I am building an IoT platform that should receive data from a Raspberry Pi over a REST API. Assuming the platform could in the future be used to manage multiple devices of multiple users, my question is, how the device should be assigned correctly (and securely) to the account of the user who owns the device. The simplest solution would be to issue an access token that is linked to a user and a device, which is then manually (e.g. with a Bluetooth app) deployed to the device. Whenever the device sends data to the server, the access token ensures, that the data is associated with the correct user account.

However, this method does not prevent the user from logging manually to the server e.g. using a python script. I was thinking about a private/public key mechanism, that could ensure, that only the device with the correct private key is able to post data to the server. I also have an idea about how to implement this, but my question is, is this really needed? Is it a problem, if users can log manually (without the device) to the server? Does it matter, what data is sent to the server if the API post includes a valid access token?

  • 1
    At the end of the day, a piece of software uses some protocol on the internet to get to your service in the cloud. It uses some security mechanism to authenticate/authorize. If the end user can get at the security token and knows what end point to use, you wont be able to control them from calling it from a different piece of software. However, if they do, it would be their data. Why would you care ? If you really have to ensure it came from a certain hardware, you'd have to use some sort of signing mechanism on the hardware with you prividing keys. Microchip ATSHA204A for example. – kalyanswaroop Mar 18 at 1:16
  • 1
    In fact, if you do allow code running on a developer's PC to call your API, it makes your product easier to learn, test, monitor, adapt. – kalyanswaroop Mar 18 at 1:32
  • Thanks, thats what i wanted to know. Indeed, the signing mechanism would be a lot more difficult to implement, therefore my question if it is worth the trouble. – kleka Mar 18 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.