We are trying to come up with a scheme to secure http communication between our internal servers.
Are there any good established schemes out there? The requirements we have are:
- The clients and servers are physically located in different places and need to communicate over the internet.
- The client needs guarantees that it is talking to the server it thinks it's talking to.
- The server needs guarantees that it is talking to the client it thinks it's talking to.
- The server needs to be able to block communication with a particular client in the event it's been compromised.
- There exists a secure out-of-band communication that allows for the distribution of things like keys.
Our current idea is to secure all communication using SSL. A certificate chain to validate the server's certificate will be distributed to the clients (and only the clients) using the secure out-of-band communication. Whenever the client communicates with the server, it is pinned to using this certificate chain. This guarantees the client is talking to the correct server, and gives us some loose guarantees on the server side that it's talking to one of a set of semi-trusted clients.
A public-private key pair is generated for each client. The public keys are stored on the server (via the secure out-of-band communication). The following workflow is used to authenticate the client.
The session token is then sent in all future requests. The session token can be revoked etc. If a client is compromised, it's public key can be removed from the server and all session tokens associated with that client revoked.
Is there a better way to be doing this? Is there anything we've not considered?