仪器网站安全和架构问题
我正在为一台仪器开发 .NET/C# 应用程序软件，该仪器具有内置 PC（Core 2 CPU/2.66GZ/4GB RAM），并且可以从设施 IT 防火墙后面访问互联网。该软件由两部分组成：用于 UI 和设备控制的富客户端桌面应用程序和用于使用浏览器通过互联网提供远程维护（例如设备配置和校准）的 Web 应用程序 (silverlight)。该设备网站将使用仪器本地的 IIS 进行托管。我的问题是：
- 在设备上运行 IIS 托管网站有什么风险？
- 如何确保仪器的安全，使仪器的数据和操作免受潜在黑客的侵害。
- 提供Web服务（或WCF服务）作为远程维护的接口是不是更好的设计？在本例中，我将创建一个富客户端服务实用程序，该程序可以通过 Internet 使用 Web 服务以进行远程维护。
I’m developing a .NET/C# application software for an instrument which has a built-in PC (Core 2 CPU/2.66GZ/4GB RAM) and will have access to the Internet from behind the facility IT firewall. The software is made up of two parts: a rich client desktop app for UI and device control and a web app (silverlight) for providing remote maintenance such as device configuration and calibration via internet using browser. This device web site will be hosted using IIS locally on the instrument. My questions are:
- What is the risk of running an IIS hosted web site on a device?
- What does it take to make it secure so that data and operation of the instrument is immune to potential hackers.
- Is it a better design to provide web services (or WCF services) as the interface for remote maintenance? In this case, I’ll create a rich client service utility program that can consume the web services over Internet for remote maintenance purpose.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
哇，那是一个有趣的项目！
就我个人而言，我会采取不同的方法，让设备/仪器从集中式服务器提取维护信息，而不是托管执行它的服务。
您真的想担心更新和更新的维护吗？该设备上的补丁。
但我会尽力回答，就像你别无选择一样。
1）风险与任何网站相同。你必须处理身份验证，在你的情况下，我会允许IP范围..等等。
2）没有什么是免疫的。但首先请谷歌一下 WCF 安全性。
3）是的，如果服务托管在“工具”之外，这是一种更好的方法，
祝你好运，听起来很有趣。
Wow, thats an interesting project!
Personally I would take a different approach and have the device/instrument pull the maintenance info from a centralized server instead of hosting the service that performs it.
Do you really want to worry about the maintenance of updates & patches on that device.
but Ill try to answer like you didn't have any choice.
1) the risks are the same as any website. you have to deal with authentication, in your case I would have allowed IP ranges.. etc.
2) Nothing is immune. But just google WCF security for a start.
3) Yes that is a better approach if the services are hosted outside the "instrument"
good luck, sounds like a fun one.
有关 WCF 的详细信息，请参阅 WCF 开发人员中心。
WCF 的一个功能是可以在几乎任何类型的程序中托管 WCF 服务。特别是，您可以在设备上托管安全的 WCF 服务 - 根本不需要运行 IIS 或任何其他 Web 服务器。
See the WCF Developer Center for much information on WCF.
One feature of WCF is that it's possible to host a WCF service in almost any kind of program. In particular, you could host a secure WCF service on your device - without needing to run IIS or any other web server at all.