Is it possible to effectively protect/encrypt intellectual property that is on the client side?
Assume that I am selling a product (software) to clients, that contains intellectual data, for example malware signatures in the case of an antivirus product. What I do not want, is competitors to get my end-point solution and extract the valuable data for their benefit.
How do companies tackle such a scenario? Or does this problem have a solution at all?
I assume that the basic approach requires encryption of the data while on the disk. Of course the decrypted data (part of them) and the key for decryption are in RAM at some point, which means that access to RAM means access to the data eventually, so for this scenario lets assume that we do not care about the RAM issue and we only care about data at rest.
So assuming that I decide to encrypt my data on the client side. My problem is the handling of the encryption/decryption key:
If the key is in the appliance/code (hardcoded, file, etc) then eventually it will be exposed by reverse engineering. If I have access to the Internet maybe I can create a complex PKI scheme to lets say decrypt the data on Server side and send them back to the client. But maybe this is not a given (you would expect an antivirus to work without Internet connection even with old signatures), or has very expensive performance.
How can someone effectively resolve this?