Question

I have an app that runs in the client and this app sends and receives data to/from a remote server.

Is there any way that I can guarantee that the data sent to the server really originated from the allowed app?

Of course I can encrypt the data, but as it can be decompiled, it wouldn’t make it 100% secure.

We’re using .net/c#.

thanks!

Answer 1

Your question is too ambiguous and cannot be answered in its present form. You’ll need to more precisely state the threat that you want to mitigate.

For example, suppose you have a client, Alice, attempting to send a message to a server, Bob. Is the threat:

1. A third party, Eve, could be listening to the communication channel. Alice desires Bob to understand the message, but Eve must not be able to understand the message.

2. A third party, Mallory, could be actively tampering with the communication channel. Bob desires to know whether or not anyone has tampered with Alice’s attempt to send a message.

3. Eve and Mallory are working together. By monitoring the channel, Eve has accumulated recordings of a number of genuine message from Alice to Bob. Even though she cannot understand them, she believes they are good messages. Eve gives the messages to Mallory. Mallory will tamper with the communication channel so that Bob appears to be getting valid messages from Alice even though Alice is not sending messages right now. (Or, Mallory will tamper with the channel such that Alice’s current valid message is replaced with a previous valid message.)

4. A third party, Moriarty, has murdered Alice and is now sending messages to Bob purporting to come from her. (The communication channel is uncompromised; Mallory and Eve have the night off.) Bob wishes to know whether the message is really coming from Alice, as the message claims.

Those problems might seem similar but in fact they are different problems and solved with different techniques. If you think you are solving all of them by solving one of them then you are building an insecure system. You need to carefully and clearly describe what threat you want to mitigate before anyone here can give you advice on how to do so.