Currently I have the following design:
- Central cloud hosted server with a REST api
- Multiple remote servers each with a REST api
Data is posted from the remote servers to the central server at regular intervals.
Commands are issued from the central server to individual remote servers in the form of POSTs to the REST api running on the remote server.
I am worried about security. The most important thing is to prevent unauthorized commands being issued to the remote servers.
Currently I am using token based authentication. Each remote server has a token without expiry issued by the central server that is stored in a config file on the filesystem of the remote server. This token is passed in the Authorization header of the POST requests originating from the remote server.
The other direction of communication works similarly. Each remote server generates a token for the central server that is stored in a relational database in the same network as the central cloud server.
My issues with this design:
- If the database is compromised, the attacker can issue commands to the remote devices - I am essentially storing passwords in plaintext in the db
- If the file system of a remote device is compromised, the attacker gets access to the token
What ways can I improve upon this design? The communication from the central cloud server to the remote device does not not need to be a REST api. It seems like what I need is some sort of two-way handshake between the two servers. How is that achievable with a REST api?
- Both rest apis are served over HTTPS
- The remote devices often lose internet connectivity for periods of time
- The remote devices are at risk of being physically stolen
Some things I have considered:
- I could connect all servers to the central hosted database, and use that for communication. This does not seem ideal because this seems like a security risk to have these remote devices connected directly to the database. Also, the remote servers often lose connectivity.
- Restrict access to the remote servers to a whitelist of IP addresses including the central remote server