Improving Web Application Security: Threats and - CGISecurity

362 Part III: Building Secure Web ApplicationsClientProxyHost ProcessObjectFormatter SinkFormatter SinkCustomEncryption SinkCustomEncryption SinkSinkSinkTransport SinkChannelTransport SinkChannelChannelFigure 13.4Using custom encryption sinksAn encryption sink is a custom channel sink that you can use when you use a customhost with the TcpChannel. On the client side, the sink encrypts request data before itis sent to the server and decrypts any encrypted response data received from theserver. On the server side, the sink decrypts the request data and then encryptsresponse data.Implementing a Custom Encryption SinkThe sink should use asymmetric encryption to exchange session level encryptionkeys. After exchanging a session key, the client and server maintain a copy of the keyand either side may choose to create a new key at any time during the lifetime of thechannel sink. The server should maintain a different key for each client itcommunicates with.