如何使公共静态类“安全”？

Question

I'm looking to create a secure wrapper for a public class with public static methods, so let's say the class is very simply:

public class MyClass {
      public static int Add (int first, int second)
      {
          return first + second;
      }
}

I want to have a client needing to access this via some secure other class that will call MyClass. At the end of the day I'm expecting to have all this code in a single dll for clients to use. The intention is to have some behaviour like:

public class SecureMyClassWrapper
{
    bool _isUnlocked;
    private static readonly List<string> validIds = new List<string>(){"only me", "and them"};

    public SecureMyClassWrapper(string id)
    {
        if (validIds.Contains(id))
        {
            _isUnlocked = true;
        }
        else
        {
            _isUnlocked = false;
        }
    }

    public int Add(int first, int second)
    {
        if (_isUnlocked)
        {
            return MyClass.Add(first, second);
        }
        else
        {
            // throw security exception etc.
        }
    }
}

There's a fair possibility that someone with more hacking ability than me is going to want to get at my static methods, so please can somebody suggest why this might be a bad approach or what I should be concerned about here? Some ideas would be that

• MyClass methods can easily be called through reflection
• somebody could ildasm.exe code, change the list of validIds or _isUnlocked logic (or even their values at runtime?)
• possible to read a valid ID and then use it as their own

How could I guard against reflection or decompilation in these cases? Is there a standard approach for this you would recommend, eg Code Access Security?

Answer 1

Host the code you want to protect in a service run on another machine. And expose the api with a Interface.

Answer 2

The only way to protect your .Net code is to use an Obfuscator . However it only does so much so it is still crack-able. Even non-.Net code is easy to crack, to have its heaps and stacks altered etc. usually for the purpose of bypassing electronic registration process with commercial software.

If you're dealing with some very sensitive code you can always put it on a cloud server but of course that implies monthly costs. In that case you may also want secured traffic (https) which is just as costly.

Ultimately, you would have to do a cost vs. benefits consideration when dealing with your code's security. It is always best practice to write your code in such a way that it can be open-source and still not compromise your users security or data.

Answer 3

You should mark the functions on MyClass as internal . This means only code in the same assembly can call these methods (ie. your "safe" Public methods)

For example:

internal static int Add (int first, int second)
{
    return first + second;
}

See this: https://msdn.microsoft.com/en-us/library/7c5ka91b.aspx