2

I have limited client devices and one server.

I want to create a client-server secure connection while app installation but don't want human-interaction between devices and server like registration or login.

After installation app, this client device should be already authenticated.

Also want to avoid incorrect/fake devices.

In which way, I can implement this issue? I am newbie to information security. Please help me.

Improve this question

1 Answer 1

Reset to default
5

One approach can be to use PKI. Major steps would be:

  • Define your own CA by creating, create a self signed certificate for it.
  • Make this certificate trusted by adding it to the trust store on every device. Thus, even if you update server certificate time to time, it will remain trusted, because it will be signed by your trusted CA.
  • Create separate key pair and certificate for every device, it should be used for communication with the server.
  • Register public key of every device on the server side. Based on this the server will authenticate client devices. The server will reject communication with any clients that have no public key, registered at the server. Besides, this will give you the possibility to prohibit access for some client devices if think they were compromised.

don't want human-interaction between devices and server

Yes, this will be fulfilled.

After installation app, this client device should be already authenticated.

Installing a key pair on the device and pre-registering it on the server side will make them automatically authenticated when they establish connection to server.

Also want to avoid incorrect/fake devices.

The server will communicate only with clients whose public key is pre-registered on the server.

Improve this answer
4
  • Is there any other options instead of PKI?
    – Necromancer
    Jul 1, 2020 at 7:59
  • 1
    There can be some other solutions. E.g. you may go straight forward and embed user and password into each client. The reliability of password will be the same as the reliability of the private key in case of PKI. But also in this case to establish secure connection to the server each client needs to have the certificate of your CA so that it knows that it talks to the server, not to the man-in-the-middle.
    – mentallurg
    Jul 1, 2020 at 8:34
  • Is there any risk for using self signed certificate?
    – Necromancer
    Jul 6, 2020 at 5:44
  • In case you use CA you can organize the process so that each device is verified before issuing a certificate to it. Thus, when server receives a request and the client can present a request issued by CA, it can be trusted. Where as when you use self-signed certificates, some malicious device can pretend to be one of your normal devices, and there will be no way to distinguish them. Instead, I'd suggest to establish your own CA. This CA can use self-signed certificate and issue normal signed certificates to devices.
    – mentallurg
    Jul 6, 2020 at 9:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .