InfoPath Dev

Hi,

My organisation is looking to transfer forms over email and we realise that people can potential tamper with the XML before sending it off. Does anyone know if Infopath provides encryption technology to secure the form during transfer?

Is there a better way (perhaps using standard functions in InfoPath) to check whether a form has been tampered with before sending?

Good question. I was actually at a Microsoft Code Camp on Security over the weekend in Washington, DC and there was a speaker going over XML Signatures. You can implement signing of XML out of the box with InfoPath. I have only played around with it, but I did not actually implement. Here are a link you can use to start your research.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/odc_ip2003_tr/html/odc_INF_Lab_10.asp

This lab discusses how to sign the entire document or sign a piece of your XML.

We've used signing for many projects. It works well.

Patrick Halstead [InfoPath MVP]
InfoPathDev

Thanks for the article you posted. I have attempted your suggestion of signing the form entirely or partially and it successfully protected my data in InfoPath. However, it did not solve my problem of tampering the XML file transmitted over an email attachment. If I receive a submitted form over email, I can still download it and change the data and save in notepad. When I open the modified form, the hacked data will appear and InfoPath will protect the fake data.

Is this what a DigiSig only meant to do (protect data in InfoPath)? Is DigiSig the right solution for my manually-editing-xml-in-notepad problem? Or there are alternatives for this?

OK, after several hours of experimenting in InfoPath, I have found out that if you save a SIGNED xml form and edit it in notepad and then opening it in InfoPath, InfoPath will determine for you whether the file's data was changed. But the user will have to access the tools > digital signature > view signed form > and read message about breach of form data. Which is a bit too much for the normal user I think, but nonetheless, it's good to see this mechanism exist. And I wish to continue this issue on a new thread.

And I did find out that InfoPath does not provide encryption for the xml file.

Does signing the form keep you from being able to see the data connection username and password?

Is there another way to just protect the username and password used for the data connection? I build all the security I want into the form but I dont want users to have any access to just connect to the SQL server and see things in the tables theyre not supposed to. If you use the default windows authentication and give users Select, Insert and Update rights in order to enter data into the form, I dont know how this can be prevented...

Any ideas?

Can you secure the data connection if you do it via code? and if so are there any examples of this?

quote:

---

Originally posted by Patrick Halstead

We've used signing for many projects. It works well.

Patrick Halstead [InfoPath MVP]
InfoPathDev

---

well you can encrypt the data in the infopath form before saving or submiting it

below is the code to encrypt a field in InfoPath 2007.

             Rijndael rKey = new RijndaelManaged();
            XPathNavigator xnFormName = null;
            XPathNavigator totalNode = this.MainDataSource.CreateNavigator();

            xnFormName = totalNode.SelectSingleNode("/my:myFields/my:field1", this.NamespaceManager);

            string totalNodeOriginal = xnFormName.ToString();
            byte[] totalInfo =
                System.Text.Encoding.Unicode.GetBytes(xnFormName.ToString());
            MemoryStream ms = new MemoryStream();
            CryptoStream csBase64 = new CryptoStream(ms,
                 new ToBase64Transform(), CryptoStreamMode.Write);
            CryptoStream csRijndael = new CryptoStream(csBase64,
                 rKey.CreateEncryptor(), CryptoStreamMode.Write);
            csRijndael.Write(totalInfo, 0, (int)totalInfo.Length);
            csRijndael.FlushFinalBlock();
            string base64enc = System.Text.Encoding.ASCII.GetString
                (ms.GetBuffer(), 0, (int)ms.Length);
            xnFormName.SetValue(base64enc);

hope this solves your problem