we have a requirement to be able to access resources on a mobile device. the mobile device must act as a server. it must be available no matter how the phone is connected (wifi, 3g, behind firewall, etc). i understand this can be accomplished by initiating an ssh reverse port forward from the phone to a cloud-accessible server. clients wishing to access resources on the phone can now connect to the cloud server at some random port, and have the connection tunneled to the mobile device. fine.
my question concerns the feasibility of this idea as a scalable, robust, secure solution. a mobile application deployed to tens of thousands of devices using this scheme to make device-local resources accessible. the device-local resources are not ultra-high security. ssh was suggested mainly because it makes setting up the tunnel easier.
here are some of my concerns,
port allocation. every tunnel requires a unique port on the cloud server. i believe this will require the device and the cloud server to negotiate an IP before initiating the tunnel. this is certainly possible, but it means there's a somewhat complex service somewhere that is constantly probing ports to determine their availability.
port resources. there are a finite number of ports on the server. maybe not a problem when things are scaled across multiple servers.
tunnel management. tunnels may not always go down nicely, so there's the problem of "cleaning up" tunnels that go down unexpectedly (see #1).
security. each device would require the public key to match the secret on the cloud server. if it's on the device, it can be taken from it. now, as long as the account is locked down, there's not much that can happen, but it does open another vector of attack.
also, simply having all of the unique ports open of the server is another attack vector.
scalability. how expensive (resource-wise) is it to have perhaps thousands of SSH tunnels open? is it realistic?
firewalling. the cloud server ports will not be "80" or "8080", but some random number. is this a problem for some firewalls that may restrict outbound connections to standard ports?
as you can see security isn't my forte, so treat me with kid gloves. if you haven't guessed, i have extreme reservations about this approach so i'm looking for evidence to look at other solutions to solve the general problem.