Encryption (OpenNetCF) and Webservice

[jez]

I'm about to start coding and have a couple of questions relating to the
implementation of my project. Its architecture consists of a client (PPC)
connecting to a Web Server (running IIS) which in turn will retrieve/modify
information from an MSDE 2000 DB.

Hence :

PPC <--> IIS <--> MSDE 2000

The following 3 questions arose :

1) I am planning on using web services to send/receive data to/from an MSDE
2000 DB. Are all the responses that I get from web services in xml or can I
for instance get back in integer or string via a webservice (i.e. if I just
wish to receive a certain value that from a tuple in my DB).

2) I'd like to encrypt data prior to sending it to the webservice (because
data is to be sent wirelessly) and decrypt data upon arrival on the server
(IIS) to make a request on the DB according to the data that I sent. Vice
versa should obviously also be possible. Is there a way to do this ? I.e.
can different clients with different keys send/receive encrypted data ? The
OpenNetCF Cryptography library seems to have different types of
cryptographic algorithms available for use - any specific one that I should
be looking at ? I don't have a problem creating keys in advance and
associating them with a specific client.

3) Any ideas where I could find a decent tutorial on connecting VS.net and
IIS to use web services ? I've read a couple of .NET CF books, they all
explain how to create a WS, but not how to actually connect VS.NET to the
IIS server (which in my case would run on XP).

Thanks so much

jez

 

[Darren Shaffer]

Jez,

Based on questions 1 and 3, let me recommend an introductory book on how to
access
web services from .Net such as the MSPress book "Developing XML Web Services
&
Server Components". Your web service methods can absolutely return
integers,
strings, more complex types such as DataTables and DataSets, and of course
XML. The
process of "connecting" your .Net application to IIS is really the process
of adding a web reference
to your .Net application for a web service hosted within IIS. It's a very
simple process
and you code against the interface that the web service exposes as if you
were coding
against a local managed component. You might want to check MSDN and walk
through
any of the papers that illustrate instrumenting a Compact Framework
application to use the
MapPoint Web Service - all the concepts you'll need are there.
http://msdn.microsoft.com/mappoint/...pull=/library/en-us/dnmapnet30/html/v35go.asp

A general introduction to consuming web services from the Compact Framework
can be found here:
http://msdn.microsoft.com/mobility/...ary/en-us/dnnetcomp/html/netcfwebservices.asp

As for encryption, as long as your 'encrypter' and your 'decrypter' use the
same 'secret'
to generate keys (and the same encryption algorithm on both ends), you can
choose the algorithm
that you think is appropriate given your security requirements. You are
correct that the OpenNetCF
Smart Device Framework includes a number of encryption algorithms from which
you can choose.
There is also a white paper on MSDN regarding signature capture using the
Compact Framework
which also illustrates using the crypto APIs on device.
http://msdn.microsoft.com/mobility/...rary/en-us/dnnetcomp/html/ppcsignatureapp.asp

 

[jez]

Darren,

thanks for your reply. I've managed in the meantime to install MSDE (osql is
such a pain for beginners!) and IIS. I actually own a book on C# Web
Services by Banerjee et al. (published by Wrox), but it doesn't explain how
to install WS on IIS. I'll give it a try tomorrow by browsing through the
net. Once this is done I'll try to connect the WS to my SQL DB.

Once I get the WS working I'll go through the encryption. My current single
point of failure is the understanding of sharing a key. How does the sharing
take place and how does the WS know which key to use with which client
(there will be n clients with n different keys). Is there any place where I
can find more information about using the OpenNetCF Security libraries ?
(i.e. how to create the keys, distribute them etc...). Perhaps a member of
the OpenNetCF Board has written a document about it ?

Looking forward to hearing about it,

Thanks

Jeremy