Encoded WebService SOAP Header?

I have a public web server that runs behind a firewall at a hosting
facility. We own and control the server. I need to make occasional updates
and changes to data stored in SQL and am unable to establish any type of VNP
or SSL connection to the server due to hardware restrictions at this time.

I would like to make these updates using Web Services. I understand how to
embed a username / password in a SOAP header, but it would seem to me that
an attacker could simply replicate the username / password since I am unable
to use SSL at this time. Or is there another approach to encrypting these?
(Read on.)

If I encrypt the username password using a .NET cryptographic provider,
couldn't an attacker simply use the encrypted username / password?

How about adding a time component to the encoded username / password data
structure such as DateTime.Now.Ticks? This would make every username /
password unique. In addition, I could test the uuencoded time factor to get
an age on the username / password. If the absolute age of the time factor is
older than about 500 (1000?) milliseconds, I would assume it is invalid.

I have tight control over both the web server and my client updating
machine. I would use the same symmetric encryption key on both machines and
would have to insure that the clocks on both machines are synchronized to
one another within a small error factor.

The actual data that I am transferring is really not sensitive and it does
not need to be encrypted; I just need to insure that only I am able to make
updates to via the web services.

Seem like a reasonable approach?


.

Relevant Pages

  • Re: anyone used disk encryption & fingerprint id software?
    ... altho we have all been bitten by software that doesnt work or work ... i presumed that encrypting the drive would avoid having the data 'readable' ... the fingerprint thing is a lazy man's way of trying to get a strong username ... >>also using a fingerprint scanner to generate my username/passwords so ...
    (microsoft.public.windowsxp.general)
  • Re: anyone used disk encryption & fingerprint id software?
    ... loose the key to unencrypt the data it is lost forever. ... If you use EFS you must ... > i presumed that encrypting the drive would avoid having the data ... >>>in a username and password, does the scanner somehow create both of ...
    (microsoft.public.windowsxp.general)
  • Re: How Secure Are Username Token Encrypted Messages
    ... > My question is Encrypting the username token using the public key of the ... > "Martin Kulov" wrote: ... the public key of X.509 certificate from the receiver. ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Problem Comes Up After Updating
    ... connecting to the Net no longer opens up. ... disappears i.e. the next screen to enter username & password does not ... I decided to uninstall the updates which were installed day before ... yesterday from the Control Panel (Add/Remove Programs) but the updates ...
    (microsoft.public.windowsxp.general)
  • Re: new guy
    ... You should be presented with a text-only login prompt. ... Log in - enter you username, press enter, password, press enter. ... sudo apt-get upgrade ... the updates could take quite a while. ...
    (Ubuntu)