What proven methods exist for authentication of a user on remote, unconnected machines/devices where establishing unique login credentials for the users isn't practical due to the number of machines/devices?

We have an application where we have a large number of industrial devices distributed around the world and we'd like to secure these so that only authorized technicians can access them and retrieve the data. These aren't always connected to network and they are often left in unmanned locations, so physical security is not something that can be counted on and authentication with a server isn't possible.

I'm sure this kind of challenge has existed for decades, and while I've seen many really bad attempts at solving this (e.g. a single password for all technicians) I haven't personally encountered anything that seems both robust and elegant.

I suppose an encrypted certificate that requires a password (albeit shared) would be a step in the right direction. This weak 2-factor method would require the technician has something (like a USB key w/ cert) and it prevents immediate exposure of the certificate if the USB key is dropped in a parking lot but I'm wondering if there's something better.

What scares me about this is the high probability of a foolish person creating "password.txt" and putting it alongside the cert...

Thanks for your thoughts.

  • Are the devices ever connected to the network? Even intermittently? Can you rely on that? If not, how will you install and maintain the credential DB? Aug 31 '15 at 23:32
  • Some of these devices may never be connected to a network. The idea was that the validation would be integrated into the embedded software of the device, i.e. when it is initially programmed and then shipped it includes some kind of validation mechanism for the certificate. Aug 31 '15 at 23:38
  • How will you handle resetting lost or exposed passwords? Aug 31 '15 at 23:39
  • Good question! Hence my use of the word "weak"... really looking for suggestions on robust (or at least better) solutions given the limitations. Aug 31 '15 at 23:41

So I think that, given the lack of physical security of the devices, whatever you do will be only best-effort. You just can't stop someone from stripping the device down, reading the data, modifying it, etc... Let's just take that as a given and move on.

This solution utilizes HMACs. An HMAC takes two inputs, a string and secret, and produces an output string that is cryptographically difficult/impossible to forge without knowing the the secret.

Put on all devices a shared secret (the same one) that is also known by the device administrators (they're the ones who give out authentication information to technicians). As the device is not physically secure, the storage of the secret will be less-than-perfect, but we already agreed that we'd be OK with this.

An admin will give a user a username and a password. The password will be the result of HMAC(secret, username) (possibly truncated to some reasonable length). When the user logs into a device, they will enter their username and password. The device will recalculate the HMAC, truncate it to the appropriate length, and compare it with the user's password.

Depending on your needs, you can make some changes to the system:

  • Instead of storing the same secret on every device, you can store different secrets. This will, of course, increase administration costs, but it will add some security. You could give each device its own secret or group devices by geographic location, issue date, or other means.
  • Along with the username and password, you could give each user a password expiration date. They would then enter their username, password, and expiration date when logging in. Their password would be HMAC(secret, username + expiration date). The advantage of this is that passwords naturally timeout so an exposed password won't haunt you forever. The disadvantage is that users will need to continually get new passwords. Unlike more typical password expiry, users will need to contact admins to get their new password. Here too the lack of physical security may allow attackers to reset the date on the device, reactivating an expired password. Again, we agreed that perfect security won't be possible without hardware security.
  • Depending on the flexibility of the device, you may be able to move the credentials to a USB drive, SD card, or some other device that can be used for authentication. An encrypted USB key like this one will provide you with 2-factor authentication.
  • With each user having a unique login, you can implement some type of auditing.

Notable problems with this system include:

  • Inability to disable a password. Even if you use the date extension, you need to wait for the password to expire.
  • Unless you use a secure USB key (or similarly secure device) for authentication, it is still open to users creating "passwords.txt" files.
  • The lack of hardware security greatly reduces any security efforts.
  • Thanks Neil, this is a good answer. It also shares some similarities with something I had thought of before posting, so it's good to see I was headed down the right path. I think the expiration date consideration you have is critical for something as weakly managed as this kind of "best of the not-so-good solutions for a bad situation." Thanks again. Sep 8 '15 at 21:01
  • If you're happy with the answer you should select it with the check mark next to it. Sep 8 '15 at 22:04
  • Sorry, still new here. I had voted up instead of selecting the checkbox. I've done this now. Sep 9 '15 at 13:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.