Simple Java client-server application with SSL encryption of traffic
Budget: $30 – $250 USD
Hello,
We need a ‘proof of concept’ application that is able to send a serialized object over the network. Traffic needs to be encrypted and only clients that can identify themselves can be allowed to communicate with the server (preferably locally stored key/certificate).
Both symmetric and asymmetric approaches are acceptable as long as they provide mutual authentication and traffic encryption. Traffic itself has to be encrypted - ciphering an object's fields and sending them over an unsecured socket is not considered encryption.
Please propose your approach to the problem and its justification in your offer.
This is a deep-backend service - no user interface. We prefer low-level implementation. The simpler the better - this is just an example implementation that will be modified further. Don’t use external dependencies if not necessary. Do not use Spring/SpringBoot. Logging is not necessary. More requirements can be found below. Example/template classes are attached.
Requirements:
Java 11
Project buildable with Maven
Client has to hold valid key/certificate to be able to exchange data (please propose your approach)
encrypted client-server communication
server-client can exchange serialized objects
provide step-by-step instruction on how to generate new certificate / key (preferably unix commands)
Scenarios:
1.
Server is running. A client tries to connect (knows IP address / port and is whitelisted) but lacks locally stored key/certificate.
Result: client is not authorized, no object exchange is possible.
2.
Server is running. A client tries to connect and has access to locally stored key/certificate. However, the server-side application does not have a matching key/cert (e.g. traffic was routed to a different instance). Communication is not possible because keys/certificates mismatch.
3.
Server is running. A client connects with a locally stored key/certificate. Server has access to a matching key/certificate. Object exchange is possible.
We need a ‘proof of concept’ application that is able to send a serialized object over the network. Traffic needs to be encrypted and only clients that can identify themselves can be allowed to communicate with the server (preferably locally stored key/certificate).
Both symmetric and asymmetric approaches are acceptable as long as they provide mutual authentication and traffic encryption. Traffic itself has to be encrypted - ciphering an object's fields and sending them over an unsecured socket is not considered encryption.
Please propose your approach to the problem and its justification in your offer.
This is a deep-backend service - no user interface. We prefer low-level implementation. The simpler the better - this is just an example implementation that will be modified further. Don’t use external dependencies if not necessary. Do not use Spring/SpringBoot. Logging is not necessary. More requirements can be found below. Example/template classes are attached.
Requirements:
Java 11
Project buildable with Maven
Client has to hold valid key/certificate to be able to exchange data (please propose your approach)
encrypted client-server communication
server-client can exchange serialized objects
provide step-by-step instruction on how to generate new certificate / key (preferably unix commands)
Scenarios:
1.
Server is running. A client tries to connect (knows IP address / port and is whitelisted) but lacks locally stored key/certificate.
Result: client is not authorized, no object exchange is possible.
2.
Server is running. A client tries to connect and has access to locally stored key/certificate. However, the server-side application does not have a matching key/cert (e.g. traffic was routed to a different instance). Communication is not possible because keys/certificates mismatch.
3.
Server is running. A client connects with a locally stored key/certificate. Server has access to a matching key/certificate. Object exchange is possible.