2

The question title is... ugly to say the least. Here's an overview of what I've got:

  • I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back.
  • The tool is sold to organisations who want to include the functionality in their public websites and apps for their customers to use. The tool remains on our servers (no client has access to the code or binaries)
  • I need to stop unauthorised organisations using the tool in their sites and apps.

Inside a browser, authorisation is easy; I simply check the ORIGIN header when requests are made and all is good (individual users hacking their headers isn't important).

In apps it's a different story. First, I need to prevent applications simply using the browser interface (or rather, make the browser interface the same as the app interface), then I need to use keys or similar to authorise allowed clients.

I realise that no matter what authorisation I put into the apps, it can always be hacked out because they're public, but this can't be a unique situation, so I'm wondering what solutions have already been developed. (Since I have limited knowledge of security terminology it's proven hard to search for!)

Improve this question
2
  • Perhaps you could look into OAuth.
    – Adi
    Commented Mar 21, 2013 at 1:41
  • @Adnan I did, but I couldn't see how it provided any extra security in this situation; as far as I can see a hacker could just forward requests for authentication to a legitimate client's server.
    – Dave
    Commented Mar 21, 2013 at 1:47

1 Answer 1

Reset to default
1

Your question is essentially one about DRM.

I can't really make out one important fact about the tool. Is this tool hosted on your own servers or your clients servers?

If the tool is hosted on your own servers, this makes the situation a lot easier. Setup a authorization system based on API keys and only allow clients to use the tool if an accepted API key is sent in the request. In this scenario, you have to ensure that none of the relevant (data processing) portion of the code is in the hands of the client.

If the tool is hosted on your clients servers, the API key system still works. Have a functionality that allows the clients to generate and revoke API keys to allow them access into that particular instance of the tool.

If your question is how to prevent unauthorized organizations on installing your tool in their own servers, this problem is probably difficult to solve technically. You might want to rely on legal contracts to prevent authorized organizations from leaking your code.

Improve this answer
1
  • I updated the question. The tools is on our servers, and clients simply send requests to it (in the web version, a piece of javascript code sends AJAX requests with data and receives the results). As for API keys, anybody could listen-in to a legitimate communication (or look at the javascript code, or strings in the executables) and extract the key. I know this is theoretically impossible to secure, which is why I'm looking for the current accepted (practical) solution.
    – Dave
    Commented Mar 21, 2013 at 12:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .