0

i was wondering - consider i have 2 machines - client and server. the Client is opened to the internet, and sends very sensitive data to the server.

If fake data will be sent to the server and is not identified - this will lead to a catastrophic situation.

Client certificate / authentication will not be helpful, as this is an automatic process and a compromised client certificate/credentials will be easily grabbed.

I've read the following post: Authentication and removing the ability to replay information from a compromised machine and the answer suggested to use a "secret" that will be hard to replay from a compromised machine.

So, following this information, i can think of hiding some "secret" info from time to time (when generating the "real" data) and let the server check it - if it's ommited, the machine was compromised.

I was wondering if there are any other recommended methods in denying compromised machine data?

thanks :)

Improve this question
5
  • I don't understand, what scenario are you defending against?
    – André Borie
    Commented Feb 16, 2017 at 17:33
  • 1
    Ever thought of the server fetching the information from the client? In addition to fetching the information the server could implement means of verifying the clients integrity. Since these checks are implemented on the server, it is harder to cricumvent these on the client.
    – cornelinux
    Commented Feb 16, 2017 at 23:35
  • @cornelinux how will exactly this will help? the (client) machine is compromised - so server can verify whatever he wants, the fake client will responds correctly. but as i see, there's no actual way to achieve this (identify that someone compromised the sender application) - only to make it harder for the attacker
    – ArielB
    Commented Feb 19, 2017 at 13:28
  • Security is only about making it harder.
    – cornelinux
    Commented Feb 20, 2017 at 23:07
  • @cornelinux true, though there are aspects that can be trusted much more, but i can agree with you. anyway, i'll go for the "make it harder" zone.
    – ArielB
    Commented Feb 21, 2017 at 8:35

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .