Web Services provide an excellent way to talk between distributed systems. However, the data within the SOAP messages sent between systems may need to be encrypted when it contains sensitive information. There are several ways to handle this including the use of SSL, custom encryption, and a variety of up and coming standards such as WS-Security.
This sample application demonstrates how custom SOAP attributes can be used to encrypt only the sensitive parts of a SOAP message sent between systems rather than the entire message. This allows the message to stay intact while the sensitive data is still protected. While writing a custom encryption application admittingly is not always the best solution especially since Microsoft will likely release code that will handle this task automatically for you in the future (causing the custom solution to be discarded), it does provide an excellent environment for learning more advanced concepts of .NET Web Services.
To clarify what the application will do, examine the following SOAP message which contains unencrypted data that prying eyes could access:
By using the custom SOAP parameter encryption class in this sample application, specific parts of the SOAP message can be encrypted as shown below:
This encryption is accomplished by using asymmetric (Public/Private) key encryption. The client sends their public key to the Web Service within a SOAP header and the Web Service uses the key to encrypt sensitive parts of the SOAP message. The returned message is then decrypted by the client using their private key.
Parameters within the response SOAP message can easily be encrypted using the public key supplied by the client by simply applying the following attribute to a Web Method:
When applied to a Web Method, this particular attribute will cause the AccountID, AccountName, and AccountContact parameters returned to the client to be encrypted. The attribute can also be used to log incoming and outgoing SOAP messages to a file.
The downloadable sample code includes the Web Service and custom SOAP header and attribute classes within a project as well as a sample Windows Forms test client project.