I am setting up a private home management system containing several daemons/servers and a few clients to connect from.
I am trying to achieve end-to-end encryption with the most monitoring and health check processes I can in order to create trust in this homemade system.
I want to ensure the authenticity of every ongoing connections to each independent modules. Avoiding MitM and losing track of transitting data. At any point, the data should keep its integrity and be protected from any alteration unless ordered by an authenticated session.
Architecturally speaking, here's what I have in mind:
A shell client, an admin GUI (web), and a mobile app can connect to my home network.
To connect, the first step would be an auth server that generates a session. Then, the session would be spread among every module in the home network (talking about a few raspberries plugged here and there).
Once the session is created, the client (either shell, web, mobile) can interact with a Command & Control main hub, which then spreads the commands and fetches information to and from every other module (raspbpies)
The modules do not need to communicate with each other, but they all, independently should communicate with the Command & Control hub.
To communicate with C&C, each module should once be registered and given an
Now here's how I would try and secure it:
Web/Shell/App Connection: 2 step-auth (Basic + HOTP) Client -> Auth Server: HTTPS TLS Auth-Server -> Command & Control hub: Session related JWT
C&C -> Modules
As those modules should not be reachable through the internet, I was thinking of generating a session-related RSA keypair between C&C and each module to authorize the connection.
Maybe, the keypair could be generated from the
API_KEY provided by C&C.
The modules would send needed information to C&C, which will then be delivered to the logged-in client.
I would appreciate if you could point my mistakes or point me to other useful resources that I may have missed.
Additional note: Most (if not all) daemons will be nodejs processes