Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #27427

Re: Embedded Ethernet

Show all headers | View raw

pozz <pozzugno@gmail.com> writes:

> Now the problem is how to increase the security of communication over
> Internet. This isn't a simple task. In my application, it means adding
> HTTP authorization, strong encryption and so on.
> Unfortunately lwip HTTP server doesn't support authentication (even
> the basic method) and encryption, so it must be added.
>
> I think authentication and encryption is not a problem only with HTTP
> applications, but for all communication protocols over public networks
> (so MQTT, SMTP, SNMP and so on).
>
> I understood *the solution* is TLS/SSL (I think HTTPS means HTTP over
> TLS). And TLS/SSL means strong encryption that needs some crypto hw
> engine (that LPC1769 doesn't have).

We're using TLS with client side (and server side) certificates to do
authentication (i.e. knowing who the other party is and create a secure
channel). Keys can be kept on a separate TPM chip.

Authorization (who is allowed to do what) is more complex issue,
basically our server is allowed to do almost anything, except update
firmware. Firmware is signed with separate key.

We're running Linux on AM3352, though. I found references of mbedTLS
being able to use client side certificates, but setting up the whole
system may not be that easy. On Linux stunnel is a nice way to tunnel
traffic if you don't want to do TLS connections from your
application.

Separate crypto engine is not necessarily needed, it just gives you more
security (key storage) or performance (crypto functionality).

--
mikko

Back to comp.arch.embedded | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-09-22 17:52 +0200
  Re: Embedded Ethernet mmm <m.colandrea@libero.it> - 2017-09-22 18:00 +0200
  Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-09-22 20:27 +0200
    Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-11-17 10:25 +0100
      Re: Embedded Ethernet Theo Markettos <theom+news@chiark.greenend.org.uk> - 2017-11-17 10:39 +0000
        Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-11-17 12:25 +0100
      Re: Embedded Ethernet "Boudewijn Dijkstra" <sp4mtr4p.boudewijn@indes.com> - 2017-11-17 11:36 +0100
        Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-11-17 12:54 +0100
      Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-11-17 15:23 +0100
      Re: Embedded Ethernet Mikko OH2HVJ <mikko.syrjalahti@nospam.fi> - 2017-11-18 11:29 +0200
  Re: Embedded Ethernet Joe Chisolm <jchisolm6@earthlink.net> - 2017-09-22 13:31 -0500
    Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-09-23 00:01 +0200
      Re: Embedded Ethernet raimond.dragomir@gmail.com - 2017-09-22 22:38 -0700
        Re: Embedded Ethernet raimond.dragomir@gmail.com - 2017-09-22 22:41 -0700
      Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-09-23 12:02 +0200
        Re: Embedded Ethernet Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-09-23 06:32 -0400
          Re: Embedded Ethernet Dimiter_Popoff <dp@tgi-sci.com> - 2017-09-23 15:31 +0300
            Re: Embedded Ethernet Phil Hobbs <pcdhSpamMeSenseless@electrooptical.net> - 2017-09-25 13:07 -0400
              Re: Embedded Ethernet Robert Wessel <robertwessel2@yahoo.com> - 2017-09-25 15:31 -0500
                Re: Embedded Ethernet Dimiter_Popoff <dp@tgi-sci.com> - 2017-09-27 01:50 +0300
          Re: Embedded Ethernet Les Cargill <lcargill99@comcast.com> - 2017-09-28 20:07 -0500
        Re: Embedded Ethernet upsidedown@downunder.com - 2017-09-23 14:48 +0300
        Re: Embedded Ethernet Les Cargill <lcargill99@comcast.com> - 2017-09-28 20:06 -0500
          Re: Embedded Ethernet Joe Chisolm <jchisolm6@earthlink.net> - 2017-09-29 09:41 -0500
          Re: Embedded Ethernet upsidedown@downunder.com - 2017-09-30 18:49 +0300
        Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-10-12 11:26 +0200
          Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-10-12 12:46 +0200
          Re: Embedded Ethernet Joe Chisolm <jchisolm6@earthlink.net> - 2017-10-12 10:49 -0500
      Re: Embedded Ethernet Grant Edwards <invalid@invalid.invalid> - 2017-09-23 20:40 +0000
        Re: Embedded Ethernet Joe Chisolm <jchisolm6@earthlink.net> - 2017-09-23 19:24 -0500
          Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-09-24 13:28 +0200
  Re: Embedded Ethernet Les Cargill <lcargill99@comcast.com> - 2017-09-22 21:12 -0500
  Re: Embedded Ethernet Tauno Voipio <tauno.voipio@notused.fi.invalid> - 2017-09-24 11:01 +0300
  Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-10-16 14:10 +0200
    Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-10-16 15:10 +0200
      Re: Embedded Ethernet pozz <pozzugno@gmail.com> - 2017-10-16 17:54 +0200
        Re: Embedded Ethernet David Brown <david.brown@hesbynett.no> - 2017-10-16 23:45 +0200
          lwip/httpd: how to return dynamic data [was Re: Embedded Ethernet] pozz <pozzugno@gmail.com> - 2017-11-13 12:11 +0100
            Re: lwip/httpd: how to return dynamic data [was Re: Embedded Ethernet] David Brown <david.brown@hesbynett.no> - 2017-11-13 14:14 +0100

csiph-web