Just a multi-tier security question

See more:

C#

.NET

Hey there,

This is just a little security question I was wondering about, because I think many of you struggled with this one.

I have a multi-tier system (Gui > Processor > Core > Data). I use the processor to 'define' processes, like 'create a user'. The processor knows what to do. It calls a validation method in the Core project. If that succeeds, it will create the user in the Core project. Again, if that succeeds, the processor knows it must mail the user to welcome the user in my beautiful system. For me seems like an ordinary story however...

If I install my application on a target machine, the four libraries will be stored on the harddrive somewhere I can't reach it. Any developer can then reference for example the Core library and develop exactly the same methods but (for example) bypassing the validation routine. If that's possible, you can imagine how vulnerable your n-tier application is (the data layer is probably most vulnerable).

How can I protect the (for example) data layer from calls other then from the Core library, and protect the Core library in turn from calls other then the Processor layer. The processor layer can then be exposed widely to allow different UI's and stuff, which is exactly what we want!

Thanks a lot!
Eduard

[Edit]

To get things straight :
My Core project contains 3 functions :

bool ValidateEntity(entity);
bool CommitEntity(entity);
void SendConfirmationEmail();

The Processor project contains one function :

bool CreateUser(entity)
{
    bool success = false;
    if (core.ValidateEntity(entity))
    {
        if (core.CommitEntity(entity))
        {
            success = core.SendConfirmationEmail();
        }
        else
        {
            throw new Exception("Something went wrong in datasource");
        }
    }
    else
    {
        throw new Exception("Validation failed");
    }
    return success;
}

Now in this case, I can reference the Core project and just call core.CommitEntity(entity) without the validation.

[/Edit]