The scenario:
- Our customer creates physical devices used in infrastructure across the globe
- Their new devices have IoT capabilities and can communicate their status and other sensor data to the cloud
- We are building a web portal that displays information about these devices
- This web portal provides access to customers and to their staff
The need:
We need to build a secure customer registration process that ensures the person who registers an account with the portal is their actual customer, and gains access to the data emitted from the device they own.
The current process, as outlined so far:
When a device is sold their ERP system will inform the customer portal, via a secure connection (API), that a device has been sold. It will include device details (serial number, etc.) and some customer information (note: the customer information at this point may belong to a wholesaler and not be the end customer we are interested in).
The devices will include some kind of label with a QR code/URL/key that can be used to register the device.
The problem: it is difficult to make this secure, because, for example, it would be possible for someone to photograph the QR code while the device is in transit. Someone with the photograph could then register the device inappropriately.
Ideas:
- Create a tamper-proof label, such as something that you can scratch the surface of (like a lottery ticket) to reveal a secret key used for registration. Include a big warning that, if you are the end user and this label has been tampered with, you need to inform the company immediately.
- Try to develop some kind of two-factor authentication, whereby on registration with the portal, the portal informs the ERP of registration, and the ERP sends an email to the customer to verify the registration. Problem with this approach is the wholesaler situation I mentioned previously.
- Request that the customer enter some kind of information that only they, and the origin company know, such as order ID. Problem with this is that it's not terribly secure, the order ID may appear on bills of sale, shipping forms, etc.
Can anyone suggest a secure method of doing this? Is there an existing solution or pattern we can adopt? Thoughts welcome - thanks!