CODEWITHSUNDEEP
c#web-servicessecurity
LauzPT
LauzPT

Reputation: 125

WebService Security

I'm developing an project, which consists in a webservice and a client application. It's a fair simple scenario. The webservice is connected to a database server, and the client consumes from the webserver in order to get information retrieved from the database.

The thing is: 1. The client application can only display data after a previous authentication; 2. All the data transferred between Web Service and clients must be confidential; 3. Data integrity shouldn’t be compromised;

I'm wondering what is the best way to achieve these requirements. The first thing I thought about, was sending the server a digital signature containing a client certificate, to be stored in the server, and used as comparison for authentication. But I investigated a little about webservice security, and I'm no longer certain that this is the best option.

Can anyone give me an opinion about this?

TIA

Upvotes: 1

Views: 1238

Answers (2)

Merlyn Morgan-Graham
Merlyn Morgan-Graham

Reputation: 59101

You should use a known good scheme to achieve this sort of secure connection: SSL. If the technologies (programming languages, libraries, etc) you are using have a known SSL pattern, then use that.

If your session is secure, then you don't need any extra data encryption. The latest versions of SSL are pretty strong by today's standards.

In the case of a C# application, I'd use WCF with SSL.

Your client needs to know they can trust the server, so you'll need a server certificate. If you're okay with a client only needing a password to access that data, then you don't need client certificates.

Upvotes: 2

Dani
Dani

Reputation: 15069

all communication between the client and the web service should be encrypted. than the strength will come from the way you handle encryption keys.

microsoft's wcf has message authentication using certificates, and other options.

you can use some signature algorithm (like md5) to sign the "data" that you send to the client (inside the message), but an attacker can do that as well, so a stronger option would be using public-private keys to encrypt the data with the signatures... but you need to guard the private keys now.

how important is your data ?

Upvotes: 1

Related Questions