1

Scenario: I have an application A which holds sensitive data. I have an application B which needs to process the data. A will provide a web-interface. B will make calls to get required data from A.

Requirement: I would like to secure the system such that A transfers data only to actual instances of B. As far as possible I would like to prevent any human from being able to make a call to A, pretending to be B

Solutions Considered: This question came closest to my needs: How to make secure communication between servers However, it involves storing some information on the client (shared secret, certificate, public/private key) either hardcoded or saved somewhere on the server. While this prevents external parties from attacking the system, admins or devs for service B will have access to these "secrets", and will be able to fake a call from B.

Question: Is it at all possible to implement an application authentication scheme that even devs / admins cannot fake? I am open to solutions that involve procedural controls, separation of responsibilities and other techniques in conjunction with software / cryptographic controls

Improve this question
1
  • 1
    Admins on system B can theoretically see anything that is going on on that system. That includes seeing the details of any controls that the application implements - up to, and including, things like certificate pinning within the app (they can, given sufficient effort, decompile it and bypass that - it runs on their system). Humans are quite good at pretending to be computers - certainly better than the reverse...
    – Matthew
    Jun 14, 2016 at 15:46

1 Answer 1

Reset to default
-1

I have seen something similar to this done before, but there is a pretty massive downside: the only way you can guarantee it to work is by preventing all human access to the machine where B resides. It was accomplished like this:

System A is configured to only accept calls from System B. System B is a virtual machine image which contains only a single admin user, and on first boot a script runs which changes the admin password to a long random one using a cryptographically secure algorithm. At this point the only way to stop it is to shutdown the VM. Edits are made by changing the image and starting it up again.

This isn't a perfect solution, as an admin on the virtual machine's host could take a memory dump and possibly extract some of the "sensitive" data while it is being processed. (Thanks Philipp for pointing this out.)

Improve this answer
4
  • Wow, interesting approach. Thanks for sharing. Any idea how system A was configured to only accept calls from system B? Any use of client certificates, public-private key pair would require some transfer of information from system B to system A.
    – kaustav
    Jun 17, 2016 at 5:21
  • It used a combination of a known certificate and only allowed a particular IP address.
    – TTT
    Jun 17, 2016 at 13:29
  • 1
    There is a problem with that approach: The hypervisor which runs the B virtual machine can easily freeze the VM and create a memory dump from which the sensitive information can be extracted.
    – Philipp
    Jul 14, 2016 at 21:23
  • @Philipp - Good point, I have edited my answer to include your caveat. Fortunately this wouldn't enable the attacker to fake a call to B though, only potentially see a slice of data that perhaps they shouldn't have been able to see (if they didn't also have access to system A).
    – TTT
    Jul 15, 2016 at 21:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .