Ideas for subscription implementation in electronic devices - Page 1
Forum section: electronics / projects

author: ricko_uk
author_rank: Super Contributor
timestamp: December 15, 2020, 12:28:42 am
content: Hi,I need to upgrade a portable device for a client so that they can allow the users to purchase additional software functionality in the form of additional date/parameters that can be easily downloaded into the portable unit (i.e. the device in question).The main requirements are:1)very easyfor the user to purchase/download/enable the additional functionality2) very quick and easy for me to implement because of the limited budget and tight timescale and have not previously implemented similar systemsI am open to suggestions that are software/hardware or just hardware. Web based interfaces/solutions are also welcomed but again, I can design a website but have no experience on web/server programming or languages. But I do have years of experience in C and C++ for embedded systems.Any suggestions/ideas?Thank you

author: dmills
author_rank: Super Contributor
timestamp: December 15, 2020, 12:52:58 am
content: It depends a bit on your threat model, but what I did this a product that we were not expecting serious attempts to hack the keygen on was the following:The device has MAC address, unique programmed by the processor vendor, but a serial number works as well.I threw a HTML singe file web page together as a keygen for our office use that worked as follows.Firstly, I came up with a 'secret key', just a shortish text string in my case, this is a shared secret, so not terribly secure, but simple and good enough for what I needed, IIRC I used one of the products licensing error messages to disguise things a little.My keygen had a set of check boxes for license options and a field to enter the mac address, the options were just coded as a bitfield stored in an integer.The license key that was generated was an ascii hex string <Mac address><License code><SHA1>Totalled as I recall 68 bytes in my implementation.When generating the key, I did SHA1(<secret string><mac address><license code>)The file written was <mac address><license code><sha1>, one line of hex digits.When the file was loaded onto the device (We used a usb key, but whatever), the firmware extracted the sha1, then did sha1(remaining bit of string), and checked that the hashes matched, then that the mac address was correct.If those two things checked out then it used a location in our device boot flash where it CLEARED bits corresponding to any bits set in the license code (Flash can always clear bits, but needs erase to set them).The licensed functions then simply checked the appropriate bit was clear in the license store.Yea, I know sha1 is a bit shit, but the whole thing was a bit shit, it also took me a morning to bash together.Subscription, as in timed expire is harder and really needs both an RTC and some eeprom or such.Regards, Dan.

author: girishv
author_rank: Regular Contributor
timestamp: December 15, 2020, 02:15:44 am
content: I have been evaluating various security options for protecting AES keys for our NFC/Payment solutions. The industry standard for securing AES keys is to use Secure Access Modules (SAM). Unfortunately, logistics of lifecycle management of SAM can be overwhelming for SME's. On the other hand, there is no easy way out.During my quest for the alternate solutions, I found one of the solutions to be attractive. It is "Trust Platform for the CryptoAuthentication" product family from Microchip. They offer an interesting set of features for protecting IoT devices in field. I have shamelessly copied few of them herePre-configured and pre-provisioned with keys and generic certificates for thumbprint authenticationMOQ is 10 units including provisioningCode examples are available for AWS, Azure, Google IoT SDKIf you can commit to a larger MoQ, you will get advanced feature set.Checkouthttps://www.microchip.com/design-centers/security-ics/trust-platformA solution like above will allow you to focus on your product. The asking price may not be very steep considering you end up doing very little or no work on security front.Disclaimer: I have no affiliation with Microchip.

author: ricko_uk
author_rank: Super Contributor
timestamp: December 15, 2020, 03:37:50 am
content: Thank you Dan and girishv!Very interesting! But way too complex for what I am looking for. It is a very simple low cost application. No need for security or anything like that.Any other very simple, low cost and easy to implement solutions?Thank you

author: girishv
author_rank: Regular Contributor
timestamp: December 15, 2020, 05:14:08 am
content: Quote from: ricko_uk on December 15, 2020, 03:37:50 amWe have designed and deployed dozens of custom network appliances based on Open Source technologies. As there was limited physical access to these devices, we needed a robust remote management system covering monitoring, (re)configuring and updating the devices. We had to spend a significant portion of budget on device management.From my experience, low cost and easy to implement don't go together unless you leverage open source technologies and protocols.I suggest you consider a solution like AWS + FreeRTOS. You will get a jump start on building your devices which can managed and upgraded over the air.Checkouthttps://aws.amazon.com/freertos/features/

author: ricko_uk
author_rank: Super Contributor
timestamp: December 15, 2020, 06:53:36 pm
content: Thank you girishvThat looks interesting but ideally am looking for an even simpler methods/ideas simply because as mentioned in the OP I have no experience in web server programming.Any other ideas?

author: dmills
author_rank: Super Contributor
timestamp: December 15, 2020, 07:38:24 pm
content: My thing was about as simple as such things can be, the only way to make it simpler would be to drop the sha1 and shared secret, but that makes the file very, very trivial to hand hack.IIRC the C bit was less then a hundred lines, and the HTML (No web server was involved, it was just a file that opened in a web browser and generated the license file with a bit of javascript mostly copied off stack overflow, I don't do we dev), maybe a few times that, but mostly cntrl-C-V 'coding'. The key gen could have been python, or C++ or whatever, but the nice thing about a self contained .html file is that it will run anywhere on pretty much any thing.Really secure doings for PCI compliance or such are WAY complicated, and almost always best brought in, but feature licensing in an embedded product is usually not something that needs magic and is usually a fairly low effort thing.Regards, Dan.

author: girishv
author_rank: Regular Contributor
timestamp: December 16, 2020, 01:02:00 am
content: Quote from: ricko_uk on December 15, 2020, 06:53:36 pmI know you are looking for simpler methods/ideas. I suppose your concerns on web/services is main reason for exploring simple solutions. But, there are ways to start with little/no server side development.Checkouthttps://github.com/mainflux/mainflux/. You will get following features out of the box. I have listed some key features.Multi-protocol connectivity and bridging (HTTP, MQTT, WebSocket and CoAP)Device management and provisioning (Zero Touch provisioning)Message persistence (Cassandra, InfluxDB, MongoDB and PostgresSQL)There are many commercial options like AWS IoT Core, Azure IoT and many more. Whatever you choose, there is some learning curve and it may look steep. But, these solutions make your product look very professional without spending thousands of man hours reinventing the wheel.

author: mag_therm
author_rank: Frequent Contributor
timestamp: December 16, 2020, 01:19:04 am
content: On linux to clients around the world, I use ssh tunnel vsftpd and vnc, bidirectional, interactive if needed, worked well for 10+ years. Firewall is whitelist.Small body of clients and specialized.You could do a nice GUI over that if needed.

author: ricko_uk
author_rank: Super Contributor
timestamp: December 17, 2020, 11:47:34 pm
content: Thank you all. Learned a lot as I researched more all the solutions offered.