3

The scenario:

  • Our customer creates physical devices used in infrastructure across the globe
  • Their new devices have IoT capabilities and can communicate their status and other sensor data to the cloud
  • We are building a web portal that displays information about these devices
  • This web portal provides access to customers and to their staff

The need:

We need to build a secure customer registration process that ensures the person who registers an account with the portal is their actual customer, and gains access to the data emitted from the device they own.

The current process, as outlined so far:

When a device is sold their ERP system will inform the customer portal, via a secure connection (API), that a device has been sold. It will include device details (serial number, etc.) and some customer information (note: the customer information at this point may belong to a wholesaler and not be the end customer we are interested in).

The devices will include some kind of label with a QR code/URL/key that can be used to register the device.

The problem: it is difficult to make this secure, because, for example, it would be possible for someone to photograph the QR code while the device is in transit. Someone with the photograph could then register the device inappropriately.

Ideas:

  • Create a tamper-proof label, such as something that you can scratch the surface of (like a lottery ticket) to reveal a secret key used for registration. Include a big warning that, if you are the end user and this label has been tampered with, you need to inform the company immediately.
  • Try to develop some kind of two-factor authentication, whereby on registration with the portal, the portal informs the ERP of registration, and the ERP sends an email to the customer to verify the registration. Problem with this approach is the wholesaler situation I mentioned previously.
  • Request that the customer enter some kind of information that only they, and the origin company know, such as order ID. Problem with this is that it's not terribly secure, the order ID may appear on bills of sale, shipping forms, etc.

Can anyone suggest a secure method of doing this? Is there an existing solution or pattern we can adopt? Thoughts welcome - thanks!

|improve this question
  • 1
    Could qr code be put inside package, so it is invisible unless customer unpack it? – Konstantin Petrukhnov Nov 16 '16 at 13:34
  • @KonstantinPetrukhnov these devices are very large (room size), so they do not come inside a package. We could conceivably include a package with the device, though, that might serve this purpose. That is essentially my tamper-proof label idea. – adriandz Nov 16 '16 at 14:57
  • @adriandz: how do you identify the final customer? Do you even know who the final customer is? – Bogdan Nov 16 '16 at 15:36
  • @adriandz: Do those devices come with some kind of paper documentation? Then you could package the tamper-proof label along with that. – Bart van Ingen Schenau Nov 16 '16 at 16:55
3

I would have the device register itself rather than having the customer register a device.

  • A customer creates a customer account. This allows the customer to manage individual accounts for other users within the company, to grant privileges to those accounts, etc. I assume customers will tend to have more than one device and that there will be multiple users that want to view the data. And companies may want to segregate users so some users can view data only for a subset of the devices.
  • During the setup process, in addition to doing things like setting up the
    network connection and an alias that they control, the customer provides the customer account login information to the device.
  • The device contacts the portal and registers itself using the customer account username & password and its internal identifier. If an attacker had previously found and registered that identifier, you can throw an error or do whatever else you'd like to do to investigate/ resolve the issue (remembering that the second registration may be an attack by someone else or may be the real customer registering the device).

This way, users don't need to worry about paperwork that goes missing or typing in a long secret key. They're just hitting a "Register Device" button and the device handles the rest.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.