How to protect my functions which will be called by other programmers?

I have some Matlab functions stored in my computer. Other people will call those functions from Matlab in their computer. However, I don't want them to see my codes or copy the files of my functions for some reasons. Are there any solutions for this?

[Simon Li]

Is DCOM a good choice?

Answer 1

[Image Analyst]

See this MathWorks link for a full discussion of protecting your source code by deploying as p-code.

[Simon Li]

Thanks. If they copy the P-code file, they still can run it on their computer. Is there any way to prevent them from copying the files?

[Walter Roberson]

If they have access to the system the files are stored on, then in order to execute the .p then MATLAB needs read access (not "execute" access) to the .p files. That being the case, if the people have enough access to MATLAB to be able to copyfile() or fopen() then they could potentially take copies of the files. You would have to put them inside some kind of walled garden that did not permit them to write any new files anywhere.

[Image Analyst]

You don't even need MATLAB - you could copy files just by using the operating system. But , if they're encrypted into p-code, what does it matter if they do?

[Simon Li]

I want to protect not only the source but also the application. With copies of p-code, one can build another application easily.

[Walter Roberson]

This is not something that MATLAB can help you with directly. MATLAB needs operating system "read" access to .m files, .p files, and appropriate shared objects such as .dll (Windows) or .mexw64 (Windows) or .so (Mac or Linux) . If users of your program have access to the command line of the operating system or to the operating system file browser or to remote copy utilities, then they would typically gain access to the implementing files as well.

There are secure versions of Linux under which it might be possible to tie a program (such as MATLAB) to an access token that is required in order to access the implementation files, making the files not readable through command line or file browser and so on. However, if the person is executing MATLAB and has access to the command line, then because they would be executing inside the program with the access token, they would be able to command copying of the implementation files.

There is MATLAB Compiler, which can create executables (such as .exe for Windows) which would make it difficult to gain access to the implementing files in any useful way (the user can see them but only in encrypted form), but there would still be the issue of whether the user could copy the executable, which is an operating system matter. Some operating systems do provide permission mechanisms that can permit execution of an executable without the user being able to directly open or copy the contents.

.... but basically in order to be sure of protecting your source, what you need to provide is a remote access mechanism such as a web based site that executes on behalf of the user, with the user able to use whatever interface you provide but unable to get to the implementation. The MATLAB Compiler SDK can help create web based applications.

[Simon Li]

Thanks. The MATLAB Compiler SDK can create API used by other languages(says C) to access my application in remote server. However, those languages do not include MATLAB. Hence, the client developers who also uses MATLAB as develop environment cannot call the API directly. Since I have too many functions in that API, there will be a lot of work to do. Is there a simple way to do this?

[Walter Roberson]

You can provide a .h file and a shared object such as a .dll, and have them calllib(), with your shared object making https connection to the remote server. You would have to copy or serialize the data and send it to the remote system.

Or you could provide a series of .m or .p functions that use tcpclient() to make https connection to the remote server. You would have to copy or serialize the data and send it to the remote system.

In theory, DCOM permits remote execution (if I recall correctly), but I suspect that would be a pain to get right and configure on all sides; https://www.cybereason.com/blog/dcom-lateral-movement-techniques

Answer 2

[Stephen23]

Two steps:

1. write your function so that at the start it checks something that only you know about: e.g. your username in the absolute filepath, or the content of a file somewhere. If the check fails, return.
2. convert to p-code.

Unless they manage to read your mind it is unlikely that they will know what you are checking.