RE: secure a WS called via GPRS
- From: stcheng@xxxxxxxxxxxxxxxxxxxx (Steven Cheng[MSFT])
- Date: Fri, 11 Aug 2006 07:25:59 GMT
{\rtf1\ansi\ansicpg936\deff0\deflang1033\deflangfe2052{\fonttbl{\f0\fnil\fprq2\fcharset0 MS Sans Serif;}}
\viewkind4\uc1\pard\lang2052\f0\fs20 Hello Trapulo,
\par
\par From your description, I understand you're consider a security mechanism to secure your ASP.NET webservice which will be consumed by many smart devices(mobile .... ) using CF 2.0, correct?
\par
\par Based on my experience, you may consider the following options:
\par
\par 1. I'm afraid using WSE 3.0 is not doable here, the bottleneck is your client consumers(smart devices), since WSE 3.0 only support .net framework 2.0 (not compact framework ).
\par
\par 2. Is it possible to use transport protocol security? Since webservice currently most rely on HTTP, a very common and sophisticated security approach is using https/ssl to secure our webservice.
\par
\par 3. If using https/ssl is not possible for your scenario, I think you need to consider implementing a custom security component which will help encrypt and sign your webservice request/response SOAP messages. And for ASP.NET webservice, the SoapExtension is such a plugable component, which can intercept the request/response SOAP message of ASP.NET webservice webmethod(at both server-side and client proxy side). Thus, we can define a custom security SoapExtension which encrypt and sign the soap message. Here is a tech article whch has demonstrate a simple securing soap extension:
\par
\par #Encrypting SOAP Messages
\par http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnaspnet/html/asp09272001.asp
\par
\par In addition, .net framework(also compact framework 2.0) has provided enchanced cryptographics support, you can leverage them in your custom webservice security extension:
\par
\par #Cryptographic Services
\par http://msdn2.microsoft.com/en-us/library/93bskf9z.aspx
\par
\par #Cryptographic Tasks
\par http://msdn2.microsoft.com/en-us/library/7yx4d854.aspx
\par
\par Hope this helps. If there is any other information you're interested, please feel free to let me know.
\par
\par Sincerely,
\par
\par Steven Cheng
\par
\par Microsoft MSDN Online Support Lead
\par
\par
\par
\par ==================================================
\par
\par Get notification to my posts through email? Please refer to http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notifications.
\par
\par
\par
\par Note: The MSDN Managed Newsgroup support offering is for non-urgent issues where an initial response from the community or a Microsoft Support Engineer within 1 business day is acceptable. Please note that each follow up response may take approximately 2 business days as the support professional working with you may need further investigation to reach the most efficient resolution. The offering is not appropriate for situations that require urgent, real-time or phone-based interactions or complex project analysis and dump analysis issues. Issues of this nature are best handled working with a dedicated Microsoft Support Engineer by contacting Microsoft Customer Support Services (CSS) at http://msdn.microsoft.com/subscriptions/support/default.aspx.
\par
\par ==================================================
\par
\par
\par
\par This posting is provided "AS IS" with no warranties, and confers no rights.
\par
\par
\par
\par
\par
\par
\par
\par
\par
\par
\par }
- Follow-Ups:
- Re: secure a WS called via GPRS
- From: Trapulo
- Re: secure a WS called via GPRS
- From: Pablo Cibraro [MVP]
- Re: secure a WS called via GPRS
- References:
- secure a WS called via GPRS
- From: Trapulo
- secure a WS called via GPRS
- Prev by Date: RE: Flowing Kerberos Credentials from Browser Client to Web App to Web Service App ...
- Next by Date: Re: Create Certificate X.509 in Win2003 Server
- Previous by thread: secure a WS called via GPRS
- Next by thread: Re: secure a WS called via GPRS
- Index(es):
Relevant Pages
|
Loading
