Search code examples
securityfiletransferb2b

B2B File Transfer

I have been asked to develop a highly secure B2B File Transfer system between three companies.

VPN is not an option and they prefer to use common ports like 80,443, etc, so no extra firewall configuration shall be done.

i found solutions like oftp2 and as2 to be sufficient enough. although, i have some questions before i can decide:

  • is not https file transfer secure enough. so i can use asp.net/C# to do the task.
  • what about existing tools like SFTP, rsync and other *nix tools.
  • what about using SOAP?

my main concern is to avoid any possible clear data exposing to the outer world.

all ideas are appreciated.

thanks in advance.

Solution

  • if you use a block cipher like AES to encrypt the data and send the result using RSA encryption that will do the job. For the RSA you encrypt using their "Public key" which you get them to send to you out of band (Courier service) then they decrypt with their private key. This is totally secure providing both companies keep their private key secret. You have a key pair for each of the 3 companies. The extra AES layer is if you are really paranoid and really really want to make sure even if someone got the private keys they still can't read the data. Also you should sign all messages: send a hash of the rest of the message encrypted (AES) with your private key then the recipient can decrypt with your public key, and hash the data themselves and if their hash is not the same as your one that was attached after it was decrypted then it was not from you. This prevents man in the middle, domain in the middle etc interceptions. This would only allow someone to interfere if they got both the public and private key and the AES password... at that point the estimated crack time is well over 2 billion years with 2048 bit RSA so I think you're safe.