# Seeking strategies to deploy a function securely without a front end

Background

I have a fuction, which calculates an analytic solution to a multi-dimentional geometry problem.

The function takes a list of real numbers (typically less than a dozen) and outputs a list of reals of equal length (12 reals in -> 12 reals out). The function runs fast and doesn't require a lot of computational resources. More typical solutions to the problem involve statistical sampling of something like 10^5 points and use a substantial parallel computing infrastructure or lots of time. The idea has a number of commercial applications including epidemiology and insurance.

The function uses a number of "high-level" Mathematica functions including:

CholeskyDecomposition[]
IdentityMatrix[]
LinearSolve[]
Simplify[]


What I need

I need to deploy this function into a Windows based technology environment so that the users can call the function from some of their process workflows (e.g., they may call it from a database stored procedure or another program).

I need a deployment solution and have some concerns I need the solution to address, especially:

• keep the code proprietary;
• deploy reliable code; and
• make the function easy to use in the target environment.

The target environment does not include Mathematica; they have no other need to run Mathematica, CDF, or Wolfram Player Pro. They have no need or interest in running a Mathematica front end.

An ideal but likely unworkable solution

Generation of a C code executable would provide an ideal solution, but the function's use of the "high-level" Mathematica functions listed above excludes this as a simple option.

I'd consider developing my own versions of the high-level functions from lower-level Mathematica code that one could then compile to C code, but this just seems silly (and probably hard) If anyone has suggestions along these lines, thinks it possible, or can direct me to examples please let me know.

One can readily get C implementations of the Cholesky Decomposition, but that would introduce a whole other layer of complexity. Also, I never wrote much C code and what I did I did a very long time ago.

A workable solution?

Running the kernel and the code from a script file (without the frontend) seems like a place to start:

It looks like I can send parameters to a script. From the documentation on Script Parameters

...When running a Mathematica script, you may often want to modify the behavior of the script by specifying parameters on the command line. It is possible for the Mathematica code to access parameters passed to the Mathematica script via $ScriptCommandLine. Promising, but the documentation does not provide a clear example of how I could call a Mathematica Script with a list as a parameter. If anyone has suggestions on how to go about this or can refer me to information that gets me part of the way to a solution, please let me know. Sidebar -- the tutorial makes no mention of running Mathematica Scripts under Windows. This has me a little worried. An answer to an earlier question I asked implies that one can do this on a Windows platform see: Chris' answer at the bottom. Does anyone know for certain? Examples appreciated. Using Encode[] seems like it could also help by securing the code and making it less likely that anyone could view it. This raises some questions: The documentation for Encode[] states: On certain computer systems Encode["source","dest",MachineID->"ID"] can be used to generate an encoded file that can be read only on a computer with a particular$MachineID.

This would help a great deal in securing the code, but the documentation does not list the "...computer systems..." on which this will work. Any ideas?

More Encode[] questions. Does one use Encode[] to encode:

• single functions?
• notebooks including the function?
• packages (.m files)?
• something else?

The example in the documentation doesn't seem clear on this.

The beginning of a solution...

It seems like the following begins to give me a workable approach if I can clear up some of the issues:

• Use Encode["source", "dest", MachineID->"ID"] to secure the code.
• Run the kernel(s) and the function from a Mathematica Script.

The target environment will need a Mathematica license and processes and policies to launch and shut down the kernels, but I can work with that.

Can I create a workflow wherein I:

• launch the kernel by a script at the begining of a day;
• use a script to call the function on the kernel throughout the day; and
• close the kernel at the end of the day?

This would help address the reliability issue.

Or should the kernel launch, run the function, then close everytime I want to use the function?

So...I've got a general idea of one way to go about this. I could use some guidance take it down another level of detail.

-
Encode works on all computers where Mathematica works. –  Rolf Mertig Jan 11 '13 at 21:16
@RolfMertig -- Thx. That helps address one of the key questions. –  Jagra Jan 15 '13 at 1:07

Not a full answer, but a little too long for a comment.

You may need to pay a close attention to licensing. If the results of your computation are used on a single machine (e.g. somehow saved to a database or used further in the computation), you may only need a professional single-machine license. If they are going to be used by other employees / machines in the company directly, you may need a WebMathematica lincense.

Assuming the first case, I'd use JLink rather than script mode, and call Mathematica from Java (or .Net/Link, if you prefer that). This will be more robust and allow to:

• automatically transfer common data formats from and to Mathematica (that includes type-checking on both parts, plus it is reasonably fast since Mathlink is used behind the scenes)
• manage Mathematica kernels, including error-handling, re-starting kernels in the case of a crash, etc.
• easier integrate it into the infrastructure of the company, and make the natural - looking .Net or Java API for the IT department of the company.
• easily prototype things in Mathematica, since JLink allows one to work with individual instances (as mentioned in JLink's documentation, it makes Mathematica a prototyping environment for Java) - and I believe the same for .Net/Link too.

As for keeping the code proprietary, you could use either Encode or create an .mx file (with DumpSave), plus set the relevant attributes (Locked, ReadProtected), but no protection will give you a 100 % guarantee. You could also combine Encode and DumpSave etc, which should give you a reasonable level of protection. You could also write some Mathematica code obfuscator, or use some existing ones (not sure if they exist).

In terms of the project's organization, I can only give an idea how it could look like for Java (I have no experience for the .Net). For Java, you can package your final project as a single .jar file. Inside, it will contain your Java code (compiled) and your encoded compressed Mathematica code. You can make settings customization (such as location of Mathematica installation etc) a part of your Java API. So, all that the programmers of that company would have to do is to add this .jar to the classpath for their project (to the set of libraries they use), and also the JLink.jar - and they can start using it. This is all very standard in the Java world, so you win big in terms of the easy setup. In addition, you win in terms of development, since WolframWorkbench, being built on top of Eclipse (one of the most popular Java IDE), is optimised for the hybrid Java / Mathematica project development.

-
+1 Yes, I agree. If Java is an option, then is the way to go. –  Rolf Mertig Jan 11 '13 at 21:22
yes, but use a very good obfuscator, because strings are readable in .class files. –  Andreas Lauschke Jan 11 '13 at 22:02
@AndreasLauschke Yes, that's a good point. You should have come here earlier and answer this question first, I obviously know less in this area. –  Leonid Shifrin Jan 11 '13 at 22:05
A comment on licensing. The Wolfram website states "Mathematica powers other applications in a variety of ways: it can call and be called by C, .NET, Java, and other languages; automatically generate C code; and compile standalone dynamic libraries or executables." Note it does not say "...except for anything you'd actually like to do with Mathematica." I appreciate the challenges of compiling high-level code to C, but it just doesn't seem right that one would have to purchase licenses to do something that Wolfram tells one, one ought to be able to do for free. –  Jagra Jan 11 '13 at 22:07
@Jagra I party agree with you, but I also think that this is based on marketing realities. Perhaps unfortunately, it seems that in the modern world the competition is not won by stating exact applicability / limitations on the marketing pages, which serve a different purpose. What I would really agree with is that, in my personal opinion, current deployment options are one of the weak spots for Mathematica - based technologies. –  Leonid Shifrin Jan 11 '13 at 22:14

webMathematica is probably the most secure solution. Unless someone hacks your sever there is no way to get to the source of your program.

Using webMathematica you could easily use standard Web services. Check out the documentation So e.g., you can create a macro in Excel and then it looks like

In this way you use standard web technology and keep all your Mathematica source code central in one server. It may take quite a while to get familiar with webMathematica, but simple things can be done quite quickly.

-
I agree on the security, but webM license is pretty expensive, unless the company already has a site license. So, it may (or may not) be a bit too much for a single function. This is why I did not make such a suggestion in my answer. –  Leonid Shifrin Jan 11 '13 at 21:15
Sure. Not cheap. But developer time and support time (installation, maintenance, Help desk calls) is also not cheap. So it depends. Plus: I really think that any JLink call over TCP/IP needs a webMathematica license really ... –  Rolf Mertig Jan 11 '13 at 21:23
You are probably right regarding the TCP/IP calls, but in some cases one may do without them - for example, a machine is doing a computation with data stored in a database (perhaps on the same machine), and then the results are again placed into the database. The fact that other machines may then query that database is irrelevant - a single Pro license covers such a case. Re: developer / support time - yes, I agree with that, so of course +1for you too. –  Leonid Shifrin Jan 11 '13 at 21:29
Part 1: +1 to both of you, but Leonid's answer needs a few comments: The proposed "solution" with Encode and ReadProtected and Locked doesn't work, there are three work-arounds for that, some even on the web (which I won't reference here, but readily accessible to anyone). WRI even presents Leonid's "solution" in a screencast, well knowing that it can be hacked with 5 lines of M code. I think I have a way to make it truly undecodable, I use it for my commercial product JVMTools, but it's a different approach. –  Andreas Lauschke Jan 11 '13 at 21:50
Part 2: Next, note that an approach using Java code will use the M code as strings, and therefore should be heavily obfuscated, as the o/p wants to keep the code proprietary. Strings are readable in .class files, so an unobfuscated Java file would expose the M code. Finally, note that the webM license applies WHENEVER M is used in ANY type of web/network environment, see item f in the license agreement, "prohibited uses". Note the comments on the running-mathematica-via-jlink-from-a-servlet-on-tomcat-7-problem discussion. –  Andreas Lauschke Jan 11 '13 at 21:54