Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a server which is composed of a page and a web service. The web service is intended to be used by a Windows Phone mobile application that I will develop myself.

Now, my question is, how do I identify that the web service request is coming from the mobile application I developed? On normal web applications, one can make use of a combination of certificates and digital signatures to ensure the identity of the caller.

The main problem is that Silverlight does not allow the developer to load the certificates installed on the mobile phone and get the private key to sign the data. I thought of hardcoding the private key into the application, however this is not secure at all as the application can be easily disassembled and reverse-engineered.

What else can I do to make sure that the web service request came from the mobile application I developed rather than from a normal web application?

share|improve this question
    
How much effort to put into this depends on what you are trying to accomplish. What is your goal? –  GdD Apr 29 '13 at 16:08
    
@GdD The web service will be used to make payments online using credit card details. Even though I authenticate the user everytime a call is made, I would like to verify that the call was made from the mobile phone app itself and not from a normal computer app. –  Joe Borg Apr 29 '13 at 16:17
add comment

1 Answer

You can add an API_key to your authentication process - something that a user needs to request first thing from the server. This initial request can contain device specific information, application specific information and user identity bits. Generated API_key can be a cryptographic hash function of that data.

A server stores all the API_keys and link a key to a user (if you want).

Only requests that have valid certificate and API_key are authenticated. You can then only allow one simultaneous log on with a valid API_key to mitigate API_key sharing.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.