I have a hardware device, which collects data. It should then encrypt the data, and send it to a server, which should decrypt the data.
The device is an embedded system which can be programmed only once (during manufacture), and then can no longer be accessed (it can only push data to the server).
The idea I have in mind is to:
- During production (mass production), program each device with a unique public key.
- Have the server associate the corresponding private key with the device's serial number in the server's database.
- On receipt of data, use the serial number to look up the device's private key, and decrypt the message.
I'm guessing this is possible, but is it feasible? Particularly the idea of generating and storing a unique key/pair when the devices are programmed (far too many devices to do this manually), and associating it with the device's serial number in the database?
Or is this a bad idea, and is there a better way of allowing a number of IoT devices to communicate securely with a server?
N.B. I have simplified the above, but the device should actually encrypt the data, transmit it to a phone via bluetooth, and then the phone POSTs it to the server over HTTPS. The phone does not decrypt the data. This means that the device cannot just push the data to the server over HTTPS.