Web Application Code Protection via Device-Bound Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web-based applications face challenges in code protection, as accessible code can be stolen or pirated, leading to unauthorized use and reuse by competitors, despite existing encryption methods being vulnerable to capture and reverse-engineering.
Innovation Solution
A method and system that apply two layers of code transformation: obfuscation and encryption to web-based applications, using device and non-device parameters to generate a protected version that can only be executed on the correct client after successful decryption, incorporating obfuscation techniques like device identifier obfuscation and symmetric or asymmetric encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code is encrypted using a random key or hash key before transmission, then code security is improved, but the code can still be captured and installed on any other client after decryption
Solution Approach 1:
The patent applies dynamic code generation where the encrypted code is transformed based on device-specific parameters. The code structure and encryption keys change dynamically according to the target device characteristics, making captured code useless on other devices. This resolves the contradiction by maintaining security while preventing unauthorized installation through dynamic adaptation.
Solution Approach 2:
The patent binds the encrypted code to specific local device properties such as hardware identifiers, device type, or configuration parameters. Each device receives code encrypted with keys derived from its unique characteristics, creating localized security bindings that prevent the code from being installed on unauthorized devices even if captured.
2Ease of operation
If code is made accessible in clear text for web-based applications, then ease of operation and platform compatibility are improved, but code protection is worsened
Solution Approach 1:
The patent performs preliminary encryption of the code before it is made accessible to clients. The code is encrypted with device-specific keys and parameters before transmission, so while it remains accessible in a readable format for web-based execution, it is protected against theft and reuse. This resolves the contradiction by maintaining platform compatibility while preventing code piracy through pre-encryption.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for generating a protected version of the digital content is disclosed. The method includes obfuscating the digital content to yield a functionally equivalent obfuscated digital content, encrypting the obfuscated digital content using at least one device or non-device parameter, generating a decryption logic to be used for generating a decryption key based upon the at least one device or non-device parameter, and concatenating the encrypted digital content and the decryption logic to generate the protected version of the digital content.