failed to open log file: %s because of: %s',eLogpath,errmsg);
end
cleanupObj = onCleanup(@() fclose(fileID));

% Attempt to load prev_run
if exist(eMatpath) == 2
    S = load(eMatpath,'prev_run');
    prev = S.prev_run;
else
    prev_run = n;
    save(eMatpath,'prev_run');
    disp("No previous run found. Saving current input");
    fprintf(fileID,'No prev_run found. Saving input %d as prev_run\n\n',n);
    return;
end

if n == prev
    disp("Equal");
    fprintf(fileID,'Result: Input %d is equal to previous run %d\n',n,prev);
elseif n > prev
    disp("Higher");
    fprintf(fileID,'Result: Input %d is higher than previous run %d\n',n,prev);
else
    disp("Lower");
    fprintf(fileID,'Result: Input %d is lower than previous run %d\n',n,prev);
end

% Update prev_run to current n
prev_run = n;
save(eMatpath,'prev_run');
fprintf(fileID,'Overwriting prev_run %d with input %d\n\n',prev,n);
end

Create Encrypted Data to Deploy with Application

You can use encryptingURL outside of deployment as well, for instance, to create encrypted data and package it along with the application.

For this example, to give the application an initial value of 5, create an encrypted MAT file using the secret secure_compare.password and the encryptingURL function.

At the MATLAB command prompt, create the secret using the setSecret function.

setSecret("secure_compare.password")

Use the Secret Prompt dialog box to set the password value and add the secret to your MATLAB vault.

Next, create an encrypted MAT file using encryptingURL and the secret secure_compare.password. Save the initial value of 5 to the encrypted file.

matpath = fullfile(pwd,"prev_run.mat");
eMatpath = encryptingURL(matpath,"secure_compare.password");
prev_run = 5;
save(eMatpath,"prev_run");

When you call the save function using an encrypting URL, the generated MAT file is encrypted.

(Optional) Embed Secret in Deployable Archive

You can choose to embed the secret in the application deployable archive or store it as an environment variable on the target machine.

To embed a secret in the archive, create a secret manifest file named secrets_manifest.json that specifies which secrets in the MATLAB vault to embed. For this example, embed the secret named secure_compare.password.

To prevent an environment variable from overriding an embedded secret, specify the secret name in the EmbeddedNoOverride section. (since R2026a)

{
     "Embedded": {
       "description": "All secret names specified in this section will be put into the deployed CTF.",
       "secret": []
     }, 
    "EmbeddedNoOverride" : {
      "description": "All secret keys specified in this section will be put into the deployed CTF and can NOT be overridden by the external environment.",
      "secret": ["secure_compare.password"]
    }
}

Build Standalone Application

Package the code into a standalone application using the compiler.build.standaloneApplication function. Include the MAT file using the AdditionalFiles option. Optionally, to embed the secret in the archive, use the SecretsManifest option and specify the JSON secret manifest file.

br = compiler.build.standaloneApplication("secure_compare.m",...
     AdditionalFiles="prev_run.mat",...
     SecretsManifest="secrets_manifest.json",...
     TreatInputsAsNumeric=true);

The function generates a standalone application named secure_compare in the folder secure_comparestandaloneApplication. The file extension depends on the platform used to generate the application.

Note

The generated standalone executable does not include MATLAB Runtime or an installer. To create an installer that installs the application and MATLAB Runtime, use the compiler.package.installer function.

Run Application

You can test the application in MATLAB using the system command syntax. Navigate to the folder that contains the application executable.

The first time you run the application, it creates an encrypted log file in the current folder.

!secure_compare.exe 5
Equal

!secure_compare.exe 8
Higher

!secure_compare.exe 3
Lower

To read the encrypted log file, use the encryptingURL function to create a secure path to the file.

logpath = fullfile(pwd,"secure_compare.log");
eLogfile = encryptingURL(logpath,"secure_compare.password");
type(eLogfile)
Result: Input 5 is equal to previous run 5
Overwriting prev_run 5 with input 5

Result: Input 8 is higher than previous run 5
Overwriting prev_run 5 with input 8

Result: Input 3 is lower than previous run 8
Overwriting prev_run 8 with input 3

To run the application on another machine, you must install MATLAB Runtime at the same update level or later. For more information, see Download and Install MATLAB Runtime.

See Also

| | | |

Topics