title: Execute and transfer highly secure data between known and unknown hosts
body: <p><strong>The problem is:</strong> I have a script (written in PHP) that is able to get commands, gather and send private data (<strong>this is just backup script</strong>). Main server will ask scripts to get data.</p>
  
  <p>Now I have 3 security problems I want to solve:</p>
  
  <ol>
  <li>I want to disallow any other server to ask for the private data (no server, except the allowed, can execute any command)</li>
  <li>I want to encrypt request - I will send private data in it (for example file names to transfer, which are considered private)</li>
  <li>I want to encrypt the response - script will output private data (file contents).</li>
  </ol>
  
  <p>Does anyone has any idea how to achieve these points or has any interesting cases of thoughts in this matter?</p>
  
  <p>My idea is to:</p>
  
  <ol>
  <li>Generate some kind of secure password and encrypt script before I will deploy it to remote server. I store the password and pass it in a request - it will decrypt the script (this is easy in PHP). Remote script then may send request to main server asking was this command authorised. Also, I can check IP of the server.</li>
  <li>I will also generate another secure password which is used to encode/decode all sensitive data in request.</li>
  <li>The idea here is to use also encode/decode approach from 2, but also not to send a response directly. Script will send request to the server with an answer. (using HTTPS). This will not let data go outside of the connection and will also make sure we use HTTPS (I don't know the status of the remote server, but I'm sure main server has strong SSL).</li>
  </ol>
  
  <p>Is it enough? Will you add anything? WHat are your thougts?</p>
  
  <p>Regards,
  Jakub Król.</p>