如何保护 .NET DLL 的安全
保护您正在从事的项目的 DLL 的最佳实践是什么？我有兴趣开发的某些 DLL 将具有数据访问层 (DAL) 和业务逻辑层 (BLL) 功能。可能有多个应用程序最终可以访问这些 DLL 来执行特定于业务的功能。
保护这些 DLL 以便它们只能由创建者的应用程序使用的最佳方法是什么？
阻止未经授权使用 DLL 的安全性和防止可能的反编译的安全性都是可取的。
What is best practice for securing DLL's for projects you are working on? Certain DLL's I am interested in developing will have data access layer (DAL) and business logic layer (BLL) functionality. There may be several apps that can eventually hit these DLL's to perform business specific functions.
What is the best way to secure these DLL's so they can only be used by only creator's applications?
Security for both blocking unauthorized use of the DLL's and security against possible decompilation are both desirable.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
一种选择可能是将 DLL 中的所有公开类标记为“内部”而不是“公共”，然后使用 "InternalsVisibleTo" 属性用于显式命名允许使用内部类型的 DLL（可能还包括 exe）。这可能要求所有参与者都被命名为强名称，但无论如何这是一件好事。
最终，当您的代码在黑客的机器上执行时，没有绝对的方法可以阻止坚定的黑客访问您的代码。所有可以由机器执行的代码都可以通过足够先进的工具和经验来分解和重新组装成其他东西。
实现代码安全的最佳方法是问这样一个问题：“我们希望让某人在未经许可或授权的情况下使用此代码有多困难，以及我们愿意花费多少时间/金钱来实现这一目标？”如果您什么都不做，那么其他人很容易在其他项目中使用您的 DLL。如果您做一些简单的事情，就可以使其他人在其他地方使用您的 DLL 变得不方便。如果您投入数月的努力，您可能能够使某人很难滥用您的代码，但您永远无法使其成为不可能。
我能想象到的一种接近绝对安全的技术是：根本不要在客户端（或黑客）的机器上执行代码。相反，运行 Web 服务，并将代码保存在服务器上，这样黑客就无法随意在您的进程上启动调试器或反汇编您的代码。然后，您的代码安全性由服务器位置的物理安全性和服务器端口的网络访问安全性来定义。这些攻击向量比您对在黑客机器上执行的代码所做的任何事情都难以规避许多数量级。
对于一些软件公司来说，将部分应用程序从客户端迁移到云端并不是为了获得更好的可扩展性、更容易的更新或更低的成本，而是为了代码安全和防止盗版。
One option might be to mark all the exposed classes in your DLL as "internal" instead of "public", then use the "InternalsVisibleTo" attribute in your DLL to explicitly name the DLLs (and possibly exes) that are allowed to use your internal types. This may require all participants to be strongnamed, but that's a good thing to do anyway.
Ultimately, there is no absolute way to prevent a determined hacker from accessing your code when your code is executing on the hacker's machine. All code that can be executed by the machine can be disassembled and reassembled into something else with sufficiently advanced tools and experience.
The best way to approach code security is to ask the question "How difficult do we want to make it for someone to use this code without license or authorization, and how much time/money are we willing to spend to achieve that?" If you do nothing, it's very easy for someone to use your DLLs in some other project. If you do a few simple things, you can make it inconvenient for someone to use your DLLs elsewhere. If you invest months of effort, you might be able to make it very difficult for someone to misuse your code, but you can never make it impossible.
One technique that is as close to absolutely secure as I can imagine is: don't execute your code on the client's (or hacker's) machine at all. Run a web service instead, and keep your code on the server where a hacker can't casually fire up a debugger on your process or disassemble your code. Your code security is then defined by the physical security at the server location and network access security to the server's ports. These attack vectors are many orders of magnitude more difficult to circumvent than anything you can do to code that executes on the hacker's machine.
For some software companies, moving a portion of their applications from the client to the cloud isn't about getting better scalability or easier updates or lower costs, it's about code security and piracy prevention.
使用开放密钥机制建立身份验证。仅当您提供有效的密钥和令牌时，DLL 中的函数才会起作用。
Establish authentication using Open Key mechanism. The functions in the DLL will only work if you supply a valid key and the token.
如果有人可以访问包含所有这些程序集的机器，那么您比重复使用它们的人更需要担心，他们可以直接访问数据库而不是使用您的程序集。
如果这是一个桌面应用程序或其他应用程序，并且您直接访问数据库，那么您需要重新考虑您的应用程序，通过 Web 服务或其他方式访问数据，而不是直接访问数据库。
If someone has access to the machine with all those assemblies, you have more to be worried about than someone reusing them, they could just go directly to the database instead of using your assembly.
If this is a desktop application or something and you're accessing the database directly then you need to re-think your application, access the data via web services or something rather than going directly to the database.
如果您以 .NET DLL 的形式将知识产权发送给客户端，那么保护您的知识产权实际上是不可能的。您可以在云中托管应用程序逻辑，但这可能不适合您的场景。
即使是“最好的”混淆器也不是绝对正确的。您可能会阻止一个偶然的黑客，但正如 dthorpe 所说，如果有人真的想反编译您的程序集，他们就会这么做。
Protecting your intellectual property is not really possible if you ship it in the form .NET DLL's to a client. You could host your application logic in the cloud, though that might not suit your scenario.
Even the "best" obfuscators aren't infallible. You could probably put off a casual hacker, but as dthorpe says, if someone really wants to decompile your assemblies, they will.