I have a server in a trusted environment. This server handles requests from clients in an a non-trusted environment. I'd like to authenticate each request and to know if the client code has been tampered or not.
Client software is installed in a secure environment and if I generate some 'secret' (nonces or pseudo-random numbers) and don´t store it in the client, it can assume to be safely-kept.
I thought about using a modified one time password (OTP) with the secret generated at installation time. I could include time syncronization at the client machines as a requirement. The OTP secret key would be derived from the client software md5 hash and maybe some form of hardware id at installation time.
Is there a industry standard way of doing what I want? I really dislike the idea of rolling my own, since I'm hardly qualified to do that.