I have an embedded board with a very limited processing and memory resource. I would like to control the board using an android app.
The users are categorized into 3 groups:
owner of the board.
admins of the board.
The owner has total control on the board and can define the admins. Admins can invite the users and give some permissions to normal users to work with the board. Everything has a time meaning that the given permission has a start date and end date, beyond the period the permissions won't work!
Said the problem, I am looking for a wise while low overhead authorization and authentication techniques.
Some major questions:
The keys/tokens should be generated inside the mobile app or by the board? for some reason I prefer to generate the tokens inside the mobile app... whats pros, cons of this approach?
For time: it should be included in the token (e.g., JWT) or it should be saved in the board?
Do we need a kind of database for users and their role in the board or not? due to limited resource I would like to only store the tokens rather than user information like ID, token, etc. Is it possible or not?
For encryption of the line, each pair of (board, admin/user/owner), we need to have a different public/private key or not?
For generation of token in mobile app, we need a key. This key should be common among admins or not?
If the key (for token generation), is common among admins, in case owner wants to remove on the admin, what happens? How can I get the key back from the admin?
In order to prevent the replay, how can I implement challenge and response technique?