Click here to Skip to main content
15,881,248 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hey,

Lets say I have a class which contains an internal sensitive structure whose content I don't want to reveal to my user when he receives an object I've serialized, but it is essential that he would have receive this data (a token...)

In other words, I'm interested in replacing this structure with a seriailzed-encrypted string, which will be deconverted into the structure when deserializing the class. This behaviour is expected everytime the class is used in serialization, therefore I would expect to decorate the class with a certain attribute.

Is there a standard way to do that? I know that JSON.NET has a "JsonConverterAttribute", but I prefer the approach of serializer-agnostic classes (I use DataMemberAttribute), and I don't want JSON.NET as a dependency (or as my sole supported serializer...)

I have tried ignoring the internal structure, and using a string property, that sets and gets the internal structure. It was an adequate solution for deserialization, but I had no passable solution for serialization.

I have also tried to create a generic object something like SerializationTransformationObject<tinternaltype,>. It worked fine, but had some esthetic disadvantages. I'm implementing my own JsonConverter already (currently for Deserialization only), I've considered adding support for the forementioned type. That way, my Json Serializer solves the problem himself, without creating dependencies in my code.

I also considered compiling JSON.NET myself, and defining an identical attribute in my abstract serialization library.

What would you recommend?

Thanks!
Posted

1 solution

Inherit ISerializable and then implement custom serialization. All you need to do then is to encrypt the data using whatever encryption you want. You can then use a private/public key encryption system to deserialize the data on the other side.

That's what I would do anyway.

[Edit]
See this[^]

AES encryption[^]

You can always convert the byte stream to a Base-64 string, then encrypt the string and send it over as plain text, XML, or JSON.
 
Share this answer
 
v2
Comments
ShacharK 26-Sep-13 10:21am    
I don't see how implementing ISerializable is of any help. I have a custom object that exposes String instead of an object. I need it to be transparent, as if it never existed.

InternalStructureToStringSerializationObject should output a serialized string, and it could be initialized from a string as well.

Instead of: { "Output" : "EncryptedString" }, it should be serialized to "EncryptedString" only.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900