MSMQ 安全性和性能
我想知道是否有人使用两种不同的安全方法进行了一些性能测试。主要与服务器端的事情有关。
1) 使用活动目录，每次发送消息时都会验证用户帐户。
2）使用证书，每条消息都用证书加密。
我的猜测是，解密消息需要更多的计算机密集型工作，因此活动目录方法可能会表现更好。
I was wondering if anyone has done some performance testing with two different approaches for security. Mostly concerned with the server side of things.
1) Using active directory, the user account is validated each time a message is sent.
2) Using certificate, each message is encrypted with a certificate.
My guess would be that decrypting the message is more computer intensive hence the active directory approach is likely to perform better.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
那里有一些混合的安全措施。
您需要哪些？
让我知道，我可以让您更好地了解什么性能方面。
您写道“使用活动目录，每次发送消息时都会验证用户帐户。”
这听起来不对。 MSMQ 所做的就是将发送用户帐户的 SID 放入消息标头中。这就是为什么您不应仅仅依赖于在队列上设置帐户级别访问权限，因为任何人都可以欺骗 MSMQ 消息中的 SID。
干杯
约翰·布瑞克威尔
You have a few mixed bits of security there.
Which ones do you require?
Let me know and I can give you a better idea of what works performancewise.
You write "Using active directory, the user account is validated each time a message is sent."
That doesn't sound right. All MSMQ does is put the SID of the sending user account in the message header. This is why you shouldn't rely on just setting account level access on queues as anyone can spoof the SID in an MSMQ message.
Cheers
John Breakwell
作为 MSMQ 的初学者，我将尽力在这里回答这个问题。
[1.] 确保队列免受您不想要的帐户的访问
回答：我的理解是，如果我使用私有队列，它会隐式执行此操作。换句话说，如果任何人都不知道，那么“外人”怎么能接触到呢？
[2.] 确保消息来自其声称的帐户（身份验证）
答案：我可以对此进行辩论。我不确定它会在我的特定环境中产生影响，因为一切都是由发送结构化数据的自定义应用程序驱动的。如果数据的结构不正确，则该消息将被忽略。
[3.] 确保没有人可以看到消息正文（加密）
回答：这里更相关，我确实认为某种程度的加密可以防止任何“偷看”数据。
最后，我不知道 SID 位于消息标头内。
让我知道这些不同的安全设置对性能有何影响。另外，您对 MSMQ 的安全性有何建议？
感谢您提供所有信息...
克里斯蒂安·马丁
Being a starter on MSMQ, I will do my best to answer the question here.
[1.] Securing a queue against access from accounts you don't want
Answer: My understanding is that if I use a private queue, it will implicitly do that. In other words, if anyone does not know about it, then how "outsiders" can access it ?
[2.] Ensuring a message is from the account it says it is (authentication)
Answer: I can debate about this. I am not sure it will make a difference in my particular environment since everything is driven by a custom app with structured data sent. If data is not structured the way it should be, the message will simply be ignored.
[3.] Ensuring no one can see the message body (encryption)
Answer: More relevant here, I do think that some level of encryption to prevent any "peeking" of the data.
Finally, I was not aware that the SID was inside the message header.
Let me know how performance is affected but these various security settings. Also, what's your advice on security with regards to MSMQ ?
Thx for all the info...
Christian Martin