-1

I would like to know is there any update about protecting DB Structure? We deliver a licensed app that uses SQL as its main DBMS and we would like to lock the database structure (schema).

I know I can encrypt the data it self and stored procedure ...etc. I want the best practice to encrypt/Secure/ Lock the data structure and relation from end client DBA.

I have access to the end client physical server as we make the app installation and repair.

The app is written in C# using linq to sql

The fear is reverse engineering the solution (and it already happened once) using the database scheme. so we need to run our app in a secured environment and it is using only local DB.

Microsoft is not providing this function as per: https://docs.microsoft.com/en-us/sql/relational-databases/security/protecting-your-sql-server-intellectual-property?view=sql-server-2017

  • Could you edit the question and add more details? What kind of "attacks" you are worried about? What things you'd like to prevent and what would happen if those would happen anyway? You might need attack surface analysis and that would be better on-topic at Security.Stackexchange site. – vonPryz Aug 7 '18 at 8:06
  • The fear is reverse engineering the solution (and it already happened once) using the database scheme. so we need to run our app in a secured environment and it is using only local DB. – Karim Aug 7 '18 at 8:09
  • If you are handing the database to customer, there is little if anything to stop them. Can you move the DB in, say, Azure cloud instead? See this SO question too. In addition, have you thought about .Net decompilation as an attack vector? – vonPryz Aug 7 '18 at 8:16
  • We can't use Azure as client site doesn't have internet connection. Is there a way to deploy it locally ?! – Karim Aug 7 '18 at 8:25
  • This is really a question for your lawyer. Most of us are not copyright experts though you do have rights. You can add comments or descriptions to objects to reference its origin. You could always encrypt the database and only allow access through the app? Honestly the people who violate your trust should be sued. – clifton_h Aug 7 '18 at 17:02
5

I would like to know is there any update about protecting DB Structure?

The short answer is there has been no change, it's a fool's errand.

I want the best practice to encrypt/Secure/ Lock the data structure and relation from end client DBA.

Using SQL Server, there isn't one. If you want to do this, make something wholly propriety for the data layer.

The fear is reverse engineering the solution (and it already happened once) using the database scheme.

Then this should be solved via litigation or by changing the data layer to something less well known or propriety. I hate security through obscurity as it doesn't work, at all, so propriety will work so long as no one really cares to reverse your code or attach a debugger.

Here's the problem you're going to continue to face, no matter what - propriety, encrypted, or whatever... The other party owns the hardware and thus can duplicate the hardware/software and then attach a debugger to it and see whatever they want. That's up to you to weigh the options of picking and choosing protection schemes.

SQL Server Administrators can see everything in the database (schema wise) and can easily take over the instance if the hardware owner does not have an administrative login (again they own the hardware). Database users that have enough permissions can see the schema. In fact, just using your application the user could guess most of the schema, let alone if you have any areas for input that they could abuse to find out more information.

so we need to run our app in a secured environment and it is using only local DB.

If they own the hardware, this is impossible as the environment is no longer secured.

We can't use Azure as client site doesn't have internet connection.

This means you also can't host it on premises, it's only available on theirs - so again, nothing you can really do that it's so above and beyond that it would add a large financial and technical burden into your software.

TL;DR;

Nothing you can really do, use litigation as a means to deter or financially ruin those who violate the rules.

  • They could copyright their designs, though, with added documentation. This would help enforcing said litigation easier. See Atlassian’s JIRA – clifton_h Aug 7 '18 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.