Assuming I make the HTTP server on my Arduino publically available, are there any suggestions for protecting it from unauthorized access? My only two three ideas thus far are:
Check the IP of the connected client against a whitelist of allowed clients. This would be the most secure, but not very practical.
Have a password form. Not very secure against MitM attacks or brute force password guessing attacks.
Require a hash of the request page name, any parameters, the time, and a password with every request. This might be the best from a security perspective, but seems the most difficult to implement.
I'm looking forward to any other suggestions, comments on the above ideas, or info on any existing projects related to this.
I'm building an alarm system (though it will not be publically accessable, so this does not apply to it) which got me thinking about this.
For this hypothetical setup, I would say "the pain" is enough that it needs some sort of protection, but not so much that someone would be willing to invest in anyhting more than an Arduino.
The Arduino provides a 10 digit code
You answer it with 10 digits according to a certain algorithm.
e.g. The formula could be
Place the (day+month) hour minutes backwards on place 012345
add the 10 digits, and place it in the answer at position 6 and 7.
add these 8 digits and subtract from 99 and place that number on pos 8 and 9
e.g 1234567890
sum = 45
response = 2412064575
the formula could also any kind of function that you can do from the head.
e.g. the first 2 digits indicate the length of the response string.
Another security system I saw once was that you needed to "scramble" the headline of some newssite e.g. cnn.com. That headline formed the challenge,
So the challenge generator was not part of the local system. Think of adding the last 2 digits of the S&P index.
There are properly secure ways to do this, although program size is an issue when starting to add in cryptographic libraries. You need to assess what the threat model is and then choose something that addresses this. Its quite likely that all you need is authentication (ie a MAC as someone has sort of described already), but you might want to add replay-prevention (so that if someone uses the same URL again the second time it is ignored).
Thanks for the replies. I agree that anyhtign that needs high security probably shouldn't run off an Arduino, but again,
for this hypothetical setup, I would say "the pain" is enough that it needs some sort of protection, but not so much that someone would be willing to invest in anyhting more than an Arduino.
So how do you make the challenge different each time you access the sketch immediately after the Arduino has been reset? Don't you need a source of randomness?
