如何缓存的eToken密码为多个进程 [英] How to cache eToken PIN for multiple processes

问题描述

我有一个使用的x509Certificate2在'我的'证书存储，最初从的eToken设备未来的.NET（C＃）应用程序。

I have a .NET (c#) application which uses the x509Certificate2 in the 'my' Certificate Store, originally coming from an eToken device.

当我使用证书（解密数据，或者使用它作为Web请求一个clientcert），它会要求设备PIN一次。在此之后，它的缓存，用户是不是每XX分钟密码请求困扰。

When I use the certificate (to decrypt data or use it as a clientcert for web requests), it will ask for the device PIN once. After that, it is cached, the user isn't bothered with the password request every xx minutes.

现在，我有多个进程，所有使用的证书。
，每个进程都将要求器件的引脚。 （缓存似乎是每个进程）。

Now, I have multiple processes, that all use the certificate. Each of these processes will request the device PIN. (the cache seems to be per process).

有没有解决这个简单的方法？
能我的地方高速缓存吧，让每一个进程可以在不一遍一遍请求PIN码访问令牌？

Is there an easy way around this? Can I 'cache' it somewhere, so that every process can access the token without requesting the PIN over and over again?

推荐答案

提醒一句：这是非常糟糕的安全习惯做这种PIN缓存。任何凭证应简要地仅作为可能的存储在存储器中，以避免攻击者通过监视系统的存储器获得的PIN信息。虽然一般这需要对机器进行本地访问，这仍然被认为是一个非常相关的威胁，因为大多数时候，你不希望系统管理员探听到引脚上：）

A word of caution: It is really bad security practice to do this kind of 'PIN' caching. Any credentials should be stored in memory only as briefly as possible in order to avoid attackers to gain information on the PIN by monitoring the system's memory. Although in general this would require local access to the machine, this is still considered a very relevant threat, because most of the time, you don't want sysadmins to snoop into PINs either :)

这是说，它是不必输入PIN每隔一秒用户一个真正的PITA。由于有这么多的东西安全，有安全性和可用性之间的权衡。

That said, it's a real PITA for users having to enter the PIN every other second. As with so many things security, there is the tradeoff between security and usability.

许多智能卡驱动程序做这种形式的缓存本身，你注意到的。通常有两种证书/密钥卡上，其中一个被视为高安全性的操作，如在文档提供的签名不可否认密钥使用，另一种认为是用于这种不断重复的琐事的认证证书作为一个服务进行身份验证。通常情况下，你必须重新输入PIN每次访问不可否认的关键时间，而司机往往会缓存认证密钥的PIN码。

Many smart card drivers do this form of caching themselves, as you noticed. Often there are two certificates/keys on the card, one with non-repudiation key usage deemed for high security operations such as providing a signature on a document, the other one deemed an 'authentication certificate' that is used for ever-recurring chores such as authenticating with a service. Typically, you have to re-enter the PIN each time you access the non-repudiation key, whereas the driver often caches the PIN for the authentication key.

所以，它真的取决于你的特定用例 - 如果你考虑的操作是非常重要的，我会建议对任何做任何缓存。尝试'教育'用户来代替。这是为自己好，等等，等等：）

So it really depends on your particular use case - if you consider the operation to be highly critical, I would advise against doing any caching whatsoever. Try to 'educate' users instead. It's for their own good, etc. etc. :)

否则，如果你考虑的风险是可以接受的，你可以使用任何形式的进程间通信的最适合您共享跨进程的PIN码。一个简单的解决方案是建立在只有在应用程序上的读/写权限的目录中的PIN文件'。检查文件是否存在，只要在需要PIN（小心的竞态条件！） - 如果文件不存在呢，索要密码，并将其写入文件 - 否则只需读取文件的PIN码。确保覆盖与被用来传达PIN零的内存。

Otherwise, if you consider the risk to be acceptable, you may use any form of interprocess communication that suits you best to share the PIN across processes. A simple solution could be to create a 'PIN file' in a directory that only the application has read/write permissions on. Check for file existence whenever the PIN is needed (beware of race conditions!) - if the file is not present yet, ask for the PIN and write it to the file - otherwise simply read the PIN from the file. Make sure to overwrite the memory with zeroes that was used to convey the PIN.

这篇关于如何缓存的eToken密码为多个进程的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！