I want to develop a server for a sensor on the Internet of things (IoT). Everybody can buy the App for that specific sensor. The App will exchange data with the server. How can the server validate that data is really stemming from a legitimate App?
Since everybody can buy the App and a compatible sensor, 'everybody' can also disassemble/hack and copy the authentication into a non-legit app, also if the server would provide a one time license code, or a pre-shared key, or a certificate.
Looking at DTLS-based Security with two-way Authentication for IoT, it seems that a trusted platform module (TPM) is the way to go. But that would not be a viable solution for an App in an App store, wouldn't it?
Is there any other way for the server to validate that a message is really from a legitimate App? Perhaps a way that is not as strong as a TPM, but still acceptable depending on the value of the data to protect?