.net 2.0 Interprocess CAS / Data Security

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

John Comber - 14 Sep 2006 17:00 GMT

Hi,

I'm developing an app that will access secret info from a SQL Server db.
The server component that accesses the db will be hosted on the same machine
as the db. Client components will connect to the server component to
retrieve the secret.

Two questions:
1. Using CAS, is it possible to use LinkDemandChoice /
StrongNameIdentityPermission on interprocess / cross-machine calls? i.e. Is
it possible to only allow Strong Named clients to call the server component
even though they may be running on different machines?

2. Is it possible to use SecureString to transfer the data from the server
component to the client component, or is SecureString machine specific?

Any advice gratefully received.

Regards
John.

Reply to this Message

Joseph Bittman MVP MCSD - 24 Sep 2006 05:16 GMT

Sept. 23, 2006

Uhmmm... to your first question, my memory is hazy ... I think it is
possible to make sure the caller from another computer has a certain
permission, but I'm not sure whether this information is transmitted by
default through a web service or such.

Regarding your last question about SecureString... it is based on DPAPI
encryption, which is machine specific... each machine has a different key
combo to perform the encryption, which means you'd have to change the key on
each machine to be in-sync with each other... which would be a huge security
concern & risk.

Hope this helps!

Signature

Joseph Bittman
Microsoft Certified Solution Developer
Microsoft Most Valuable Professional -- DPM

Blog/Web Site: http://CactiDevelopers.ResDev.Net/

> Hi,
>
[quoted text clipped - 19 lines]
> Regards
> John.

Reply to this Message

.net 2.0 Interprocess CAS / Data Security

Free Magazines