.net 2.0 Interprocess CAS / Data Security

14 Sep 2006 4:00 PM

John Comber

Hi,

I'm developing an app that will access secret info from a SQL Server db.
The server component that accesses the db will be hosted on the same machine
as the db. Client components will connect to the server component to
retrieve the secret.

Two questions:
1. Using CAS, is it possible to use LinkDemandChoice /
StrongNameIdentityPermission on interprocess / cross-machine calls? i.e. Is
it possible to only allow Strong Named clients to call the server component
even though they may be running on different machines?

2. Is it possible to use SecureString to transfer the data from the server
component to the client component, or is SecureString machine specific?

Any advice gratefully received.

Regards
John.

24 Sep 2006 4:16 AM

Joseph Bittman MVP MCSD

Sept. 23, 2006

Uhmmm... to your first question, my memory is hazy ... I think it is
possible to make sure the caller from another computer has a certain
permission, but I'm not sure whether this information is transmitted by
default through a web service or such.

Regarding your last question about SecureString... it is based on DPAPI
encryption, which is machine specific... each machine has a different key
combo to perform the encryption, which means you'd have to change the key on
each machine to be in-sync with each other... which would be a huge security
concern & risk.

Hope this helps!

--

Joseph Bittman
Microsoft Certified Solution Developer
Microsoft Most Valuable Professional -- DPM

Blog/Web Site: http://CactiDevelopers.ResDev.Net/

Show quoteHide quote

"John Comber" <John Com***@discussions.microsoft.com> wrote in message
news:8581E01D-A556-4AE5-90FB-C3B58FF94A2B@microsoft.com...
> Hi,
>
> I'm developing an app that will access secret info from a SQL Server db.
> The server component that accesses the db will be hosted on the same
> machine
> as the db. Client components will connect to the server component to
> retrieve the secret.
>
> Two questions:
> 1. Using CAS, is it possible to use LinkDemandChoice /
> StrongNameIdentityPermission on interprocess / cross-machine calls? i.e.
> Is
> it possible to only allow Strong Named clients to call the server
> component
> even though they may be running on different machines?
>
> 2. Is it possible to use SecureString to transfer the data from the server
> component to the client component, or is SecureString machine specific?
>
> Any advice gratefully received.
>
> Regards
> John.