2

Is identifying a pi device based on its serial number(pulled from the cat /proc/cpuinfo) and hash of the output of cat /proc/cpuinfo as reliable as username/password authentication?

I am thinking of building a native application, which will need to communicate with a server and I am struggling with authentication.

INFO:

  1. Python application
  2. Commercial
  3. Heavy communication with the server (Eventually long connections, short period between connections)

Outcome:

identify the device and make sure that the specific (hardware?)device is making the requests and not mimicked by another device or recreated by an external party for malicious purposes (Helps with licensing and with security, IMO)

3
  • Would ssh be an option? – Thorbjørn Ravn Andersen Jan 4 '14 at 2:09
  • SSH will not be an option, because the client applications will connect to a central server which will need to perform various tasks. So, basically what I need is an API authentication. – DaGhostman Dimitrov Jan 4 '14 at 14:10
  • They could connect with ssh. – Thorbjørn Ravn Andersen Jan 4 '14 at 15:20
2

A recent project with banking might bring some insight for this. Since banks use it I am sure you can.

This is about sending data from client domain to bank domain using GET/POST data with a HASH. The key here is that the server of the client uses a Private key within a long string of data to verify the origin and the integrity of the data being sent. Prevents tampering and man in the middle attacks. But it does not obscure data unless you use HTTPS

In your case you can use the serial number, mac address, SD card serial number,and anything else that is unique to the hardware configuration.

Private key: !PRIVATE!

String to hash: rpiserial!PRIVATE!macaddres!PRIVATE!sdserial!PRIVATE!timestamp!PRIVATE!  etc...

HASH : SHA256 recommended

The time stamp shgould be a unique number generated on the Pi that is never repeated but you can generate the number on your server based on the information you know about the Pi. Like Google authenticator or some algorithm that generates unique number for that Pi only.

Now you can generate a private key for each RPI, keep it on the Pi and on your Secure server. Keep all the data on the secure server. Everytime a request comes in you compare the HASH from the Pi on the Server. If it matches it means the origin is unique.

The only problem is that if somebody steals the SD card they have access to the Private key and your unqiue number generator. So they might compromise that single Pi without you knowing, but the rest will be Fine.

That verifies the origin, based on the hash of all the hardware serials you are using.

Then if you embed encrypted data you know its from that Pi, and its not been tampered with and you can unencrypted and trust it.

As long as both devices are in a secure place and cannot be accessed by anybody this is pretty solid for now.

You should read up about DRM used in games or a technique called perfect forward encryption.

2
  • This is an outstanding answer! I was wondering if anyone was going to answer it. (I even tough about reposting on SO) – DaGhostman Dimitrov Jan 4 '14 at 14:36
  • Glad it could help. Just remember to build the string on the Pi and your server every time, then hash it and compare them (if you are using a unique variable like timestamp) otherwise. Good luck :) – Piotr Kula Jan 4 '14 at 15:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.