Which encryption technique should be used for cloud computing data transfer?

Question

I want to setup my application for cloud computing for Software as a Service. There is going to be a lot of data transfer between my server and client, to and fro. The technique I have envisaged is:

1. Even the smallest communication must happen through file transfer.
2. The file must be created in binary at the source whose file format is understood only by my application.
3. The binary file is then encrypted by AES 256 encryption which requires another file for decrypting instead of a string.
4. The generated file is transmitted via SFTP.
5. The client and server applications will communicate with each other using some non-standard port like say 7238 (random) instead of the standard 80.

I am looking forward to critical suggestions to my technique as I have little experience in networking applications and encryption. Note: The key file used for encryption is already present at both the server and the client.

EDIT: As asked by Steffen here is what I want to protect: 1. Protect the server from getting hacked 2. In case the server is hacked the data stored on the server should be encrypted such that it is useless to the hackers 3. Transfer data to and fro the server and client without leaking it to an eavesdropping hacker

Answer 1

The first step in securing anything should be to evaluate what you need to secure and where somebody might attack you (attack surface). I don't know what you have to protect, but since you are doing your computing in the cloud you should not only ask yourself how to communicate with your cloud application, but how the application itself is secured, that is how the server is protected, who owns it, which laws apply... .

As for your idea of communication: it looks like you combine different techniques you heard about in the hope that it will be kind of secure, but you don't really understand what you are doing (otherwise you would not ask). Please don't try to reinvent security, it usually goes wrong. Use instead established technologies like TLS or SSH and understand how they work, what they offer, and what limits they have.

As for your added information of what you want to protect:

Protect the server from getting hacked

You should be aware, that with most cloud solutions you don't have your own dedicated hardware, but share the hardware with others and only get a kind of container or virtual machine on the hardware for you. If somebody successfully attacks the host running these containers you can forget the security inside the containers.

Also, most systems are vulnerable once an attacker gets access to the hardware. So you have to put a lot of trust in the people running the infrastructure.

In case the server is hacked the data stored on the server should be encrypted such that it is useless to the hackers.

This will not fully work. Because you have to work on your data while they are not encrypted, you have to have the necessary decryption facilities inside your cloud application. A competent attacker with full access to your machine has access to your application and can analyze it and extract the decryption part and reuse it.

Transfer data to and fro the server and client without leaking it to an eavesdropping hacker.

I would recommend to use established technologies like TLS or SSH for this, but even these can fail if not used the correct way.

At the end it boils down how valuable your data are. Professional attackers will not put too much effort in hacking a system which has nothing valuable to protect, but will put lots of effort when really valuable data (which means money) are involved.

If it is just a play project I would not care too much with security, i.e. only secure the server so that it cannot be misused. But, if the data are really valuable you might better keep the attack surface small and not trust too much people. In this case I would not do anything in the cloud.

Answer 2

1. Protect the server from getting hacked 

For this you could find multiple hardening guides, which combines locking down your machine, keeping it up to date with hotfixes and so on.

2. the data stored on the server should be encrypted

Ensure your data is encrypted, you could do this using symmetric encryption (you suggested AES, with the key being a file), there are multiple ways to do this.

3. Transfer data to and fro the server and client

For this, you need to ensure you have a secure channel, protected with the likes of SSL/TLS. You suggested to use SFTP (whose default port is 22, not 80), which is a good things. I wouldn't -personally- bother too much with randomizing ports, you'll have more trouble getting it through a firewall (if you're talking about an app being used in corporate environments) and people will find out it's a SSH/SFTP server anyways.