0

My employer has a system that clinicians use to capture video data for patient bookings. This comprises two applications running on Windows:

  • A GUI application (Electron/Javascript)
  • A local service (C#).

Both applications need to access our API over the internet.

Users must log into our API with their own account and password but they do so from the GUI application that runs on a computer with shared login credentials (shared between all clinicians at a site).

The two apps currently communicate over RPC (I plan to switch this to a local REST service in future).

  1. What is a secure way to authenticate with our API from the C# service, given I only want the user to log in once, using the GUI application?

  2. Can those authentication credentials be securely stored for use later by the C# service on a shared-access computer?

Background:

The GUI application is used to login (authenticating with our internet API) and get the list of available patient bookings for the user (over same secure API). The user then selects one of the bookings and captures some video data for it. Once video capture has completed, the GUI app hands the data over to the C# service.

The C# service's job is to run continuously in the background and perform time-consuming processing work on captured video data. Once that processing has been completed, some results data needs to be uploaded to our internet API.

We don't want the user to have to wait until this post-processing has completed (it may take 10 minutes or so) so we want them to be free to close down the GUI application and still have uploads occur in the background while the computer is running.

I would like to be able to restart the computer and have the C# service (which runs at startup) pick up where it left off with processing and uploading data. For this, I'd need to securely store the credentials of the user who performed the capture so they can be read back.

I've considered passing the credentials in plaintext over RPC when a user logs in successfully so both app are aware of them. This answer indicates there is no need for interprocess encryption on the same machine, but I'm not sure if that is reasonable given the user account used to access the computer is shared. I'm also not sure if it's possible to securely encrypt the credentials for use later without re-authenticating to unlock them in some way. (Our API password is not tied in any way to the password used to log into Windows and we don't want to integrate those as we may move away from Windows in the future).

Any help appreciated, thanks

bemo
  • 25
  • 4

1 Answers1

0

Use an authentication token:

  1. User logs in via GUI

  2. API returns an authentication token

  3. User captures whatever he needs, and sends data and token to C# service

  4. C# processes all data, sends data plus token to API

This way username and password are not saved locally. Make sure to have a sane expiration time for the token, and don't let it be reused.

ThoriumBR
  • 50,648
  • 13
  • 127
  • 142
  • Thank you @ThoriumBR. Using a token is a good suggestion, but is there a way this could be securely stored for use after a reboot? I'm not sure what to encrypt it with that would be actual security rather than obscurity since others on the system will have access to the application and its state. – bemo Jan 22 '21 at 16:02
  • You don't need to care much about reboots. If any user restarts the computer, the information must be processed again, so the owner of that job have to login again. And the computer will (hopefully) not reboot multiple times per day. – ThoriumBR Jan 22 '21 at 18:25
  • Thanks for your suggestions! – bemo Jan 22 '21 at 20:58