I'm new to Information Security so please bear with me if this question is quite trivial.
I want to design a secure protocol that allows someone to download a piece of data that belongs to them from a server to their cell phone. The protocol has four requirements. I have some general ideas on what should be implemented to match the requirements but I'd like some alternative suggestions as I'm not too experienced in the field.
The requirements are:
- There needs to be an authentication protocol between the client and server. (For this I was thinking of a one-time password based solution).
- The data transfer must be secured and resistant to interception.
- The transferred data must have its confidentiality protected (DES encryption?).
- The server must be protected from DoS attacks (have a limited number of requests per user per unit of time?).
There are some assumptions about the system:
- The cell phone offers a DES-based symmetric cryptosystem as well as a secure hash function.
- Each cell phone has a password registered with the server but does not share any extra DES key with the server.
- The phone cannot run any asymmetric cryptosystem such as RSA
- The devices are incompatible with Kerberos.
What would be the best way around this problem?
Thanks in advance :)