I'm building a small server at home, and I'd like to have a sort of "smart" board to control its power. This board will have, at the beginning, to simply turn it on or off (more features will be added later).
This device will be sort of Arduino based (in fact it is a more powerful microcontroller, but I'm using the Arduino environment to program it).
Now, the access to all the network will be provided through VPN from the server, but obviously the switch cannot be accessed only through VPN (since it cannot be reached if the server is off, hence I will not be able to turn it on). So a direct internet access is needed for it.
I wanted to secure the operations, since allowing anyone to turn on and off my server is a bit problematic..
What I thought was using a set of pre-shared symmetric keys (thinking about AES); every time the webpage is loaded the microcontroller sends a seed (for instance the date) and the client, through JavaScript, evaluates a token to be sent along with the request encrypting, for instance, the seed and the request with the key passed in a textbox.
What do you think? Are there simpler solutions already known? How is this problem usually handled?
Please note that HTTPS is not a solution, since implementing it onto a microcontroller is quite hard...
EDIT: since some additional info were asked, here is something more specific:
the board I'm planning to use is a Maple Mini; the processor is a STM32-F103RCBT6 (72 MHz, 120 KB Flash, 20 KB SRAM). I'll be using an ENC28J60 ethernet interface (so no hardware stack).
I will forward a port from my router to it, since I want this functionality to be available from "the outer world"; the interface will be a webpage. If the flash becomes too tight, I can put the page on an external SD card.