Unusual WCF Security Scenario

See more:

WCF

security

service

Hi guys,

I am faced with a WCF security scenario that isn't particularly well documented online. I am developing a product licensing service in WCF that will be deployed along with our software. This licensing service will be responsible for a number of things related to controlling use of our software and connecting to our remote licensing server for updates, revocations etc. Consequently it's not the kind of service I want spoofed, and I don't really want spoof clients communicating with it either. As it's running on the same PC as the client can anyone suggest a security policy for this scenario? I'm particularly interested in authentication as most of the other security principles are straightforward. I'm reluctant to get into certificates if I can help it but as mutual authentication is a priority I'm beginning to think I may need to implement a custom 'challenge/verify' scheme between the service and client.

Any ideas? Thanks for reading.

Chris.