I am working on a system that needs to keep the data safe and not accessible to people without authorized access. The client is a web app that communicates with the servers via APIs. This is what I have so far:
__________ _____________ __________ | Server | | Server | | Server | | (Keys) | | (Web Files) | | (Data) | |__________| |_____________| |__________| | | | SSL SSL SSL | V | | __________ | ---------------> | Client | <--------------- |__________|
- Server (Web Files) servers the static files
- Server (Data) connects to DB (Data) and servers the encrypted data
- Server (Keys) connects to DB (Keys) and serves the user’s data key
The process would be:
- Client is served the static files by Server (Web Files) via SSL
- Client authenticates using Username/Password with Server (Keys) and gets their data key via SSL
- Client connects to Server (Data) and gets the encrypted data via SSL
- Client decrypts data using the acquired data key
- Client alters the data
- Client encrypts the data using the acquired data key
- Client sends the encrypted altered data to the Server (Data) via SSL
This way each server is isolated, but if someone gains access to Server (Keys), they can work their way to decrypting the data in Server (Data). Is there a way to make this more tight, so as if one of the servers or DBs is compromised, it would not compromise the security of the data? The current configuration is convenient but not set in stone.
- The customized and obfuscated encrypt/decrypt library is out of the window.
- The data would be private info and their security is mandated by the government with the very broad and vague “Private information should be protected against leakage and unauthorized access”.
- Up until now, the system was isolated and was operated within a closed network, locally (with the same design). We now need to allow broad remote access.
- If we turn over the encryption key to the client users, they become responsible for its safety and if they lose it, the data becomes inaccessible. If we need to be able to retrieve the data, we need to save the key on our servers as well (maybe by encrypting it with a master key, and make the retrieval process manual, instead of automatic).
- It is back to the drawing board.