0

What native technology exists to encrypt/decrypt a string in the database for reading into a single application?

Scenario:

I have a set of connection strings that I need to use to securely access a set of production servers, for a polling application. I would like to store those in a table in a database and pull them out as I need them via a service. That will give me the ability for a handful of users (with permissions) to edit/add those entries.

My target audience using this application are all developers, these are servers to monitor our production and staging environments for some specific SQL flaws that I may need to later fix. This is a devops application.

Knowing that my target audience is developers, and that these are production servers, I would like to "lock the door" to keep people from actively seeing the production passwords/useraccounts unless they need them (auditing purposes). I realize that a lock is only as good as the frame around the door, and is only to keep honest people and petty thieves out, and that anyone dedicated will eventually be able to get past whatever safeguards I try to set.

Problem:

What technology in C# exists to secure this information and still allow me to dynamically add/alter connection strings but still keeps the data in the database reasonably secure? I am willing to make some changes to a machine.config or the like, but I need to actively develop the application too, so would like if it could be done in either machine.config1 or web.config, to allow for local development before deployment to the devops servers.

I understand that some of my alternative suggestions are:

  • Use strong database passwords to keep people out
  • Use strong schema organization to keep people out
  • Trust the developers, they work for your org (see "audit trail". I need to make some stab at securing production credentials)
  • Don't let people have access to the server and store them in the web.config (already plan on this in the first place)

Ideally:

Ideally I would just use a private key for encryption/decryption on the application server, but I don't exactly know the most secure way to do this, other than base64. I know this is not encryption.

What technology exists in the .NET native stack to securely encrypt/decrypt a string that may contain special characters in a single application and what is an example usage of this technology?

If I knew a name and technique, I would not be asking this question.

1 using machine.config/web.config to indicate something inherent in the .NET stack. I'm open to any suggestions.

3
  • 2
    Have you checked System.Security.Cryptography? Here is a Sample
    – Pantelis
    Apr 8, 2014 at 22:56
  • Don't forget that the database probably has some method for encrypting and decrypting as well. Apr 9, 2014 at 1:30
  • database encryption != wire encryption, right? I don't care about how the data is stored on the disk, I care about what select * says...
    – jcolebrand
    Apr 9, 2014 at 3:27

2 Answers 2

2

Saving connection information in a database table is going to be unsecure, always. At some point, you're going to have to decrypt the password, and send it to the server. Developers tend to be smart enough to figure out any "security by obscurity" approach, and get to the passwords at some point. Even if you encrypt the password in the DB (not too hard), as long as you pass it to the SqlConnection at some point, you still have to decrypt it somewhere on the user (developer) end.

Rather, the only way to do this securely, is to make sure the password actually never gets anywhere close to the developers (or anyone else). There's a few ways to handle this:

  1. Use an external security provider, such as Windows authentication. This means you don't have to use any username or password at all.
  2. Create some kind of a tunnel to send any required SQL. This is very easy if your developers only ever need to run SQL commands, and a bit trickier if they want to use productivity tools like Management Studio; however, even that's doable - SQL can run fine over TCP, and you should be able to emulate that quite easily. Only the tunneling server would have access to the actual credentials, your developers would only have credentials to the tunneling server (and limited ones at that).
  3. Use the Linked servers feature. This allows you to link local users (your devs) to remote users (su on the target server or whatever). It should work just fine with all the usual security settings.

Out of these, I'd say linked servers might be the best. They're quite easy to use, they can be administrated by the select few, and they don't publish the password at all. You can also do queries that span servers this way - very handy for a maintenance tool :)

Windows authentication is incredibly useful, but usually only on LAN, since we're talking about having all the DB servers in a domain. VPN could help, but that's getting into complicated territory.

Using a tunnel isn't necessarily a bad idea, although I assume you'll run into a few issues before you get it working 100%. And in the end, that's what Linked servers do for you for free, so why not use that?

Now, if you really do want to go through with the encryption idea instead, you can pick from a plenty of .NET supported encryption schemes. AES should work fine - it's assymetrical, so knowing the encryption key doesn't mean you can decrypt the data (the decryption / private key should only be stored in a secure location and on the maintenance application server, in a place noone but the application itself can reach; do note that admins can reach anything, so if your people have administrator rights, this isn't going to work).

For an example, see the AesManaged class in System.Security.Cryptography - http://msdn.microsoft.com/en-us/library/system.security.cryptography.aesmanaged(v=vs.110).aspx

8
  • So, in discussing linked servers with a few DBAs, they are all quite against setting up linked servers with production servers that don't need to be, because one transaction across the link can literally stop your production server if something goes south, and since I'll be connecting from a dev environment to monitor production, I don't precisely want to run that risk.
    – jcolebrand
    Apr 9, 2014 at 15:32
  • As far as "it has to be decrypted at some point, they can just debug against that" well, that requires they are able to have the key to decrypt with, and if I store the key outside of the application, as I indicated in the question with references to machine.config then I don't have to worry about them knowing the key, so they can't debug and find the value. Therefore I can restrict development of this particular application to a handful of people who are given the keys to decrypt.
    – jcolebrand
    Apr 9, 2014 at 15:34
  • If they don't have permissions to run devenv on the servers, and the firewall doesn't permit connections to the debug ports, then how exactly are they going to decrypt the contents in the connection string?
    – jcolebrand
    Apr 9, 2014 at 15:35
  • @jcolebrand Fair enough about the remote transactions. I'm pretty sure this is not a problem if you're only doing reasonable queries, but I can understand the reluctance. As for the rest, as long as noone but your trusted devs can run anything on the maintenance server (where the decryption key is), your approach can work quite well. As long as there's no security issue in your maintenance application, of course. You want to be extra careful about any service that runs on the machine.
    – Luaan
    Apr 9, 2014 at 15:58
  • @jcolebrand But in any case, do not think even for a second that you could hide it from the devs of the maintenance application. You have to trust someone.
    – Luaan
    Apr 9, 2014 at 15:59
-1

Most applications only need one database, but you can use the Manager to create as many as you need. Multiple databases are independent of each other. If your application supports switching between multiple users, each with their own separate content and settings, you should consider using a database for each user. Otherwise, it's usually best to stick with one database.

1
  • Welcome to StackOverflow! I'm afraid this is not really an answer, but should rather go in a comment. Especially considering what value it adds to a question that was asked and answered 2014. Mar 6, 2018 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.