表单数据的客户端/服务器端加密的最佳实践

Question

I am planning a project that requires the transmission of sensitive data from the client-side to the server-side, and then on to an AWS Simple Storage bucket.

This is my plan:

1. Using SSL/HTTP(S), the data can be posted securely via a web form, which is then retrieved by a PHP script on my web-server.

2. Once the data is received by the server, the PHP script will immediately send it to AWS using the AWS SDK for PHP with a directive to encrypt the data on the server-side with AES-256- See AWS Encryption.

The problem is that between steps 1 and 2, the data will not be encrypted because it has to hit my web-server first for processing. I'm thinking of having the script write the data into a text file on the server before sending it to AWS, then immediately deleting the temp file from the server after it is sent. Is there any risk in doing this? Is there a way to send a file-stream, rather than an actual file to an AWS Simple Storage bucket, thus avoiding the need to write a temp file to the server?

Am I overlooking better methods of achieving my original goal of data transmission that is encrypted 100% of the way?

Answer 1

If you're committing something to disk, then a sufficiently motivated attacker can arrange to steal that file the moment it hits the drive platters - it's fairly trivial to get notified of any changes to a disk/directory on most any modern OS, so they can simply monitor your temp directory (wherever you're writing those files) and copy them out.

Even if you immediately delete the file, the file is still present in the storage system in various caches, and as "can be written over anytime" sectors on the disk platter. Until the data's been overwritten by something else, an even more dedicated attacker can still retrieve the file even after deletion.

Beyond that, someone with enough access rights could simply reach in your PHP process's memory space and extract the file from there.

So.. the question you have to ask yourself is "what is my threat model"? And "what data am I storing in this file?"

If the data includes credit card numbers, then you're already in violation of PCI standards - the CC number can NEVER be stored anywhere in plaintext/readable format.