We are planning to deploy HSM with our application. The solution we are thinking is :
- Mobile applications talks to server application,
- Server application talks to HSM for authentications, encryption, decryption
Clients are mobile application(Android, J2ME etc.) which communicates with server application. Every transaction from mobile application to server and vice-versa have to secured through encryption. Currently what we do is (without HSM), on client registration we generate a symmetric key and permanently store onto mobile device, server and then encrypted conversation goes on.
Now, we want to do employ session keys. No permanent symmetric key. The flow we have thought for key generation and distributions:
- On client registration, mobile app generates a public-private key pair and sends CSR(Certificate Request) to server
- HSM through Server signs certificate with it's root private key, sends signed certificate and it's own certificate back to client. Here, we may consider storing public keys for each client in HSM.
- On start of each session, client would be given a session key wrapped in it's public key. We would be storing session key temporary on HSM against each client for encryption decyption.
Is it looking fine ? Can anyone suggest what's standard for such kind of scenario?