Description:
I am building an information display system. The system consists of the following:
Users create accounts for themselves, after which they can upload media to the server, create playlists and set which of their devices uses which playlist. For example, they can upload an image, create a playlist with the image and then tell one of their devices to display that playlist.
Limitations:
Only the user who owns the media or playlist can access it.
The Raspberry Pi computers cannot act as servers, they can only make requests to the back end.
The Raspberry Pi computers are not used directly by the end user. It doesn't have a keyboard. Ideally, the user just plugs in the device's power and ethernet cables and everything 'just works'.
Each device can have only one owner (or none).
The device only fetches playlists and media (e.g. images, video) from the server.
The device can only fetch playlists belonging to the device's owner.
Problem:
What is a secure way of establishing device ownership and making sure a device can only fetch playlists belonging to its owner? The device obviously does not have the username/password required to access the user's resources in a normal way.
I have considered a solution where the device has a unique ID which is too long to guess and is only available to someone who has physical access to the device.
The user would be able to take ownership of a device by adding the device ID to a list of devices they own.
This ID would be passed along with the device's request for a playlist, and the server would provide access to it if the owner of both the playlist and device are the same.
The problem is that if someone finds out the device ID, they will be able to take the device for themselves or download other peoples' playlists. The device ID also could not be changed.
What would be a better way of fetching playlists from the device? Thank you.