I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile web-site to make my service also available for other mobile operating systems.
Now, I have everything working through an API. my users can register, search companies, order products from those companies, and track their orders. It's not active yet, but it's working..
I am facing one major problem: how to secure this?
For the last few days I have stopped coding, and I have constantly been busy with searching the web, StackOverflow, and Information Security for how to do this. I have found that the way Amazon secures their API would be the best solution for me. The way Amazon secures its service is explained here. I have tweaked it a little bit for my service:
- User registers and gets private API key + public (identification) key
- User enters credentials and taps "log in". App creates hash out of the variables + private key. App sends variables + time stamp + hash + public key to API
- API looks up public key in database, finds private key belonging to that public key (if public key is valid). The API then creates hash the same way as the app did. If the hashes are the same, the request (log in in this case) is executed.
This way of securing a service makes sense to me, and I can code most of it. but I have a major problem and I can not find any solution to it:
- The user gets a public & private API key when an account is created. The public key can be sent from the server to the user device, because that is not necessarily a secret. Since the private API key can never be sent over the wire, how on earth can I make sure that an account logged in on a user's device knows the private API key that is created on the server?
Does anybody know how to solve this problem?? any help would be highly appreciated!!