1

I have a jar file that has some business critical functionality. Keeping this logic safe and preventing unauthorized usage of this jar is very important to me.

To achieve this, I have obfuscated the code before packaging it in the jar which provides some security against reverse engineering the logic by an unauthorized user.

Now I want to make sure that no unauthorized person is able to use the jar even if they get access to it. Currently, I am planning to have a root CA in my jar and issue certificates from the same CA to all the authorized consumers. Authorized users will pass this certificate in the code and it would be trusted using chain of command of certificates. Unauthorized parties wouldn't be able to use the jar since they wouldn't have these certs.

Is there any better way of doing this? Is there any problem with this solution?

4
  • 2
    If Keeping this logic safe and preventing unauthorized usage of this jar is very important to me. then you better not distribute the jar file. Nov 3, 2015 at 4:46
  • That's not very useful I suppose. I am looking for the safest way of distributing it. It would be given to authorized people only. Looking for a way to make it as secure as possible. So do you think the suggested solution is useful. Do you have any better suggestion? Nov 3, 2015 at 5:33
  • 2
    No matter how much obfuscation and confusion you throw into your program, in the right hands it will be read as through it was accompanied with full source code and a book's worth of documentation and explainations. Always assume whatever programs you release will be fully understood by malicious parties.
    – haze
    Nov 3, 2015 at 5:59
  • Distribute the jar with your own tivo-ized hardware, or provide its services from a remote server that you control. Nov 3, 2015 at 17:53

1 Answer 1

5

if you ship a program (which includes JAR files) you effectively loose control. This program can be copied, analyzed, modified etc. The only thing you can do is to make such things harder by obfuscating code or similar techniques. How hard you need to make it depends on the value of the things you need to protect.

If you cannot risk a disclosure of your secret business logic or if you cannot risk that this logic gets modified then don't include it into the program. Instead you might have some kind of online API and the application needs to contact your server with the data and get the result back - and all the critical parts are kept outside your program and fully within your control.

1
  • Just to add, you could also write an API in C with limited functionality exposed to the JNI. Strip the symbols, limit strings, and the SRE will be significantly more difficult. Not impossible, but definitely harder than using a JAR.
    – RoraΖ
    Nov 3, 2015 at 15:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .