Encrypting intellectual property on client side

Question

Is it possible to effectively protect/encrypt intellectual property that is on the client side?

Assume that I am selling a product (software) to clients, that contains intellectual data, for example malware signatures in the case of an antivirus product. What I do not want, is competitors to get my end-point solution and extract the valuable data for their benefit.

How do companies tackle such a scenario? Or does this problem have a solution at all?

I assume that the basic approach requires encryption of the data while on the disk. Of course the decrypted data (part of them) and the key for decryption are in RAM at some point, which means that access to RAM means access to the data eventually, so for this scenario lets assume that we do not care about the RAM issue and we only care about data at rest.

So assuming that I decide to encrypt my data on the client side. My problem is the handling of the encryption/decryption key:

If the key is in the appliance/code (hardcoded, file, etc) then eventually it will be exposed by reverse engineering. If I have access to the Internet maybe I can create a complex PKI scheme to lets say decrypt the data on Server side and send them back to the client. But maybe this is not a given (you would expect an antivirus to work without Internet connection even with old signatures), or has very expensive performance.

How can someone effectively resolve this?

Answer 1

If your data at any point is in plaintext on user’s machine – you can’t secure it. You can do many things to protect it, but this would only slow down a dedicated attacker: obfuscating source code, encrypting data at rest, rotating encryption keys on server, etc. This is the territory of DRM, and there are many companies that will sell you their solutions.

Every DRM system would sooner or later be broken (if your product is worth it), game piracy shows this pretty well. Also, as you’ve pointed out, any strong defense like server-side crypto would be inconvenient for users (and probably expensive four you). I propose that valuing UX over IP protection would offer a much bigger competitive advantage than having an unusable app with close-to-perfect IP protection.

GitHub is a good example. The source code of the self-hosted enterprise version is encrypted at rest with a pass phrase "This obfuscation is intended to discourage GitHub Enterprise customers from making modifications to the VM. We know this 'encryption' is easily broken.". And despite having a large chunk of source code for github.com available to every enterprise customer, they’re still in business. Offering useful service was better for business than stringently protecting IP.

There are some other ways to protect against IP theft by your competitors. One classical technique is called “Paper Towns”. Since the maps of the same area would look very similar, cartographers started to put fake towns on their maps, and if your fake town shows up in the competitor’s map then you’ve got the proof of IP theft. Even google maps does this. Recently genius.com has shown that the lyrics in google’s search result were scraped from their site by encoding a message in alternating kinds of quotation marks in the lyrics.

You can protect antivirus signatures in an analogous way: by including some signatures of a fake viruses, and periodically scanning these fake viruses with the antiviruses of your competitors.

Answer 2

How can someone effectively resolve this?

You can't.

If you store the symmetric key on the client, it will be read there. If you send it over to a server for decryption, the network traffic will be sniffed for the decrypted data. Also, you should not discount the RAM issue. Snatching data from RAM is complicated, but not prohibitively so if the reward is big.

Simply put, you can not let the computer know the secret without also letting the human who owns the computer know it.

You can obfuscate and make it harder for your competitors. But if the value of what you are hiding is high enough, you will not be able to make deobfuscation costly enough. Probably, what you need is not an engineer but a lawyer.

See Andrew Morozkos answer for a great method for detecting IP theaft, so you know when to use that lawyer.