There is a device which has three software running on it, the main purpose is the control of some machinery.
a GUI front-end, running on a single-board computer with easily accessible storage (hard disk or SD card, etc.)
a back-end, running on the same SBC as the above.
a microcontroller which drives the hardware, and communicates solely with the back-end. The messages between #2 and #3 are short, in the range of 10 to at most 50 bytes.
Income is solely made by manufacturing and selling the device itself. However, the majority of the development costs are made up by developing the software #1 and #2.
The threat model is someone making a physical clone of the device, implementing their own version of software #3, and stealing software #1 and #2. For our threat model, for the attacker to read the memory (either volatile or non-volatile) of the microcontroller in #3 is to be considered impossible. Wiretapping the communication between #2 and #3 is to be considered easy.
This looks like a standard case of software protection dongle, with its obvious drawbacks: if it's only "check for the presence of the dongle", even if it's based on sending randomly generated code encrypted by the public key on one end, and decrypting it with the private key on the other end, it's easy to defeat with a single change in a single jump instruction to bypass the "if". Anything more would require very complicated solutions, like executing some code meant to be executed in #1 or #2 in the microcontroller instead.
Instead, I'm considering the following:
- The microcontroller, obviously, will hold the private key of an asymmetric encryption.
- The commands sent from #2 to #3 will be encrypted by the public key.
- The replies (mainly status messages about the states of the controlled machinery) sent from #3 to #2 will be encrypted with the private key.
Does this scheme has critical drawbacks? Are there better alternatives?
I can see the following problems:
It doesn't secure #1 at all. (Maybe it could be done by routing it through #2 but it would make it needlessly complicated)
There are not too many types of messages and the messages are relatively short. Especially replies could be attacked, as the state of the machinery is visible, so by wiretapping one can see what kind of message gets generated in which state of the machinery. Yes, the messages could be padded, but not by orders of magnitude (it would reduce bandwidth), and adding random junk seems to be like a form of security through obscurity.