How do I securely identify a remote (self programmed embedded) device in PHP?

Question

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)?

Background: I have several embedded devices (self programmed & adaptable) that contact a webserver (php+mysql) with status updates. These updates are then - if the source is confirmed - saved to a database.

• As I understand it $_SERVER['REMOTE_ADDR'] usually can be trusted (except some IIS configuration where it may - under special circumstances - wrongfully return 127.0.0.1; but different story)

• Anyhow since I use SSL, the IP address really should not be a problem, because a handshake is required and if the IP is faked or simply wrong, the connection should not be established

• For now I require IP addresses to be whitelisted by admin, for an status update to be accepted

• The device additionally sends the MAC address via $_POST to identify the different modules with identical IP address (I know this can very easily be forged, and right now will be trusted if the IP address is trusted)

---

So first of all I am not sure if the IP address in itself is enough for it to be safe from attacks from the outside

Secondly if the device is behind a router, it will have the same IP address as every PC/device on that network. So about anyone there could forge a status update with a fake MAC address (simply as post variable), and since the IP address is whitelisted it will be trusted

So is there any way of confirming the identity of a device, or do you know a better way of doing this?

Aside: Going the other way, and have the webserver poll the different devices might be an option, but since there might be many (> 2000) devices of which we need the very last status (change) I thought it to be inefficient.

I have also heard of using a signed certificate, or multiple (for different clients), but I don't know how to go about that, so thanks in advance for every bit of information.

Usually I don't post (a lot of) questions, but this is really hard to Google - at least for me!

Answer 1

Cryptographic point of view: the only way you can distinguish, from the outside, a fake device from a genuine one is by making the genuine device "know" some value that the attacker does not know.

This can be the equivalent of a "password" (since there is no human involved, that password can be a sequence of 40 random characters, i.e. something quite strong and thus unguessable by attackers). You can store that in a custom HTTP header, or the standard "Authorization" header, or as some cookie value, or encoded as a parameter in the URL; all of these are supported by most Web frameworks, both on client and server.

You can also use X.509 certificates. SSL supports client-side certificate authentication. In that case, the "secret" value on the device is an asymmetric private key (usually RSA) and you must arrange (with a custom PKI) for the issuing of one certificate per device. Certificates are cool if you don't want your server to keep a copy of the device secrets (or hashed version thereof), e.g. because you would like to deploy new devices without having to actually inform the server. If that's not a problem with you, the "password" method will be easier than dealing with certificates.

Either way, you certainly do not want to put the same secret value in any two distinct devices. You really want to have device-specific secrets; otherwise, someone "opening" one of your devices will endanger your whole system. With device-specific secrets, you can disable authentication for some known subverted devices, from the server, without impacting the other devices.

---

Without a device-side secret value of any kind, your problem has no solution. In the Internet Protocol, machines are isolated from each other; they only see IP addresses, which are not "protected" in any way. The scope of hardware elements such as MAC addresses stops at the first router (and they can be faked easily anyway).

Answer 2

if the device is behind a router...anyone there could forge a status update with a fake MAC address

MAC addresses don't cross routers.

have the webserver poll the different devices might be an option

Tricky when you don't know their IP addresses / they are behind NAT routers.

is there any way of confirming the identity of a device

Possible solutions:

1) use SSL for data exchanges, and only accept data from devices that include a shared secret in the request (GET/POST/Cookies).

2) Use SSL with Client certificate authentication

3) use a challenge based authenticaton mechanism - note that HTTP digest authentication has a number of issues which reduce it's effectiveness in the absence of SSL - and with SSL, there's not great advantage over standard HTTP authentication

4) validate the request against a time varient hash (subject to replay attacks within time window, requires clock synchronization), e.g.

url="http://yourserver.com/beacon?device=me";
var t = new Date();
t=t.getTime();
url+="&t=" + t;
var hash=md5(url+"sharedSecret");
url+="&hash=" + hash;