I have a safety-critical embedded device, which sends data updates (in get requests) and pulls settings from a server. The device uses an embedded microcontroller/wifi chipset called the Particle P1; this takes all sent data and encrypts it with AES, sends it to a server owned by the chipset company (which we'll assume for now is secure enough), gets decrypted, and then gets sent over SSL to my server. To ensure that nobody can push false data or settings to the server, every device has both a publicly accessible serial number, and a ~50 character randomly-generated pre-set password corresponding to that serial number. The server looks up the serial number in a database and compares the password given to the one on file before considering any of the data.
Is this sort of permanent access token system secure?
EDIT: According to the microcontroller vendor, the link between the device and them is properly secured with public-key TLS:
The Particle cloud uses RSA for session key exchange and authentication and then AES for data encryption for all cloud transactions. Each device has its own copy of the Particle cloud public key and its own private key. I don't know of a doc reference but the source code is all on github for anyone to see.