Encryption of password using MS SQL Server-2008

While developing a webpage/ application, generally we have to develop login panel to verify authenticity of the user. In any such panel we need password. Now main concern is to store the password in the database.

There are so many ways to encrypt the data. We usually find that any encryption method comes with its decryption as well. But using those processes we will make our passwords insecure. Recently I found a function in SQL Server-2008 that is developed for encrypting the password. For checking the password, it has an another method the compares the plane text password with the encrypted password.

For encrypting the password, the method is

PWDENCRYPT('plane_text')

and for comparing the encrypted string with plane string is

PWDCOPMARE('plane_text', encrypted_text)


first function encrypt the plane_text into nvarchar type string and second function returns 1 if both string is same else returns 0.

One more thing PWDENCRYPT('plane_text') method returns different values i.e two different encryption of same string results in different encrypted strings. This implies that every time string is encrypted with different keys and that key is also part of the encrypted string.

Example:

SELECT PWDENCRYPT('plane_text') AS EncrptedString

output: 0x010052FFF61F36AB06A3A2DEA6A1C736FF0B7C8C646F6883C3EB


SELECT PWDCOMPARE('plane_text', 0x010052FFF61F36AB06A3A2DEA6A1C736FF0B7C8C646F6883C3EB) AS isSameString

output: 1


Note: When you will run first query, it's output will not be the same as mine as discussed above. But second query will return 1 as both are same string.

Getting System Information Using IP Address

We usually find the system support people maintaining the IT inventory manually. They visit to each machine and note down the related information like Model No, Serial No, Operation System, Processor, HDD capacity, RAM etc. Manual work comes with some human errors. So taking all point into the consideration I recently develop an application that fetches above metioned information only after passing the IP address of the machine. For that you will be needed admin username and password.

For this purpose I have taken help of WMI (Window Management Instrumentation) . WMI is the infrastructure and management data and operation on windows based OS.

The Win32_OperatingSystem WMI class represents a Windows-based operating system installed on a computer.

Using Win32_OperatingSystem, we can get various information like

Computer Name,

Description of Operating System,

Free Physical Memory,

Serial No.

and many more... for complete list visit http://msdn.microsoft.com/en-us/library/aa394239.aspx

The Win32_LogicalDisk WMI class represents a data source that resolves to an actual local storage device on a computer system running Windows.

Using this class I have just calculated the total HDD capacity.

For more details visit http://msdn.microsoft.com/en-us/library/aa394173%28v=vs.85%29.aspx

The Win32_ComputerSystem WMI class represents a computer system running Windows.

Using this class I have been able to get Total Physical Memory.

For more details visit http://msdn.microsoft.com/en-us/library/aa394102%28v=vs.85%29.aspx

The Win32_Processor WMI class represents a device that can interpret a sequence of instructions on a computer running on a Windows operating system.

Processor info can be collected using this class.

For more visit http://msdn.microsoft.com/en-us/library/aa394373%28v=vs.85%29.aspx

MAC address info is put under Win32_NetworkAdaperConfiguration class. Using Win32_ComputerSytemProduct class we can get Model No and Serial of the system.

I have created a class named SystemInfo to get above mentioned information. Here is the code...

using System;

using System.Management;

public class SystemInfo

{

ConnectionOptions options = new ConnectionOptions();

public string ipAddress { get; set; }

ManagementScope scope;

ObjectQuery ObjQuery;

ManagementObjectSearcher MgtObjSearcher;

ManagementObjectCollection MgtObjCollection;

public SystemInfo()

{

options.Username = "admin_username";

options.Password = "admin_password";

}

//get ComputerName, OS, HDD Size and RAM, Processor....

public string[] getSystemBasicInfo()

{

string[] strSysInfo = new string[5];

ManagementScope scope = new ManagementScope("\\\\" + ipAddress + "\\root\\cimv2", options);

try

{

scope.Connect();

ObjQuery = new SelectQuery("SELECT * FROM Win32_OperatingSystem");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

foreach (var m in MgtObjCollection)

{

strSysInfo[0] = m["csname"].ToString(); //Computer Name

strSysInfo[1] = m["Caption"].ToString(); //OS Description

}

//HDD size in GB...

ObjQuery = new SelectQuery("Select * from Win32_LogicalDisk");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

double DiskSize = 0;

foreach (var m in MgtObjCollection)

{

DiskSize += Math.Round(Convert.ToDouble(m["Size"]) / (1024 * 1024 * 1024), 2);

}

strSysInfo[2] = DiskSize.ToString();

//RAM...

ObjQuery = new SelectQuery("Select TotalPhysicalMemory from Win32_ComputerSystem");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

foreach (var m in MgtObjCollection)

{

strSysInfo[3] = Math.Round(Convert.ToDouble(m["TotalPhysicalMemory"]) / (1024 * 1024 * 1024), 3).ToString();

}

//Processor...

ObjQuery = new SelectQuery("Select * from Win32_Processor");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

string sCpuInfo = String.Empty;

foreach (var m in MgtObjCollection)

{

strSysInfo[4] = m["Name"].ToString().Trim();

}

}

catch(Exception exp)

{

Utility util = new Utility();

strSysInfo = new string[5] { util.getErrorMessage(exp), util.getErrorMessage(exp), "0.0", "0.0", util.getErrorMessage(exp) };

}

return strSysInfo;

}

//get MAC Address...

public string getMACAddress()

{

ManagementScope scope = new ManagementScope("\\\\" + ipAddress + "\\root\\cimv2", options);

scope.Connect();

ObjQuery = new SelectQuery("Select * from Win32_NetworkAdapterConfiguration");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

string strMACAddress = "";

foreach (var m in MgtObjCollection)

{

if (m["macaddress"] != null)

{

if (Convert.ToBoolean(m["IPEnabled"]))

{

strMACAddress = m["macaddress"].ToString();

strMACAddress = strMACAddress.Replace(":", "-");

break;

}

}

}

return strMACAddress;

}

//get Serial No....

public string getSerialNo()

{

ManagementScope scope = new ManagementScope("\\\\" + ipAddress + "\\root\\cimv2", options);

scope.Connect();

ObjQuery = new SelectQuery("Select * from Win32_ComputerSystemProduct");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

string strSerialNo = "";

foreach (var m in MgtObjCollection)

{

strSerialNo= m["IdentifyingNumber"].ToString();

}

return strSerialNo;

}

//get Model No....

public string getModelNo()

{

ManagementScope scope = new ManagementScope("\\\\" + ipAddress + "\\root\\cimv2", options);

scope.Connect();

ObjQuery = new SelectQuery("Select * from Win32_ComputerSystemProduct");

MgtObjSearcher = new ManagementObjectSearcher(scope, ObjQuery);

MgtObjCollection = MgtObjSearcher.Get();

string strModelNo = "";

foreach (var m in MgtObjCollection)

{

strModelNo = m["Name"].ToString();

}

return strModelNo;

}

}