How to install client securely?

Question

I'm writing a program in PHP that sends data from one master to many clients (all Joomla websites). When the client software is installed, it should send a message to the master identifying itself, and then the master will reply with configuration info (including a key that will be used to verify future communications).

What's the best way to activate this connection securely? Currently, the master has a database with allowed client URLs, and in order for a client to be installed, it has to be manually added to the database. I'd like to use a system that eliminates human error, but aside from reading the occasional Coding Horror post, I'm completely new to this.

I'm primarily looking for the conceptual model I'll have to implement. I'd like this to be a learning experience. Libraries would help, but I want to know why I'm doing what I'm doing.

Answer 1

Your question seems to be a bit ambiguous to me because I fail to understand what you exactly want through it. Do you want the theoretical steps you must follow or the practical algorithms and libraries for your particular language that may help you do this?

If it's a general guide on how to make client-server architecture based software security, here's a good read: http://www.eldos.com/security/articles/1942.php

As I understand it you want a method to automatically authenticate a license and add the specific computer's I.P. to your database of allowed IPs?

A good way to do this is use a simple SALT + Hashing algorithm wherein:

1. Each installation comes with a product ID.
2. This unique product ID has to be passed by your client to the server each time before use, wherein the server takes the product ID, checks if it is valid, then generates a access code (based on that day's unique salt dependent on say date and md5 of the salt+prodID).
3. This access ID is added to the access table and passed back to the client. In this manner everyday on the first run the client will be verified for it's validity.

Why this approach is good? This approach leaves the method of validity to you. Ie. When you get the prodID, you can ensure multiple things such as:

• Has any other computer tried to use this product ID today?
• Is this prod ID first time used? In that case store the IP
• If it's not used for the first time, is change of IP permitted? If so, how often?

---

Edited:

Alright, we'll change the above procedure a bit to get it to work. I'm presuming that you want to use it in sort of a licensing system.

1. Configure your payment system to generate a product or license ID for successful purchase. This ID can be anything, but remember to store it in your database.
2. When the client first runs the Joomla Extension, get the Joomla Extension to take the product ID from the user once, and store it locally. Then pass it to the server for registration.
3. At the server our products table will have two columns (pID,URL) If the product is having a null URL then we put our URL in the record where pID = Our pID If not, and our URL is not the existing URL, then we have an unauthorized installation of an installation at a separate location then the original one. A separate method would have to be used to re-validate that.