0

The current task is as follows: It's about publishing spreadsheet tables online and making them accessible only to registered subscribers. The access to these spreadsheets is meant to be a paid service. Subscribers may access them online from wherever they are and do their calculations related to expenses or working hours and so on. These spreadsheets are developed in MS Excel. They are then converted into HTML/Javascript files via a macro app. The resulting Javascript code contains all the important formulas which need to be protected.

I know about Javascript "obfuscation" and scrambling" but would like to find a better solution since the two mentioned methods can be reversed.

The idea is to place the spreadsheet tables and the formulas for calculation inside of a Flash container file for protection. This Flash container file is not meant to link to or access any other external sources. The data which the users input into the spreadsheet would be saved in XML format.

Here is one tutorial which explains how to encrypt a Flash container file in order to prevent decompilers from making the content accessible: http://code.tutsplus.com/tutorials/protect-your-flash-files-from-decompilers-by-using-encryption--active-3115 Here is a tool which claims to do the same, but it may be that it just obfuscates and does not go as far as the process in the tutorial above: www.amayeta.com/software/swfencrypt/

There are some downsides of using Flash which I know. I will not list them here, they are discussed in this forum. Consider that in this case the security aspect outweighs the downsides of Flash. The conversion of the HTML/Javascript content into Flash format will add more effort to this project.

I would like to ask these questions to this community:

  • Is there a converter that could help to translate Javascript into Actionscript?
  • Would it be necessary to translate the Javascript into PHP in order to use it within Flash?
  • Would the effort be worth it?

1 Answers1

1

No this won't be worth the effort as the client will have full control over the runtime of flash. This means that it would not be difficult to extract the functions used. If you must protect your formulas then you should only perform the calculations on your server (or any kind of well protected cloud, if such a thing exists).

If you think that your code will run fine in flash or a browser, then it should not be hard to run the code in a well protected backend server.

Maarten Bodewes
  • 90,524
  • 13
  • 150
  • 263