I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the communication between client and server is over the Internet.
What I'm looking for, is a way to ensure that the web-service can only receive requests from those physical machines that I originally installed the client-application on.
The computers will be running some kind of Windows, I'm not exactly sure which edition yet. And the web-service will be WCF-based.
My current thought is to install a client certificate on the machines, and use that for authentication on the web-service. I'm unsure of how or if there is a mechanism to lock the certificate to the physical machine, or just password protect it in order to prevent it from being exported and installed on another machine.
My knowledge of certificates is very basic, which is why I am asking if this seems like a viable approach, or if there is another way that would work better.
Edit: I realize that my original question was a bit vague about how secure I want this to be.
The client-application may be considered as a daily annoyance to the users that are forced to use it. And one of the points with the application, is to be able to tell that a person was at this location/computer at a certain point in time. So I want to be able to tell from my web-service that the request did not originate from "my machine". This is all in order to prevent the "annoyed user" from thinking up schemes to avoid having to be at the location where the client-app computer is located. Such as simply copying the application to a laptop computer.
So, it is more about preventing the simple ways to get around using my installations of the application from one of my computers. And the user type isn't someone with an IT background.
Thanks for the many helpful answers so far