Is it possible to have different keys on alot of (embedded) devices and just have 1 key on a server (to witch all these devices connect)? The main point here being when 1 device is compromised this does not mean the traffic between other devices and the server is compromised (even if the server does not know that 1 device is compromised).
Background:
All the devices will have a key pre-installed during the assembly of the device but must be changeable over internet.
Currently all devices in 1 system (a customer can have multiple systems) have the same key. But I am trying to create it in such a way that they all have different keys, hence the question.
What I think I know:
1. I believe DVD's and dvd-players use a similar scheme (ccr?) but this is broken.
2. There are Key Derivation Functions which could be used for this scenario.
For point 2 I am not quite sure how to use this i can (when assembling the device) make a salt and use it with (for example) PBKDF2 and a master key (which the server will have) than store the PBKDF2 generated key and the salt on the device and send over the salt to the server when the device is connecting so the server can create the key again. though after this i should set up a session key as well. and worst of all the salt will be vulnerable.
So this to me does not seem like a solution.
How should I do this properly, or am I looking at this the wrong way and should i do something different?