1

I have the following problem. Our product integrates with LED signs of a certain manufacturer. Communication with these devices is via HTTP (they contain a web server for admin UI and a web service). The device does not offer any authentication methods, which means if you can connect to the device via TCP network, you have full access to the device.

Our sales team and customers really like these signs due to their versatility and want them. The manufacturer is not much concerned about lack of security and not in a hurry to add any (HTTPS, user name + pw login, etc).

I am wondering if there are small devices that could be "added" to each LED sign to enforce encrypted and authenticated communication with those signs. Here is what I have in mind. The device is physically attached to a sign (inside or outside. The device has two Ethernet ports. One port gets connected to the LED sign's Ethernet port, the other to the Intranet ethernet port in the wall. The main server that controls the LED signs can now establish secure communication with those devices (VPN?) and all HTTP communication to and from the LED signs is securely tunneled through those devices.

I searched the Internet for quite a while and couldn't find any such device, possibly because I don't know what you would call such a device.

One more constraint: The main server that controls the LED signs runs Windows 2008 R2 and higher, so whatever software runs on the main server to enable those tunnels needs to run on Windows.

Thanks!

Improve this question

2 Answers 2

Reset to default
4

Any tiny, low-cost computers that run Linux and have 2 ethernet ports would let you do this. Use NGINX, HAProxy or similar on the computer to run a reverse proxy that terminates the HTTPS connection and passes onwards the unencrypted HTTP traffic. Remember that HTTPS is simply HTTP with TLS encryption added. The source server won't care.

If you cannot source a suitable low-cost computer (try looking for some of the Raspberry Pi clones, I'm sure one will have 2 ethernet ports), your alternative would be to put in a single computer at the network segment level - e.g. have the HTTPS terminating proxy running at the edge of the reasonably trusted local network. This is the same principle but simply reducing costs by aggregating traffic through a single PC - by building, floor or whatever security boundary makes sense for your customer. Better still use 2 PC's for resilience if the signs are important enough.

This is really the reverse of what you might do when running a large-scale internet web service. In that case, you may well terminate the HTTPS connections at the edge of your data centre using dedicated servers to reduce the load on your internal web servers. Same principle here but you are keeping the encrypted traffic as long as you can and decrypting at some convenient point close to the signs.

UPDATE: Regarding possible hardware, here are a few pointers.

You could use a Pi (or similar) with a USB Ethernet adapter as the second adapter.

You could review the OpenWRT compatibility database for suitable devices. OpenWRT is an open source router-specific version of Linux.

There are also some embedded linux devices with 2 ethernet ports built in.

Finally, depending on the topology of the buildings you need to support, it might be feasible to build a separate network just for the screens. This isn't as hard as it seems but the constraint may be the number of spare ports the buildings have. It is conceivable that all that is needed is some re-patching of the network. If your network staff are open to it, it might even be sufficient to logically set the screens to their own VLAN.

Sorry, I'm rambling now! What I'm trying to get across with this last point is that you might only need encryption between buildings and depending on the LAN hardware and configuration, you may be able to use a building's firewall to terminate the encryption (e.g. using a VPN - not even that if the WAN is a modern MPLS since that is already encrypted point-to-point). Then, once inside the building, you can either physically or logically segment the screen traffic.

Improve this answer
4
  • Julian, thanks for your suggestions. I had been hoping to find a ready-made and tested product that does what you are describing. Our team unfortunately is not set up to take on such hardware development and turn it into a product.
    – christoph
    Sep 12, 2016 at 1:23
  • 1
    No problem. Though I would do some additional checks before giving up. You can get a router/firewall distribution of Linux that would be easy to configure and there are a great many tiny Linux-based computers available off-the-shelf. Having HTTPS enabled is not an optional thing if there is any danger at all that the info could be sensitive nor if the network is in any way open.
    – Julian Knight
    Sep 12, 2016 at 6:01
  • Thanks for the pointers, I'll look more into tiny Linux-based devices/appliances. Maybe I can find a readily available device in a small form factor on which we'd only have install a properly configured Linux dist.
    – christoph
    Sep 13, 2016 at 15:11
  • I've updated the answer with some further info that hopefully may be helpful.
    – Julian Knight
    Sep 13, 2016 at 15:55
1

Thanks to Julian's suggestions I was able to find at least one series of devices that comes pretty close to what I am looking for: The Nexx WT3020 router series. These miniature routers have two Ethernet ports, and the cheapest WT3020A one has Wifi (not needed) and no USB. I saw prices between $15-30 on the Internet.

The WT3020 series is supported by the OpenWRT embedded OS (Linux-based), which means they could fairly easily be customized to support what I am looking for. If only they could be run using power-over-Ethernet, without having to do a custom solder job: https://wiki.openwrt.org/toh/nexx/wt3020#nexx_wt3020_poe_mod

Improve this answer
2
  • Without making a product endorsement, OpenWRT is pretty well packaged to do what you need: it will allow you to create an "internal" and "external" port to protect the sign unit from internet access, install packages to support reverse proxy of the connections via HTTPS, and also whitelist IPs or create a VPN tunnel to fully protect access. POE injectors/splitters are really inexpensive, if that's your only worry you are in great shape.
    – Jeff Meden
    Sep 13, 2016 at 18:47
  • Cool find! Agree with Jeff that PoE injectors are cheap and easy to use. Obviously you need to check power across the whole system but that should be fine with what you are doing. I do advise you to get a network specialist to check out the proposed design though just to make sure. All the best with the work, hope it goes well.
    – Julian Knight
    Sep 13, 2016 at 20:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .