4

I have a specific network environment. Its a DTN(Delay Tolerant Network) network without continous connectivity, situated on the sea, where nodes are ships. There is also a server that is a part of land infrastructure, for clarity lets name it server B. On each ship there is a computer that has custom routing software installed and also acts like a www server. On the www server there is a web email service, where users register and login with their email accounts. They should be able to read their mails and send new emails. Because the network connectivity isn't continous we can't use directly IMAP, POP, SMTP protocols to communicate with mail servers. The idea is that server B on land infrastructure will make the communication on behalf of the user. So web server on the ship will send a message containing mail information encrypted with server B certificate to some transit nodes in the network when they meet and server B decrypt that message and make the IMAP communication. The user can also register at server B and tell it, that it should check inbox messages for every 5min and if there are new mails send them addressed to the ship.

The problem is that passwords stored in the database can't be hashes, because server B wouldn't be able to make the SMTP, IMAP dialog were hashes are unacceptable. My soution is to store in the DB at servers encrypted passwords with server B certificate. When server B wan't to make SMTP it decrypt passwords with it's private key. The drawbacks of this solution is that it is slow and when private key of server B is disclosed then all user passwords can by decrypt.

Is there any better solution for this problem?

2

You seem to be re-inventing the wheel. The Internet was originally designed for clients that connect at irregular intervals. The server on the land is your mail server. The infrastructure machine on the ship can just mirror or buffer the information to the many clients on the ship. The Internet was designed to solve just this sort of problem, and there is tons of legacy software for this.

Probably you can configure two mail servers that will handle this for you without you having to write a single line of code. You need a mail server on land, and a mail server on the ship. When the ship has Internet access, it can query the land-based mail server to get the new mail for recipients on the ship. There does not need to be an exchange of passwords if the land-based mail had a verified list of email addresses for people on the ship.

Put another way, you can set up a domain for the ship and everyone on the ship is mailbox@ship.com or something. Then the normal mail routing protocol will deliver the mail to the ship when its mail server connects to your land-based network.

There shouldn't be any password problems if you configure mail routing properly. The mail server on the ship will check each user's password when they connect to get their mail.

  • Could you say something more?,How does this apply to passwords. – Russian Gepetto Apr 16 '16 at 12:38
  • The end users who will be collecting their email aboard ship will only need to authenticate to the shipboard mail server. They don't need to authenticate to the land-based mail server at all, because the mail transport protocol (SMTP, with or without TLS) does not require user-level authentication (without TLS, no authentication is needed, and with TLS certificates, not passwords, are used). So the users' passwords never need to leave the shipboard server. – Mike McManus May 16 '16 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.