5

I've seen a few questions here with similar concerns but i felt like this specific question wasn't asked or replied to, so I'll try my best to illustrate my case here.

The problem:

  • The platform I'm developing consists of a "3rd party APIs" function aggregator and normalizer as in: my users will provide their API KEYS and i have to store them
  • Users need to provide several API KEYs for 3rd party APIs
  • The application needs to API Calls on behalf of the user, even when the user isn't logged in ( during background tasks )
  • When calling 3rd party APIs I'll need the cleartext form of those keys and secrets

My infrastructure:

  • I currently use Heroku ( for my http server ) which theoretically guarantee nobody can access my machines via SSH or other means
  • My pass guarantees only a selected amount of users ( ideally using 2 factor authentication ) have access to the control panel, therefore to the ENV variables, therefore to the database credentials

My current plan:

  • Store API KEYS on a separate server which issues its own token for future authentication
  • Only accept API calls from my own http servers ( using some sort of private VPN )
  • Exposes an API which only gives access to a few selected functions then used by my other servers, this way reducing the attack surface of my system to only this machine with minimal software installed ( a minimal node.js http api ).

My pass recommendation:

  • Use heroku to run my "key manager servixe"
  • Store database credentials on ENV variables and don't give access to this account to anyone other than the "keys admin" which will be the only person able to login into the pass dashboard and see the database address/credentials

Questions:

  • What is the most secure way to store and use those keys?
  • Is there any option that is more secure than simply storing the keys on a database which the address/credentials are protected by a two-factor authenticated dashboard?

Thank You

Improve this question
3
  • Your security is always going to be limited by your trust in Heroku. If you want more security, you will need to switch to a more secure platform such as Azure.
    – Julian Knight
    May 29 '17 at 18:57
  • Key management suggestions are available from the major cloud providers, they include idesa such as generating keys with limited access, rotating keys, IP address restrictions, etc. This could further limit the impact of a compromise. support.google.com/googleapi/answer/6310037?hl=en docs.aws.amazon.com/general/latest/gr/…
    – mgjk
    May 29 '17 at 19:08
  • +1 to this. I'm running into almost the same issue. And most of the answers/comments here are missing the boat or providing no real guidance to your situation. This can't be that uncommon. I'm assuming there has got to be a architectural pattern for this. @kroe I'd love to know what you landed on, I'm probably going to take almost the same direction as the one you laid out. Also planning on encrypting the api keys as well, just in case anyone got to the db.
    – Justin
    Jan 28 '19 at 14:08
1

Based on what you stating on your question. Just use plain certificate store such as JKS file, file or PFX if running on windows and then secure your file system , so the file is protected. This is if you are storing private keys, however if your application is the client of a third party service then you only need their public key, which does not need to be protected as good as the private key. Your application still needs the passphrase to open the key store. there are some security patterns for certificates such as rotating certs.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.