CODEWITHSUNDEEP
c#.netwcfwcf-security
Veeru
Veeru

Reputation: 463

Need help in protecting WCF service

I'm developing a WCF Service and wnat to protect this service from unauthorized users. so i'm planning to add parameter "RSAKey" to the service and client (AddIn) will generate and sends the RSAKey with every request and Service will check passed RSAKey for that time for that IP and serves only if it is valid.

But my question here is, if some one decompiles the client (AddIn) though it is fuscated if he could guess of actual function that generating "RSAKey", he can call that method and generate RSAKey and use service without a problem.

So, is there anyway to protect my service to be consumed by valid/allowed clients? Note: one big thing to conside is, i want to distribute/give the clients freely for public usage without credentials. But same time want to protect from massive copy/miss usage of service.

Upvotes: 1

Views: 410

Answers (4)

pmartin
pmartin

Reputation: 2741

It sounds like your main concern is really "over-usage". If that's the case, then how about implementing some type of limitations on the client calls. You could:

-Limit the number of requests a client makes in a specified time period
-Limit the number of results returned in a single request

Of course, neither of these options will protect you over the long term. Given time, any client will still be able to download the entire DB via your service. By using some limitations, you're at least buying some time to analyze logs and determine if one of your clients is actually being malicious. By logging the requests to the service, it should be pretty easy to determine whether a specific client(s) is doing something evil.

Upvotes: 1

Tridus
Tridus

Reputation: 5081

Short answer: No.

The problem here is that your client needs to be able to connect. Anybody with a copy of your client and the time/knowledge to do it can figure out how it works, and make their own client that passes back the same thing. They're then free to do whatever they want.

A lot of money gets put into trying to accomplish this type of DRM by big companies, and it's always broken. Obscurity is the only real way this type of thing works (where nobody bothers to break it).

The service itself has to try and protect itself from misuse, either through authentication or through trying to sanity check the calls being made to block whatever it is you're trying to prevent. What you're trying to do isn't really very secure.

(What does this service do that you're so concerned about it, anyway?)

Upvotes: 1

user595010
user595010

Reputation:

  1. Leave the RSAKey generation out of the client application. Move it to one assembly that will be used both by site from which the client application is being downloaded and WCF service.

  2. Provide RSAKey when user is about to download the client application. Save the {IP address, generated RSAKey} pair in store common to site from which the client application is being downloaded and WCF service.

  3. Provide the ability to set the RSAKey for the client (so the RSAKey will be attached to each WCF message).

  4. Inspect each message received by the WCF service in order to determine whether it contain RSAKey and whether the key is valid (search for existing {IP address, generated RSAKey} pair in common store).

Upvotes: 0

Feng
Feng

Reputation: 83

Maybe you can host your WCF service by IIS server, then you can enable the https access and you can get the client IP address too. So you can suspend the access ip for a while if there is a suspected attack.

Upvotes: 0

Related Questions