I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of requests to service. Service usage costs money, and client is billed monthly for his usage of service.
Now, some of clients are building mobile applications that they hand out to their users (B2C - end users). Not all of these end users of our service have servers and they wish to use service directly from the smartphone (which technically isn't big deal being JSON/REST).
The problem is I'm not sure how to protect the service against fraud. What will prevent a third party developer to disassemble one of client's mobile application and copy their username/password/whatever security credentials and use that in his application? That would allow him to consume the service and charge the usage to one of our legit clients!
I'm pretty sure there is no perfect crypto solution to this problem unless end users are mandated to authenticate to some server. But that is not always the case.
As a last resort I guess I can distribute an obfuscated library for Android / IPhone, which would at least give the illusion of security...
Let me try to simplify the scenario.
- I have an un-hackable web server which serves out a JSON REST API.
- Mobile clients access my API directly. Their IPs cannot be validated. They are running a standard OS (Android / IOS).
- There are no other servers involved.
- I cannot access the phones' IMEI (it is considered private), nor would this help me because I don't know the end users.
- There are several such legal mobile applications, developed by different companies that access our API.
- Current security (username/password) is easily hackable by rogue company. Said rogue company disassembles a legit mobile application and copies the username/password to their illegal application. They distribute this application and profit (API usage is charged to the company from which they stole the credentials).
Can this be stopped?