安全地与分布式组件通信
我正在为分布式应用程序设计身份验证和安全性。
要求是：-
1) 有两个分布式组件 A 和 B A 和 B 将始终安装在 Windows 环境中。 A 和 B 可以安装在两个相互不信任的不同 Windows 域中。
2）A和B使用WCF进行通信。
A 和 B 应该能够相互验证并安全地交换数据。
有哪些方法可以做到这一点？
可能的解决方案是：-
a) 实施 CA，向 A 和 B 颁发证书。这两个证书均由 rootCA 签名。但是这个解决方案需要我们实现一个 CA，成本太高
b) 在 A 上实现密钥生成服务。
这看起来像：-
CreateSymmetricKey(string userName, string password);
A 和 B 将拥有一个自签名证书。 A 和 B 之间交换的数据将使用自签名证书来保护。 身份验证是使用用户名和密码完成的。
这将生成一个对称密钥。 A 和 B 都将使用本地安全存储来存储此密钥。
该对称密钥将用于 A 和 B 之间通信的加密和身份验证。
您能建议其他可行的方法吗？
谢谢， 维韦克
I am designing authentication and security for a distributed application.
The requirements are :-
1) The are are two distributed components A and B
A and B will be always installed in Windows environments.
A and B can be installed in two different Windows domains which don't trust each other.
2) A and B use WCF for communication.
A and B should be able to authenticate each other and exchange data securely.
What are the ways in which this can be done ?
The possible solutions are :-
a) Implement a CA, issue certificates to A and B. both of these certificates are signed by rootCA. But this solution involves us to implement a CA which is too costly
b) Implement a key generation service on A.
This would look like :-
CreateSymmetricKey(string userName, string password);
A and B would have a self signed certificate.
The data exchanged between A and B would be secured using the self signed certificate.
The authentication is done using userName and password.
This would generate a symmetric key. Both A and B would store this key using local secure storage.
This symmetric key would be used for encryption and authentication for communication between A and B.
Can you suggest of other ways in which this could work ?
Thanks,
Vivek
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
一个CA没那么贵。 Windows 证书服务器内置于服务器操作系统中，可以配置以生成 Internet 托管的 CRL，或者，必要时您可以使用 makecert 创建根证书，然后从该根生成 X509 证书，然后生成 CRL，您可以将其手动加载到托管服务器上的证书存储中。
您将需要任一类型的 CRL 才能使 WCF 满意。
A CA isn't that expensive. Windows Certificate server is built into the server OSes and can be configured to produce an internet hosted CRL, or, at a pinch you can use makecert to create a root certificate, then generate X509 certificates from that root, and then generate a CRL which you can manually load into the certificate store on the hosting server.
You will need a CRL of either type to make WCF happy.