I'm new to Information Security so please bear with me if this question is quite trivial.

I want to design a secure protocol that allows someone to download a piece of data that belongs to them from a server to their cell phone. The protocol has four requirements. I have some general ideas on what should be implemented to match the requirements but I'd like some alternative suggestions as I'm not too experienced in the field.

The requirements are:

  1. There needs to be an authentication protocol between the client and server. (For this I was thinking of a one-time password based solution).
  2. The data transfer must be secured and resistant to interception.
  3. The transferred data must have its confidentiality protected (DES encryption?).
  4. The server must be protected from DoS attacks (have a limited number of requests per user per unit of time?).

There are some assumptions about the system:

  1. The cell phone offers a DES-based symmetric cryptosystem as well as a secure hash function.
  2. Each cell phone has a password registered with the server but does not share any extra DES key with the server.
  3. The phone cannot run any asymmetric cryptosystem such as RSA
  4. The devices are incompatible with Kerberos.

What would be the best way around this problem?

Thanks in advance :)

  • 4
    DES has been broken for many years. A protocol you design will be hopelessly insecure. It's hard for me to believe a phone cannot implement libsodium securely. – Z.T. Nov 27 '16 at 12:39
  • 1
    Fully agree. Please don't design your own protocols as an infosec newbie. How about simply using SSL-enabled HTTP (HTTPS...) and using a server-side framework to add client authentication (you get server authentication for free by using SSL)? I can't believe your cell phone doesn't support SSL / HTTP if it supports an internet connection. As to requirement 4, it's impossible to fulfill with a software solution on your server. – Out of Band Nov 27 '16 at 13:55
  • @Pascal, agree about everything but your last point. A simple DoS, as opposed to a distributed DoS can be solved by throttling, as OP points out. Most web servers will allow you to throttle connections per IP address. – Jedi Nov 27 '16 at 14:10
  • @Jedi - that's true. I was thinking solely about DDoS. – Out of Band Nov 27 '16 at 14:19

There are multiple options for this but perhaps the easiest given your requirements is using HTTPS. You would have onetime randomly generated links that prompt for the onetime password for download authentication. I would also want the ability to set a time frame for which the content is available for download with the link. If the data is in the webroot, make sure the file permissions do not allow direct file access or even directory listing.

As for mitigating a DDoS attack..that isn't an easy task or something that can be fully handled by the application. Sure you can throttle based on IP..but remember we are talking about a distributed attack. I would suggest looking into going through a content delivery network (CDN) such as Akamai. That's a really good solution for DDoS. Hope this helps.

The data is confidential in transit because in HTTPS the encrypted session/channel is established before and HTTP requests are made.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.