Design and Evaluation of a Hybrid AES-ECC Model for Secure Server Communication using REST API

Security in server-to-server communication is essential, especially in open networks vulnerable to data breaches and service disruptions. However, many existing solutions rely on a single cryptographic algorithm, limiting their ability to address diverse threats. This study aims to develop and evaluate a hybrid security model by combining the Advanced Encryption Standard (AES) and Elliptic Curve Cryptography (ECC) to ensure confidentiality, integrity, and authenticity of transmitted data. An experimental approach is applied through direct implementation in server communication. The model uses AES for symmetric encryption, ECC for dynamic session key exchange, and JSON Web Token (JWT) reinforced by nonce, timestamp, and HMAC-SHA256 for authentication and integrity verification. Test results show the model detects payload modification, replay attacks, JWT manipulation, and passive interception, with processing time still within an acceptable range. Communication efficiency is maintained with negligible payload overhead. The novelty of this research lies in integrating hybrid encryption with stateless authentication and integrity validation into a unified architecture. This integration allows security elements to be delivered systematically via REST API, making the model easy to adopt in existing architectures. The results of this study contribute to the advancement of secure API-based communication frameworks in the field of informatics, providing a practical, adaptable, and scalable solution for protecting data in distributed information systems.