Welcome!

@DXWorldExpo Authors: Pat Romanski, Elizabeth White, Jason Bloomberg, Liz McMillan, William Schmarzo

Related Topics: Microsoft Cloud, Containers Expo Blog

Microsoft Cloud: Article

Securing Enterprise Data Transfer with SQL Server CE

Securing Enterprise Data Transfer with SQL Server CE

In the first article in this series, "Accessing Enterprise Data from SQL Server CE" [.NETDJ, Vol. 1, issue 6], we constructed a solution that allowed us to provide enterprise data access to mobile devices while in a disconnected environment using Visual Studio .NET 2003, the .NET Compact Framework, and SQL Server CE 2.0. Providing mobile users offline access to their enterprise data, along with the ability to propagate changes back to the server, is a powerful addition to any mobile architecture. But this additional functionality comes with the responsibility of securing your data while "out in the wild."

Whenever you create architectural scenarios in which your data is accessible outside of your infrastructure, you need to make data security a top-priority feature. Mobile data access is no exception. Consider the ramifications of hackers abusing your application's SSCE virtual directory to either deny access to legitimate users or steal critical enterprise data. While the functionality of mobile enterprise data access is a powerful addition to your architecture, it comes with great responsibility. Combining solid code and great features with sound security practices provides your users with a compelling application from both a functional and nonfunctional point of view.

In this article, we'll take the functionality we developed in the first installment and harden the solution to be both functional and secure. We'll secure access to the data on the back-end server by leveraging security features built into Windows Server 2003, SQL Server 2000, and IIS 6.0. We'll secure the transmission of data between device and server to ensure that data is hidden from prying eyes while en route. Finally, we'll modify our code to allow authenticated and secure transfer of data between server and device.

For this article, you'll need to start with the solution offered in our earlier article. (The source code is available at www.sys-con.com/dotnet/sourcec.cfm.) For this solution, we'll use Visual Studio .NET 2003 and the .NET Compact Framework to develop the solution, and SQL Server 2000, IIS 6.0, and Windows 2003 for the server infrastructure. Some of the steps will be slightly different on Windows Server 2000, so check the documentation if you are using that version of the server.

Secure Infrastructure Topology
Our previous solution used some less-than-secure coding and infrastructure practices to get the functional side of things up and running. We leveraged Anonymous authentication when connecting to the SSCE virtual directory via HTTP and we left the data transfer open to prying eyes by sending the data over the wire unencrypted. We used sa/password as our account for accessing the data and passed that account information over the wire as plain text. All of this should leave a modern developer queasy when imagining such practices in production. Let's take a look at a functional and secure way of delivering this functionality.

As we learned in the first article, using SSCE gives you the advantage of using existing infrastructure to create the solution, most notably using IIS 6.0 and Web infrastructure as the means of communication between the device and server, as well as leveraging SQL Server functionality such as replication. It should come as no surprise that we'll be securing our mobile data solution using security concepts that are well known to .NET developers, including IIS authentication/authorization, as well as SQL Server replication security features.

Figure 1 illustrates the topology of our secure solution. We'll authenticate users using IIS and Basic authentication. Once authenticated, we'll use NTFS security to provide authorization to resources such as the virtual directory and the server agent ISAPI DLL. Note: Since we're using Basic authentication with IIS, we'll need to configure our server to use HTTPS/SSL for communications to protect the account information as it moves over the wire. (Basic authentication works for the Internet, but sends authentication information over the wire as clear text.) HTTPS/SSL will also protect the data as it moves between the device and the server. The UI will be modified to prompt for account information and will use that account information for all communications with IIS 6.0, as well as SQL Server.

 

Securing Your SQL Server Database
We'll start by securing access to our database by allowing only specific users access to the database. Using SQL Server Enterprise Manager and the SimpleSSCEExample database we created last time, create two accounts on your server machine for testing, UserCanAccess and UserCannotAccess. Give each user a strong password. Add both accounts to SQL Server as logins and add the UserCanAccess account to the SimpleSSCEExample as a User with the proper permissions for accessing the database, including inserts, updates, and deletes. At this point, we have one user who can access the database via RDA, and one who cannot. Remember that RDA just passes SQL statements to SQL Server, and does not have any explicit security features itself. If the user is authenticated and has rights to the database he or she can pull and push data between device and server.

On the other hand, replication lets you differentiate users who can access the database and users who can access the publication. We'll restrict access to the Publication and the Publication Articles, so that only specifically authenticated users can transfer data via merge replication. Select the SimpleSSCEExamplePub and open the Properties dialog. Click on the Publication Access List tab, click Add, and select <MyMachineName> \UserCanAccess and click OK. Now only UserCanAccess can access the publication. Next, we'll use the Check Permissions option on the publication articles themselves to further refine who can or cannot merge data with the publication database. Click the Articles tab and click the ellipses button next to each article. While in the Article dialog, click the Merging Changes tab and select INSERT, UPDATE and DELETE. This change forces a check on whether the authenticated user has rights to change data via Insert, Update, and Delete statements. Use this feature to refine which modifications are allowed on each article via replication. This is a great way to differentiate between users who can pull down data for viewing and those who can modify data via replication (and to what level). Click Apply.

Using IIS 6.0 Basic Authentication and SSL
Now that we have the database configured for access to authorized users, we need to configure the virtual directory for authentication. We'll do this without the wizards so we can discuss each step of the process and how it impacts our infrastructure.

Start by opening the SQL Server CE Connectivity MMC and deleting the current SimpleSSCEExampleSynch entry. Also delete the virtual directory folder.

Next, open IIS Manager and create a new virtual directory named SimpleSSCEExampleSynch and map it to a directory on your machine with the same name, such as c:\SimpleSSCEExampleSynch. Copy the SSCE Server Agent DLL, sscesa20.dll, to this location (it can be found on a machine with SSCE server components installed under C:\Program Files\Microsoft SQL Server CE 2.0\Server) and give the virtual directory Execute permissions.

With the virtual directory in place, configure IIS 6.0 so that we can identify who is requesting access to the server agent and then limit execution rights to users of the system. We'll do this using Basic authentication. In IIS Manager, select the SimpleSSCEExampleSynch virtual directory and open the Properties page. Select the Directory Security tab in the Properties dialog and click the Edit button under Authentication and Access Control group. Make sure that only Basic authentication is selected and note the warning about sending authentication information over the wire as clear text. In order to use Basic authentication in a secure manner, we'll need to configure SSL as well to protect the transmission. Utilizing SSL in this manner will also protect the transmission of data between the device and the server agent endpoint.

In order to do this, you'll need to install a server certificate on your server. See the IIS documentation on how to set up SSL with server certificates. Once you have a certificate installed, click Edit under Secure Communications in order to configure SSL. Select Require Secure Channel and Require 128-bit encryption. Click OK until the Properties dialog is dismissed.

Now that we've set up the authentication of our users, we need to enable execution of the sscesa20.dll and enable the proper NTFS permissions for exchanging data. Browse to the directory that is mapped to the SimpleSSCEExampleSych virtual directory in Windows Explorer and right-click on folder to access the Properties dialog. Grant read and write NTFS permissions to the UserCanAccess account for this folder so that intermediate files can be placed in this folder by sscesa20.dll. Open the folder and grant read and execute NTFS permissions to the sscesa20.dll for the same account so this DLL can execute under the authenticated identity of our UserCanAccess account. You'll need to do this for each user, or preferably create a role for the users and add users to that role.

In this example I'm running Windows Server 2003, so I'll need to add sscesa20.dll as a Web extension in IIS 6.0. IIS 6.0 by default will not allow dynamic content, including ISAPI DLLs, to be served until you enable it. Open IIS 6.0, select the Web Service Extensions folder, and click the link for Add a new Web Service Extension. Give the new extension the name SecureSSCESynch and browse to the sscesa20.dll in our virtual directory to designate which DLL is allowed as the Web extension. Also set the Set Extension status to Allowed so the DLL will be allowed to execute out of the gate.

Now that we have the virtual directory covered, we'll further lock down our infrastructure by configuring a specific snapshot folder for intermediate files during replication and restrict access to that folder. Since the sscesa20.dll will run under the account that has been authenticated by IIS, we'll need to provide read access to the snapshot folder for each account that will perform replication. Create a shared folder called SimpleSSCEExample_Snap shot. Give UserCanAccess read access to the folder. Also give full control to the account that the SQL Server Service and SQL Server Agent will run under.

Finally, point the SecureSSCEPub publication to use the SimpleSSCEExample_Snapshot folder. Open Enterprise Manager, open the Properties dialog, uncheck Generate snapshots in the normal snapshot location, check Generate snapshots in the following location, designate \\<MyServerName>\ C$\Sim pleSSCEExample_Snapshot as the new location, and click Apply.

Checking your work at this point is a good idea. Open IE on your development machine and on your device and browse to https://<MyServerName>/SSCEExampleSynch/sscesa20.dll. You should be prompted to enter your account info. Enter the UserCanAccess account and then the UserCannotAccess account to make sure that authorized users have access to the SSCE Server Agent virtual directory. You know you've got the configuration right when UserCanAccess gets the message "SQL Server CE Server Agent" when browsing to the virtual directory directly.

Securing the SSCE Application Code
In this step we'll take a look at the code that's needed to access the secure connection to the server. First, we'll modify the UI to request user name and password. Open the SSCEExample.sln you created in VS.NET 2003 from our previous article and drop the controls described in Table 1 onto the form.

 

Now let's modify the code step by step, making our mobile application more secure while fixing security faux pas that we made while getting things up and running. First, let's correct the connection string we used as the olddbConnectionString parameter when using RDA to execute SQL statements on our remote server. Compare the connection strings shown in Listing 1.

The commented-out version is abysmal. It uses SQL Authentication and sa/password (the insecure developer's "dirty little secret" to get things running). The new version is much more secure. It uses the setting "Integrate Security = SSPI", which uses the current authenticated user (running sscesa20.dll in IIS) as the identity to pass to SQL Server. It also uses the setting "Persist Security Info=False", which prevents the account information from being returned in the result of the connection being made. So already we've avoided a password in our code and we're using the authenticated user's account to flow authorization. That's a good start.

Next, we need to change our code to use SSL and provide the account information that we'll use to authenticate our user with IIS and SQL Server 2000. Take a look at the code in Listing 2 to see the changes to our RDA code.

This is straightforward; we just need to point our instance of the SqlCeRemoteDataAccess class to the new URL that is protected via SSL encryption and the account information via the InternetLogin and InternetPassword properties of that class. That's it for RDA. You can run the solution and click on the RDA button to check your work.

To finish up replication, we need to make a few more changes to the code behind the corresponding button and our usage of the SqlCeReplication class. Take a look at the code in Listing 3.

Again, these simple code changes correspond to our infrastructure changes, including the usage of SSL reflected in the InternetURL property and the inclusion of account information in the InternetLogin and InternetPassword properties. Note: We're getting rid of another security "worst practice" by changing the PublisherSecurityMode setting to SecurityType.NTAuthentication in order to flow the NT account information provided earlier and to avoid the propagation of sa/password usage.

That's the final code change. Run the solution using the UserCanAccess account we've set up and test the exchange of data between the device and server. Also check to make sure that unauthorized accounts cannot access the server data and add some useful exception handling for the exceptions that are raised. If you have issues, take a look at SQL Server CE 2.0 Books Online (Click Here!) for troubleshooting information and recheck your infrastructure settings. Often a single check box setting can make all the difference with security-based code if things don't work out on the first try.

Conclusion
Now we have a solution that is both functional and secure, which is what we set out to do. We've restricted access to our server by requiring that users authenticate when using either RDA or replication. We used encryption via SSL to ensure that both account information and our data is protected as it moves across the wire. We also managed permissions on server resources to grant the least-required permissions to get the solution up and running. From there it was just a matter of some simple code changes.

Now we have the best of both worlds, mobile device access to our enterprise data, as well as the confidence that our data and server can be accessed only by legitimate users. Take this code and integrate it into your infrastructure to add to your solutions the "wow factor" that only mobile development can add.

Please note that the ideas, opinions, and information contained in this article are those of the writers, not of Microsoft Corporation.

More Stories By Chris Mayo

Chris Mayo is a .NET developer evangelist based in the Midwest. Chris has over 10 years experience developing enterprise software as a developer and an architect. His experience dates back to the days of VB 2.0 and includes development on the COM(+), .NET, and J2EE platforms. As the local .NET developer evangelist, Chris speaks at INETA, VS, and .NET user group meetings; the MSDN series; and conferences such as VSLive! and DevDays.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@BigDataExpo Stories
"Infoblox does DNS, DHCP and IP address management for not only enterprise networks but cloud networks as well. Customers are looking for a single platform that can extend not only in their private enterprise environment but private cloud, public cloud, tracking all the IP space and everything that is going on in that environment," explained Steve Salo, Principal Systems Engineer at Infoblox, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventio...
"Akvelon is a software development company and we also provide consultancy services to folks who are looking to scale or accelerate their engineering roadmaps," explained Jeremiah Mothersell, Marketing Manager at Akvelon, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Agile has finally jumped the technology shark, expanding outside the software world. Enterprises are now increasingly adopting Agile practices across their organizations in order to successfully navigate the disruptive waters that threaten to drown them. In our quest for establishing change as a core competency in our organizations, this business-centric notion of Agile is an essential component of Agile Digital Transformation. In the years since the publication of the Agile Manifesto, the conn...
SYS-CON Events announced today that CrowdReviews.com has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5–7, 2018, at the Javits Center in New York City, NY. CrowdReviews.com is a transparent online platform for determining which products and services are the best based on the opinion of the crowd. The crowd consists of Internet users that have experienced products and services first-hand and have an interest in letting other potential buye...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
SYS-CON Events announced today that Telecom Reseller has been named “Media Sponsor” of SYS-CON's 22nd International Cloud Expo, which will take place on June 5-7, 2018, at the Javits Center in New York, NY. Telecom Reseller reports on Unified Communications, UCaaS, BPaaS for enterprise and SMBs. They report extensively on both customer premises based solutions such as IP-PBX as well as cloud based and hosted platforms.
Large industrial manufacturing organizations are adopting the agile principles of cloud software companies. The industrial manufacturing development process has not scaled over time. Now that design CAD teams are geographically distributed, centralizing their work is key. With large multi-gigabyte projects, outdated tools have stifled industrial team agility, time-to-market milestones, and impacted P&L stakeholders.
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
"There's plenty of bandwidth out there but it's never in the right place. So what Cedexis does is uses data to work out the best pathways to get data from the origin to the person who wants to get it," explained Simon Jones, Evangelist and Head of Marketing at Cedexis, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, discussed how by using ne...
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
"Codigm is based on the cloud and we are here to explore marketing opportunities in America. Our mission is to make an ecosystem of the SW environment that anyone can understand, learn, teach, and develop the SW on the cloud," explained Sung Tae Ryu, CEO of Codigm, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
A strange thing is happening along the way to the Internet of Things, namely far too many devices to work with and manage. It has become clear that we'll need much higher efficiency user experiences that can allow us to more easily and scalably work with the thousands of devices that will soon be in each of our lives. Enter the conversational interface revolution, combining bots we can literally talk with, gesture to, and even direct with our thoughts, with embedded artificial intelligence, whic...
DevOps promotes continuous improvement through a culture of collaboration. But in real terms, how do you: Integrate activities across diverse teams and services? Make objective decisions with system-wide visibility? Use feedback loops to enable learning and improvement? With technology insights and real-world examples, in his general session at @DevOpsSummit, at 21st Cloud Expo, Andi Mann, Chief Technology Advocate at Splunk, explored how leading organizations use data-driven DevOps to close th...
SYS-CON Events announced today that Evatronix will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Evatronix SA offers comprehensive solutions in the design and implementation of electronic systems, in CAD / CAM deployment, and also is a designer and manufacturer of advanced 3D scanners for professional applications.
"We are an integrator of carrier ethernet and bandwidth to get people to connect to the cloud, to the SaaS providers, and the IaaS providers all on ethernet," explained Paul Mako, CEO & CTO of Massive Networks, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Sanjeev Sharma Joins June 5-7, 2018 @DevOpsSummit at @Cloud Expo New York Faculty. Sanjeev Sharma is an internationally known DevOps and Cloud Transformation thought leader, technology executive, and author. Sanjeev's industry experience includes tenures as CTO, Technical Sales leader, and Cloud Architect leader. As an IBM Distinguished Engineer, Sanjeev is recognized at the highest levels of IBM's core of technical leaders.
Leading companies, from the Global Fortune 500 to the smallest companies, are adopting hybrid cloud as the path to business advantage. Hybrid cloud depends on cloud services and on-premises infrastructure working in unison. Successful implementations require new levels of data mobility, enabled by an automated and seamless flow across on-premises and cloud resources. In his general session at 21st Cloud Expo, Greg Tevis, an IBM Storage Software Technical Strategist and Customer Solution Architec...