自定义身份验证Soap头进行加密解密

作者:ym110 日期:2008-07-07

字体大小: 小中大

在上篇文章中我们了解了使用自定义SOAP头进行身份验证，使webService服务的身份验证变得灵活，简便。
但是是以明文的方式在网上传输，不能保在传输的过程中被别人截取。所以，为了保证安全性我们必须对，Soap头进行加密，密文的方式传输。

  废话就不多说了，下面我们看看下面的简单的例子：

  首先我们在客户端进行对数据的加密：这里我们使用的是64位DES加密算法。

  设置密钥（Key）和初始值（IV）可放在配置文件中：
  <appSettings>
    <add key="Key" value="fdautoit"/>
    <add key="IV" value="FDAUTOIT"/>
  </appSettings>
*注：上面的值只有8个字节（64位）
在.cs文件中获取“Key”和“IV”
string Key, Iv;

            Key = ConfigurationManager.AppSettings["Key"];
            Iv = ConfigurationManager.AppSettings["IV"];

定义一个加密方法：
private string Encrypt(string p_strEncrypt)
        {
            //Set the Key and the InitialVector for Encrypt
            byte[] key = Encoding.UTF8.GetBytes(Key);
            byte[] iv = Encoding.UTF8.GetBytes(Iv);
            //Convent the string to byte[] of the Data
            byte[] byteData=Encoding.UTF8.GetBytes(p_strEncrypt);
            //Set Memory space for save the Data
            MemoryStream memoryData = new MemoryStream();
            //
            //DES des = new DESCryptoServiceProvider();
            //RC2 des = new RC2CryptoServiceProvider();
            //Rijndael des = new RijndaelManaged();
            TripleDES des = new TripleDESCryptoServiceProvider();
            des.Key = key;
            des.IV = iv;
            des.Mode = CipherMode.CBC;
            //Create  the Method with the Key and IV
            ICryptoTransform transform = des.CreateEncryptor();
            //Create the EnCrypt stream
            CryptoStream cryptostream = new CryptoStream(memoryData, transform, CryptoStreamMode.Write);

            //write into the Memory stream
            try
            {
                cryptostream.Write(byteData, 0, byteData.Length);
            }
            catch
            {
                throw new Exception("Encrypt Data wrong of the write to stream!");
            }
            cryptostream.FlushFinalBlock();
            cryptostream.Close();
            //return memoryData.ToString();
            return Convert.ToBase64String(memoryData.ToArray());
        }在这个方法返回的是一个加密后的数据。 private void ValidServiceMethod()
        {
            //Encrypt the username and password of SoapHeader
            string m_strName = Encrypt("admin",EncryptionAlgorithm.Des);
            string m_strPwd = Encrypt("admin",EncryptionAlgorithm.Des);
            //new a  SoapHeader and a WebService
            MySoapHeader myheader = new MySoapHeader ();
            MyService myservice = new MyService();
            myheader.UserName = m_strName;
            myheader.PassWord = m_strPwd;
            //Set the SoapHeader validate to Service
            myservice.FDSoapHeaderValue = myheader ;
            //Call Method of webservice
           myservice.GetMoney();
        }

  这样就完成了加密的过程（用户名，密码，数据可以以参数的形式传入）
在服务器端同样设置配置文件。这于客户端的是一模一样的。
<appSettings>
    <add key="Key" value="fdautoit"/>
    <add key="IV" value="FDAUTOIT"/>
  </appSettings>同样在代码文件中获取其值
  编写解密方法：
private string Decrypt(string p_strDecrypt)
        {
            // Set the Key and the InitialVector for Decrypt
            byte[] key = Encoding.UTF8.GetBytes(Key);
            byte[] iv = Encoding.UTF8.GetBytes(Iv);
            //Covent the string to byte[] with the Encrypt Data
            //byte[] EncrypData =Encoding.UTF8.GetBytes(p_strDecrypt);
            byte[] EncrypData=Convert.FromBase64String(p_strDecrypt);
            // Set the Memory stream Space for save data
            MemoryStream memoryData = new MemoryStream();
            // Create DES for Decrypt
            DESCryptoServiceProvider des = new DESCryptoServiceProvider();
            des.Key = key;
            des.IV = iv;
            des.Mode = CipherMode.CBC;
            // Decrypt with the key and InitialVector
            ICryptoTransform transform = des.CreateDecryptor();
            //Save to MemoryStream
            CryptoStream cryptostream = new CryptoStream(memoryData, transform, CryptoStreamMode.Write);
            //output the data
            try
            {
                cryptostream.Write(EncrypData, 0, EncrypData.Length);
            }
            catch(Exception ex)
            {
                throw new Exception("write to stream wrong!"+ex.Message);
            }
            cryptostream.FlushFinalBlock();
            cryptostream.Close();
            //output data
            return Encoding.UTF8.GetString(memoryData.ToArray());
        }

Soap头:
public class MySoapHeader : SoapHeader
    {
        string _name;
        string _passWord;

        public string UserName
        {
            get { return _name; }
            set { _name = value; }
        }
        public string PassWord
        {
            get { return _passWord; }
            set { _passWord = value; }
        }
    }
更改上篇中的方法：

public bool ValiHeader(out string ReturnMsg)
        {
            MySoapHeader myheader=new MySoapHeader();
            bool flag = false;
            string UserName=Decrypt(myheader.UserName);
            string PassWord=Decrypt(myheader.PassWord);
            if (UserName == "admin" && PassWord == "admin")
            {
                flag = true;
                ReturnMsg = "You Are Successfully";
            }
            else
            {
                ReturnMsg = "You Are Failted";
            }
            return flag;
        }
[WebMethod]
[SoapHeader("header", Direction = SoapHeaderDirection.In)]
public string CheckHeader()
        {
            string ReturnMsg="";
            bool IsTrue=ValiHeader(out  ReturnMsg);
            return ReturnMsg;
        }
如果方法：“ValiHeader”返回的是true 表示验证成功，如果返回的是false表示用户名和密码有误。

有关SoapHeader验证头密码核心代码就是这样了。其中省略了很多代码。

推荐好友: