This question doesn't fit well in many categories but hopefully someone's run into it before.
I'm developing a web api that will interact with a physical device. Each new physical device has it's own unique ID, but those IDs are guessable (essentially they are sequential as they come off the assembly line.)
When the device is plugged into a computer via USB we will launch a client app which the user will have installed and sync data from the device to the API. We can't rely on a 1:1 relationship of computers to devices, a user might sync on multiple machines or multiple users might sync on the same machine.
We want to authenticate to the API using nothing more than the device ID, but i don't want someone to be able to spoof another users ID by calling my API directly with a different device ID.
I'm wondering what I could do to the device ID that could enable me to securely use it for authentication.
My first thought was to encrypt the ID with a private key and then share the private key with the client software. The client software could then encrypt the device id before calling the API and transmit that encrypted value. The api compares it against a stored value and your good, but I'm worried that it will be difficult to secure the private key when it has to be stored on the client computer.