Would it be an acceptable practice, if we were to register a client (individual or company) by associating them with their static IP address to perform some secure action that only authorized clients can do? I looked at the answers stating that restricting clients by their static IP addresses is a good additional protection, and that spoofing an IP address is not a practical attack in two-way communication. I would like to understand how acceptable is it from security perspective to use the client's static IP as the only means to authenticate the client. What would be the specific risks associated with such method?
There are several problems with IP-only authentication.
- It is not, by itself, secure. A man-in-the-middle attacker can pretend to be the expected host at any IP address, and spoof anybody they want. If you want to prevent that, you'll still need an authenticated and secured channel, such as IPSec or TLS.
- An attacker that doesn't need to see response messages can still send requests to the server, if the server supports UDP or protocols that don't require a bi-directional handshake prior to sending any data.
- It's brittle. If the IP address ever changes, for any reason, not only will your authorized host lose access, but whoever happens to get the old IP (by luck or by malice) will now be treated as authenticated.
I strongly recommend another approach. Mutual TLS/DTLS is a good option for Internet-based connections where you control, or at least can coordinate, both endpoints. Standard TLS (which only authenticates the server) also works if you have some other way to authenticate the client, such as a password or other pre-shared credential, though then you have to protect against all the standard attacks on authentication systems. Adding IP filtering on top of [D]TLS is generally fine, aside from the brittleness risk
I assume that you will register a device's MAC address with a static IP.
This is not secure. Forging MAC address is very easy. You don't need any complicated tools, it can just be done with ifconfig.