3

Description:

I am building an information display system. The system consists of the following:

  • A Django Rest Framework based backend providing a low-level JSON API
  • A single page application web front-end for users which makes use of the backend
  • Standalone Raspberry Pi devices which use the JSON API to fetch content to display on a screen
  • Users create accounts for themselves, after which they can upload media to the server, create playlists and set which of their devices uses which playlist. For example, they can upload an image, create a playlist with the image and then tell one of their devices to display that playlist.

    Limitations:

    Only the user who owns the media or playlist can access it.

    The Raspberry Pi computers cannot act as servers, they can only make requests to the back end.

    The Raspberry Pi computers are not used directly by the end user. It doesn't have a keyboard. Ideally, the user just plugs in the device's power and ethernet cables and everything 'just works'.

    Each device can have only one owner (or none).

    The device only fetches playlists and media (e.g. images, video) from the server.

    The device can only fetch playlists belonging to the device's owner.

    Problem:

    What is a secure way of establishing device ownership and making sure a device can only fetch playlists belonging to its owner? The device obviously does not have the username/password required to access the user's resources in a normal way.

    I have considered a solution where the device has a unique ID which is too long to guess and is only available to someone who has physical access to the device.

    The user would be able to take ownership of a device by adding the device ID to a list of devices they own.

    This ID would be passed along with the device's request for a playlist, and the server would provide access to it if the owner of both the playlist and device are the same.

    The problem is that if someone finds out the device ID, they will be able to take the device for themselves or download other peoples' playlists. The device ID also could not be changed.

    What would be a better way of fetching playlists from the device? Thank you.

    2
    • 1
      Are you trying to defend against device theft, device sharing, or both? Are the devices generally mobile or will they usually stay in the same location? Nov 1, 2015 at 0:23
    • Theft. They will likely stay in the same location, but nothing prevents them from moving.
      – Atuos
      Nov 1, 2015 at 9:30

    1 Answer 1

    4

    The user would be able to take ownership of a device by adding the device ID to a list of devices they own.

    What you need is some way to prove that the user is in physical possession of the device.

    Going by media (e.g. images, video) it sounds like you have a display of some form, therefore it would be easiest to display some temporary PIN on the device which the user has to enter along with the device ID into your site when they try and add the device to their account.

    You could either generate this PIN online and send it to the device, or generate it offline using a protocol such as TOTP.

    This ID would be passed along with the device's request for a playlist

    Once you've undertaken the authentication process I would not recommend sending the ID. Instead generate a temporary set of credentials during the authentication process and send them to the device, that way you can revoke the credentials if required or if the user re-authenticates (say they give the device to someone else).

    I'd also suggest embedding a unique private key for every device, that way you can easily encrypt the temporary credentials with the device's public key knowing that if anyone else obtains the keys, only the authentic device will be able to decrypt them.

    You must log in to answer this question.

    Not the answer you're looking for? Browse other questions tagged .