2

How would you protect Python source code on a physical product (like a IoT device), which comes with Ubuntu installed on a mini-PC running Python code?

Few methods we thought about:

  1. Compiling the Python code (using PyInstaller, or other products).

  2. Obfuscating the source code.

  3. Linux-permissions-based solution: Configure a low-permissions user that can't even access the code, and the code running from a different user using the weak user's display.

  4. Any other idea?

  • If they have access to the physical device, linux permissions won’t help unless you can physically keep them from reading the raw data storage. Some micro controllers allow you to protect the ROM from reading externally after burn-in, but I’m not sure if any would support python like this. – nbering Jul 7 '18 at 14:23
  • Can you elaborate on what you mean by "protecting" the source code. Do you mean preventing it from being viewed? Modified? Copied? – Mr. Llama Jul 9 '18 at 17:23
2

Anything you do to obfuscate your code is a waste of time. It can be reverse engineered and I promise you anyone that wants your intellectual property will take the time to deobfuscate it.

One solution you might look at is http://cython.org. Cython converts your python into C so that it can then be cross compiled for each platform natively. If you want to hide your code this is your best bet. I know of at least two companies doing this for production python code.

  • 3
    Obfuscating your code is not a waste of time. Obfuscated code sets a minimum skill level that the attacker needs to meet to deobfuscate your code and requires more time to reverse engineer it. It won't protect your code but hopefully the attacker decides it's not worth to spend so much time time reversing it – Mr. E Jul 7 '18 at 15:58
  • 1
    Coming from my experience obfuscation is security through obscurity. The bar to deobfuscate is low and there's tools that'll do it for you. Compiled c code however is a nightmare to reverse engineer and is a realistic solution. – Anthony Russell Jul 7 '18 at 16:12
0

Well it’s subjective…

Physical security is a must as anyone can copy the content if they get access to the IoT device (removing SD Card or retrieving content would be easy).

I believe compiling the code could extend your chances of preventing stealing but that can also be cracked with effort/replicate.

Most of the IoT codes may not fall under intellectual property (If I’m not wrong) but can be categorized under copy right/license. Hence going for legal protection (against replica) would be the best solution for your concerns. If you can prove your code is licensed properly then you can claim against stealing and reusing the code.

Hope this answers your concern.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.