Solved

(Discussion)How to secure the password of my database in my connection string?

Posted on 2006-10-26
6
264 Views
Last Modified: 2010-04-23
Everybodies comment is welcome... Please don't hesitate to give your Ideas...

How can I secure the password of my database in my connection string?

Here is my connection string...

"'Provider=Microsoft.Jet.OLEDB.4.0;Data Source=|DataDirectory|\Resources\dbRoomReservation.mdb;Persist Security Info=True;Jet OLEDB:Database Password=a"

I am using vb 2005 express...

Thanks in Advance.
{Jack}
0
Comment
Question by:JackOfPH
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 9

Assisted Solution

by:DjDezmond
DjDezmond earned 150 total points
ID: 17809960
You could encrypt and then store the whole connection string in the registry somewhere, and call it 'on-the-fly' decrypting it on the way...?

http://www.codeproject.com/dotnet/EnterpriseConectionString.asp
0
 
LVL 15

Author Comment

by:JackOfPH
ID: 17810141
Thanks for the input...

The method used above is nice especially if you are using sql server...
0
 
LVL 15

Author Comment

by:JackOfPH
ID: 17810149
Is there any more Ideas?
I am looking for any different ways in securing connection strings.
So, your comments are still welcome...

{Jack}
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 4

Accepted Solution

by:
escheider earned 200 total points
ID: 17810624
I encrypt and decrypt querystring variables in ASP.NET applications when the values hold sensitive information or information I don't want easily available.   I use an encrypt and decrypt function and pass the values to these functions whenever I interact with them.  You could do the same with your connection string password:


Public Class clsSecurity

    Private key() As Byte = {}
    Private IV() As Byte = {&H12, &H34, &H56, &H78, &H90, &HAB, &HCD, &HEF}
    Private sEncryptionKey As String = "12345678"  '64 bit key

#Region "Cryptography Section"
    Public Function Decrypt(ByVal stringToDecrypt As String) As String

        If Len(stringToDecrypt) > 0 Then
            Dim inputByteArray(stringToDecrypt.Length) As Byte
            Try
                key = System.Text.Encoding.UTF8.GetBytes(Left(sEncryptionKey, 8))
                Dim des As New DESCryptoServiceProvider
                inputByteArray = Convert.FromBase64String(stringToDecrypt)
                Dim ms As New MemoryStream
                Dim cs As New CryptoStream(ms, des.CreateDecryptor(key, IV), _
                    CryptoStreamMode.Write)
                cs.Write(inputByteArray, 0, inputByteArray.Length)
                cs.FlushFinalBlock()
                Dim encoding As System.Text.Encoding = System.Text.Encoding.UTF8
                Return IsNull(encoding.GetString(ms.ToArray()), "")
            Catch e As Exception
                Return e.Message
            End Try
        Else
            Return 0
        End If
    End Function

    Public Function Encrypt(ByVal stringToEncrypt As String) As String
        Try
            key = System.Text.Encoding.UTF8.GetBytes(Left(sEncryptionKey, 8))
            Dim des As New DESCryptoServiceProvider
            Dim inputByteArray() As Byte = Encoding.UTF8.GetBytes( _
                stringToEncrypt)
            Dim ms As New MemoryStream
            Dim cs As New CryptoStream(ms, des.CreateEncryptor(key, IV), _
                CryptoStreamMode.Write)
            cs.Write(inputByteArray, 0, inputByteArray.Length)
            cs.FlushFinalBlock()
            Return Convert.ToBase64String(ms.ToArray())
        Catch e As Exception
            Return e.Message
        End Try
    End Function
#End Region

End Class



0
 
LVL 18

Assisted Solution

by:DarrenD
DarrenD earned 150 total points
ID: 17810660
Hi,

Well the idea to encrypt the connection string / password is definitely the first step.

Personally I don't like the registry so I don't use it much. I prefer to use an XML file to store the encrypted string. When using .NET you could also just store the encrypted connection string in either an app.config file for a web.config file or even create your own config file.

I usually encrypt the entire connection string as opposed to the just the password but thats just me.

Hope this helped a little.

Darren
0
 
LVL 15

Author Comment

by:JackOfPH
ID: 17816229
Thank you very much...

0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Article by: jpaulino
XML Literals are a great way to handle XML files and the community doesn’t use it as much as it should.  An XML Literal is like a String (http://msdn.microsoft.com/en-us/library/system.string.aspx) Literal, only instead of starting and ending with w…
Well, all of us have seen the multiple EXCEL.EXE's in task manager that won't die even if you call the .close, .dispose methods. Try this method to kill any excels in memory. You can copy the kill function to create a check function and replace the …
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question