需要一个安全的方案web服务asp.net
我开发一个.net 3.5 Windows窗体应用程序。我也想设计一个网站，有多个的Webmethods web服务来查询主机上的数据库。我想web服务只能通过我的winapp和我的网站被称为！而且我不希望任何其他人能够调用并使用我的web服务，但只有一些人谁有权访问我所开发的Windows应用程序。
I have developed a .Net 3.5 windows forms application. I also want to design a website that has a webservice with multiple Webmethods to query the database on the host machine. I want the webservice to be called ONLY through my winapp and my website! And I don't want any other people to be able to call and use my webservice but only some people who have access to the windows application that I have developed.
我需要一个良好的安全场景此！我真的AP preciate人谁可以帮我，因为这是我开发一个web服务的第一次经历，我真的需要我提到的！它是为安全
I need a good security scenario for this! I truly appreciate anyone who can help me because this is my first experience of developing a webservice and I really need it to be as secure as I mentioned!
你所谈论的将是困难的几个原因做，但主要是这样的：
What you're talking about is going to be difficult to do for several reasons, but primarily this:
的 如果你把code什么对你的WinForms应用程序，它可以很容易地反编译。您可以混淆code所有你喜欢的，但它可以被反编译。的
If you put anything in code on your WinForms app, it can be decompiled very easily. You can obfuscate the code all you like, but it can be de-compiled.
由于这一点，任何code，你在你的应用程序都可以被任何人访问code读取。的你应该总是把所有的WinForms应用程序，就好像它是完全破坏，并确保在服务器端的安全性补偿。的
Because of that, any code that you have in your app can be read by anyone with access to the code. You should always treat any WinForms app as if it's completely compromised, and ensure that the security at the server end compensates.
由于这一点，你不能简单地存储用户名和密码在配置文件中或code。你必须想出别的东西。您可以使用验证，并提示用户输入程序启动时用户名/密码，并使用它。然而，人们往往有着这些东西，所以你可能想要去额外的保护。
Because of this, you can't simply store usernames and passwords in configuration files or in code. You have to come up with something else. You CAN use authentication and prompt the user to enter a username/password on program launch, and use that. However, people tend to share these things, so you may want to go for extra protection.
您可以把连接信息，或秘密进入的app.config和加密，但任何人谁可以去编译code，可以重新编译它，并添加code随意对其进行解密。
You can put the connection info, or secrets into the app.config and encrypt it, but anyone who can de-compile the code, can recompile it, and add code to decrypt it at will.
您可以提供签字按键与您的应用程序，并使用在认证机制，但可以忽略。
You can provide signed keys with your app, and use that in an authentication mechanism, but that can be bypassed.
您可以限制你的IP地址，以特定的IP地址，但那些可能会被欺骗。
You can restrict your IP address to specific IP addresses, but those can be spoofed.
但是...
通过分层上面所有的技术，可以使其难以攻击者绕过您的precautions。我们确实在我们的应用程序之一以下，我们也有类似的要求：
By layering all of the above techniques, you can make it difficult for an attacker to bypass your precautions. We did the following in one of our apps where we had a similar requirement:
- 我们建立了适用于每一个客户授权一个GUID记录的数据库，并允许该客户的IP地址。
- 每个Web方法需要一个CustomerKey参数。 （该GUID上述）对Web服务的每次调用会针对IP地址的关键。结果
- 如果它匹配，返回有效数据。
- 如果失败， 返回寻找有效的数据。实际上，我们回到什么样子不错的数据，但它真的不是。这使得攻击者更难知道他们是否实际上已经通过防御打破。
分层防御，希望将阻止普通攻击。
Layering the defenses, hopefully, will discourage the average attacker.
微软有一些准则，以及： http://msdn.microsoft.com /en-us/library/ff648643.aspx
Microsoft has some guidelines as well: http://msdn.microsoft.com/en-us/library/ff648643.aspx