Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret password to decrypt the secrets that are used. Bearing that in mind, without a secret stored in a humans head, how can an automated system secure the keys it uses so that it protects the secrets from access by anyone (hacker or authorized user) browsing the server source?

The best method I can come up with is for the system to only use temporary access keys that get cleared when the process is complete, with the resulting data stored using asymmetric encryption for the user. Aside from that, are there any other methods for allowing secure automated processing on encrypted data?

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

There are a large number of ways to do this. Simplest is this:

  • A key thing you need to remember is that you don't need to store authentication keys or tokens where an attacker can get them!

On a well configured webserver you have public and private environments, and they can be well segregated.

share|improve this answer
    
yeah, i thought it would be something similar to that. thanks anyway –  cgoddard Jan 14 '13 at 22:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.