I'm quite new to information security topics and am looking for guidance to implement secure transmission of statistical data from an app to a server. In addition, I don't want any knowledge about the data stored on the server.
This is my approach:
- A developer creates a key pair and places the public key in the app.
- The app generates a public and a private key when launching for the first time. It sends the public key to the server and gets a user ID in return. Then it discards the generated public key.
- Every time the app sends data, it does it by encrypting the data with the public key from the server and signing it with its own private key.
- The developer can then retrieve the data for each user ID from the server and verify the authenticity with the public key stored with the user ID.
And here are my questions:
- Is it enought to send the public key generated on the device once or should I use a more sophisticated scheme to verify that data is sent by this exact user? There is no login and I don't care who the user is. But I want to make sure an attacker cannot send wrong data by forging the user ID without being detected.
- What should I do to detect missing data? It is okay if some data gets lost due to network issues. I am considering using ascending integers in the encrypted data. This would reveal if someone steals the private key and the current number from the app and sends wrong data.
- Finally, are there some concrete implementations that an inexperienced user like me can use without messing up?