I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly.

This of course mean that the client SW needs a username and password to be able to open connection to database. All of these are configured and stored in Windows registries. Currently stored credentials are encrypted using symmetric key which is hardcoded together with initial vector in code.

Moreover the client SW is distributed with configuration to other places.

From my point of view this is not correct approach as the credentials can be retrieved when you have access to system. I understand that it should be somehow encrypted so it is not distributed in clear text, but still...

I am thinking and trying to find the right solution to secure password and access to database and I always end up with the change of architecture from 2-layer to 3-layer, where backend server will publish API, have a user management, and only server backend application will have a direct access to database installed on it.

Do you think it can have a better solution? In a current setup I think I can only protect credentials using encryption or obfuscation to make it harder for potential attacker to retrieve it. For someone with the knowledge of the SW will be easy to get it.

  • This question raises several other questions before a proper answer can be given. Is there an active directory? What database (DBMS) is used? Please tell us a little more about the environment. – Jeroen Apr 18 '18 at 5:21
  • Yes, there is AD and database on backend is MSSQL. – user1563721 Apr 18 '18 at 5:52
  • Just to be clear, how is the password transmitted? Is it in clear text or transmitted as it was stored (encrypted using hardcoded symmetric key and IV)? In the latter case, can you tell use something more about the encryption (AES-ECB,...)? – A. Darwin Apr 18 '18 at 6:52
  • Why not use integrated authentication in MSSQL? This way you avoid all hassle as active directory takes care of everything for you. – Jeroen Apr 18 '18 at 7:28
  • The password is transmitted encrypted using AES in CBC mode with IV and key hardcoded in application. This is because the configuration is replicated to more than one client. The authentication to database is currently different from AD because there are users that do not have account in AD and they should still be able to login locally and use client application. – user1563721 Apr 18 '18 at 7:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.