Let's imagine a web service that allows to create wallets, deposit money and cryptocurrencies, perform money and cryptocurrency exchange and withdraw money.
The critical information here is:
- "sign in" credentials that allows to sign in to account.
- Private keys that allows to interact with cryptocurrencies wallets.
The common security questions here are:
- Authorization and Authentication mechanism.
- Where to store private keys and how to access them from back-end application.
- Financial transaction confirmation.
We must be tolerant to the following situations:
- Villain stole the account's credentials (possible for Admin account).
- Villain obtained access to the host where back-end application is running.
In all cases money still must be save.
So, are there common approaches or examples of architectures for such systems. Maybe useful articles?