.NET Remoting Security

kzavalo1_at_lenel.com
Date: 02/10/05 

Date: 10 Feb 2005 10:47:03 -0800

We have the client application making calls to the server using .NET
Remoting. The communication is protected by authentication,
authorization, and encryption, so nobody can get into the channel.
Also the client and the server applications are digitally signed. Now
we assume that somebody knows valid user credentials and create its own
client application to make calls to our server. We would like to
implement another layer of protection that allows only specific (signed
by us) clients to make a remote call. From what I learned about the
.NET Remoting the client sink sends the calling assembly strong name as
part of the stream. Theoretically it would give us the idea who the
caller is. But it looks like this information can be overwritten right
in the client sink, so the "bad" client can use the old strong name
that is recognized by our server to make a call. I tried to find any
information on what part of message data is always authentic and can be
trusted by the server, so we can use it in order to identify the
caller, but I did not find any definite answer.

Relevant Pages

  • Re: WCF security advice (and clarification) needed
    ... You, the client, resolve the foo.mycompany.com hostname within your ... TCP/IP) with that ticket as the security token. ... There are two parties participating in a security scenario, the server ... HTTP supports other authentication ...
    (microsoft.public.dotnet.framework.webservices)
  • Re: SSPI Kerberos for delegation
    ... We want the authentication to happen without providing credentials ... But SSPI while authenticating from the client to the server can do mutual ...
    (comp.protocols.kerberos)
  • Re: Aironet 1200/Radius Help Needed
    ... I just fired up a W2003 Advanced Server so that I can take ... >> IAS servers (do I need a separate certificate for the secondary IAS ... >> of authentication since it involves just installing the certificate on ... >between the AP and the client. ...
    (microsoft.public.internet.radius)
  • Re: Trend too expensive - what is a good replacement?
    ... I still think I might consider going to GFI for the mail protection. ... > I'm curious about the $2300 price tag for 50 users. ... >> want to be everything to everyone and the client is loaded down with too ... >> server on the LAN. ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Windows Authentication, Single sign on and Active Directory
    ... service proxy client fails to connect due to authentication failure and then ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... The server is always in the domain. ...
    (microsoft.public.dotnet.framework.aspnet.security)
Quantcast