Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

I need a process to allow only certain computer systems access to the website irrespective of the network they are using.

Much like a Licensing system, I can provide a private key or something similar to the user, which the host server should identify that key by matching from a list of private key. Alternatively could the website hosting server can use the MAC address of system?

Client Machine can have any OS installed. I am familiar with PHP but open to using any programming language

Any ideas are welcome

share|improve this question

marked as duplicate by Adi, AJ Henderson, Luc, TildalWave, LamonteCristo May 21 '13 at 13:54

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Related:… – Adi May 21 '13 at 11:24
I am mainly focused to implement it in web based application. – Arun Jain May 21 '13 at 12:13
up vote 3 down vote accepted

You can't do it using the MAC address - these are not visible across routers. Even if you were on the same LAN, it doesn't solve the problem (as posted) since it's trivial to change a MAC address.

The big question is how closely you need to stick to your requirement.

There are lots of solutions such as simply authenticating the user, using authentication devices (such as RSA keyfobs), client side certificates - but these methods can be transferred between machines. Browser fingerprinting makes it more difficult, and something like evercookie makes circumvention more difficult (but more likely to fail to work in the first place).

Really we need to know more about whether it's the device or the user you need to authenticate and how strong the requirement to disallow duplicated access is.

share|improve this answer

You can use Kerberos network authentication protocol for authenticating user before accessing the machine. Kerberos provides strong authentication for client/server applications by using secret-key cryptography where both client and server prove their identity across an insecure network connection. I recommend to read "Best Practices for Integrating Kerberos into Your Application" the paper describes best practices for application developers who want to add support for the Kerberos into their applications.

share|improve this answer
How do you implement Kerberos via HTTP? How does it authenticate the device rather than the user? – symcbean May 21 '13 at 12:58
I answer from the perspective of using kerberos for Web authentication which you can read from – Ali Ahmad May 21 '13 at 14:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.