0

How can we secure a source code which is deployed at client side cloud and is difficult to reverse engineer just like a licensed product The major difference is that I have a service to protect and do not have exe or dmg file.

I want to obfuscate the code deployed at the client side which was an internal API service till now but will be white-labelled and deployed away from my access. The usual methods to obfuscate isn't the ones feasible to opt for an always evolving code. The deployment needs to be scalable, updatable which is why container tech is preferred. However, container security is not my forte and I have read from different blogs that it involves user access management only which cannot 100% guarantee security.

2
  • Welcome. Please clarify what is it you're actually wanting to protect? The code itself, or the API end-points?
    – brynk
    May 17 at 8:02
  • The code itself. I want to protect the code which was serving as an API till now but will be given away as a product in future.
    – Mudra
    May 18 at 5:40
4

Accept that you can't do it...

If you deploy a container (that needs to be accessible and re-bootable by the client, 101 times out of 100) then the container's contents is at the complete mercy of whatever containerization technology will have been adopted.

Either you can trust your client, or you cannot. If you cannot, then nothing stops them from cloning the container and either access its storage (if unencrypted; but if you encrypt it, you'll have to be available at each reboot) or pin the container memory and read the source off it. Almost always, the latter approach is available even without cloning, and containerization technology means that the application is not aware of what is happening, and has no way of detecting or stopping it.

All protection schemes in these cases rely on something that the client has not access to. You need to ask, "is there something - before I give them the container - that the client has not access to?". If the answer is "No", then you can stop right there (if it is "Yes", then you need to ask, "and do I have access to that?"). Hardware keys, for example, is something the client hasn't access to. External keyservers are also something they don't have access to. Third-party PAAS services also. Android "secure space", to a large extent. So, what you ask can be done in principle, but very probably, not in your scenario.

...and move on.

Now, unless you're doing "jobsecurity through obscurity", there's an overwhelming chance that your code will be something complex, probably difficult to maintain for somebody unfamiliar with it, and will contain nothing embarrassing or unprofessional.

So, your target becomes simply to be cheaper than just stealing your work. This can be done in several ways, starting from making it clear than stealing from you now will mean not simply renouncing to the next few fixes (which someone might be willing to accept), but to any and all maintenance. This you can do by calculating e.g. the hashes of your code units, and verifying them to ensure they haven't been tampered with -- in which case you will charge for the restoration or for your reverse engineering any changes.

1
  • This is for the company and not job security. So, what you mentioned in the first part is what I will have to accept. Thanks a ton for your response.
    – Mudra
    May 18 at 5:35
1

Unless you do this in a SaaS fashion, your software cannot be protected.

If the client have access to your software, no matter if encoded, obfuscated or encrypted, this client CAN decode/deobfuscate/decrypt it. That's not a question of if, but when. That's a tradeoff between time and money. If it's lucrative to them to crack your defenses, they will.

You mention private API. And that means the client could proxy all requests from the container, and deduce the methods used for your API. Depending on how your software is built, the client does not even need access to the container.

1
  • Understood. You've got a point. Thanks !
    – Mudra
    May 18 at 5:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.