Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)?
Background: I have several embedded devices (self programmed & adaptable) that contact a webserver (php+mysql) with status updates. These updates are then - if the source is confirmed - saved to a database.
As I understand it
$_SERVER['REMOTE_ADDR']usually can be trusted (except some IIS configuration where it may - under special circumstances - wrongfully return 127.0.0.1; but different story)
Anyhow since I use SSL, the IP address really should not be a problem, because a handshake is required and if the IP is faked or simply wrong, the connection should not be established
For now I require IP addresses to be whitelisted by admin, for an status update to be accepted
The device additionally sends the MAC address via
$_POSTto identify the different modules with identical IP address (I know this can very easily be forged, and right now will be trusted if the IP address is trusted)
So first of all I am not sure if the IP address in itself is enough for it to be safe from attacks from the outside
Secondly if the device is behind a router, it will have the same IP address as every PC/device on that network. So about anyone there could forge a status update with a fake MAC address (simply as post variable), and since the IP address is whitelisted it will be trusted
So is there any way of confirming the identity of a device, or do you know a better way of doing this?
Aside: Going the other way, and have the webserver poll the different devices might be an option, but since there might be many (> 2000) devices of which we need the very last status (change) I thought it to be inefficient.
I have also heard of using a signed certificate, or multiple (for different clients), but I don't know how to go about that, so thanks in advance for every bit of information.
Usually I don't post (a lot of) questions, but this is really hard to Google - at least for me!