I'm designing a very simple data collection device for a research project. Because we are logging, among other stuff, the GPS position of actual vehicles, we need to protect the data. Since we manually deploy every logging device, there is no need for registrations or logins.
I have set up a web server (Node.js), a database (MongoDB), an app (native iOS), and a data format (JSON). The client regularly sends JSON to the web server with the following command:
(with the actual data as a POST variable)
deviceId is a simple identifier, for now just a number (0, 1 or 2), to make me choose which MongoDB collection to store the data in.
hash is a hash of the HTTP verb, the url, and the device's secret (just a random string hard-coded into each device), inspired by this answer.
My concern here is how secure such a system is. I am using HTTPS to protect the data transfer, and the device secret to make sure it's actually one of our devices, and not the neighbor's son trying to hack us.
Is that enough?