How can I protect my ASP.Net Source Code From My Developers How can I protect my ASP.Net Source Code From My Developers asp.net asp.net

How can I protect my ASP.Net Source Code From My Developers


You could have the dll check its environment and fail to work (I suggest you make it give wrong results rather than break) if the environment does not feel like home. You will also have to obfuscate the code to hamper efforts to remove the protection.

Edit: you could use an environment variable, registry key, existence of a performance counter, an obscure setting in machine.config, etc., and make it look like a genuine setting, then obfuscate and sign with a strong name.


This may not be appropriate to your situation but you could provide them with a proxy DLL which doesn't perform the calculations but instead calls your DLL.

You then keep your DLL on another server that only you have access to and the proxy DLL calls it via some sort of remoting protocol.


That is a weird position to be in... my condolences.

At the .Net level, the best you can do is obfuscate your code when you build it. Strongly signing your assembly will let you know if tampering is going on as well.

Another approach that some people have taken is to write the really sensitive code in C++ and compile it to an unmanaged .dll, and call into it from .net using interop. C++ bytecode is much harder to read than IL, and this throws up a lot more barriers to easy reverse-engineering.

Edit: based on comments from the OP, here is an updated answer.

If you're simply worried about them stealing the DLL that you place in the bin folder on your web server, simply publish it to a subfolder of \bin, lock the folder down using windows permissions, so there is no way they can get into it, and change your web.config to probe it.

<runtime>   <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">      <probing privatePath="bin;bin\mysubfolder;" />   </assemblyBinding></runtime>

Definitely make sure to strongly name the .dll, and keep your private key file somewhere safe. That makes your .dll uniquely identifiable and tampering can be detected if they do get at it.