Hi.
I want to make a client-server application used for reservations.
The client is a pocket pc 2003 CF2 and the server app is a basic C# application running on a Windows XP Sp2. I am using VS 2005 and C#.
So the basic idea is that the Pocket PC is connected by WIFI to the windows machine running the C# app.
With the PP you should be able to make a reservation which will be shown in the C# app and the pp should be able to show reservations made by the C# app.
1) Is the smartes thing here to use web services or .NET remoting
2) When using web services, how can the C# app update the reservations made by the client PP Synchronization
3) What about security Is it possible to implement a SSL connection between the client and the C# app Is it possible to use SSL with Pocket PC 2003 or should other security mechanisms be considered
4) Is it possible to use WSE 3.0 with pocket pc 2003 to sign SOAP messages etc.
Thanks in advance, I hope to hear from you soon.
- Nima
Reservation System
chill_pill
TOM v E >> You are right, maybe I should consider hosting a website instead of a pocket app. So can can you help me with the security issues related to using a website
I have just played around with SSL, which my "hello world" web service requires. Maybe it is easier to implement SSL with a website instead of the pocket app
I'm running IIS 5 and want to host my webservice and my website on that. I have made a test certificate wich is installed on the IIS server. When I browse my web service on my pda it prompts up asking if i want to accept the certificate before I can see the web service, so that works until now.
So by using a website I don't have to have install a certificate on the Client, I just use the one which comes up from the Server
- Nima
Ramyakeerthi
1. There's no remoting on NETCF, so you can choose between WS, MSMQ and sockets. I would suggest MSMQ/System.Messaging.
2. It could not unless device would connect and check for updates (pull). With MSMQ server could send updates to devices.
3. Yes, it's possible to use SSL with WS. Or you could encrypt data manually.
4. No, WSE 3 is not supported on devices.
Shaun Wilde
So you have an objection against installing SSL certificates on customer PDAs But keep in mind that you have to install the software on the customer's PDA as well. And from the situation you're describing it does not seem easy to do so; the customer would need ActiveSync to put the app on his PDA. Imagine doing that in a hotel lobby. I think that the hassle would put off a lot of customers.
Wouldn't it be much easier to host a website which is accessible from the PDA This would solve your synchronization problem, and the customer wouldn't need to install anything extra on their PDA.
UserVBA
1. Use SSL.
2. That is up to you to ensure delivery completeness and data integrity.
3. Use client certificates (probably answers you next question as well).
I probably would use SSL as it does a lot for a little.
Piers Lawson
Imagine a reservation system on a hotel based on a single desktop app and several clients, customers private pda's. The hotel offers the customers to use their own pda to book meeting-rooms and several other services.
Each customer gets a username and a password. The client pda's use a webservice hosted on a IIS server which also runs the C# app. When a client makes a reservation, the desktop app, which also use the same webservice, should see this reservation (pulling) and virse versa.
The PDA connects to the server with local WIFI.
So looking at a security point of view :
By using SSl, all the clients are enforced to install a certificate. Is their another approach instead of using SSL! Is it possible to sign and encrypt their messages using their password
I'm am not familiar with the security issues related to PDA's, so i'm very thankfull for your help.
This system is made for a project on a C# course at the Technical University of Denmark, and not for commercial use.
- Nima
Ayman Farouk
Lets say I choose to use web services instead of MSMQ, how would you provide security in terms of :
1) Message confidentiality
2) Message integrity
3) Client authentication
Would you use SSL between the client and the WS If you use SSL with WS, is it necessary for both the the server and the client to certificate, or does the client just request a certificate from the webservice when connecting/authenticating
Or should I skip the SSL part and get around with encrypting data manually
- Nima