How do I prevent non-legit client apps from using my server?

Question

I’m currently writing a pair of client/server applications. I was recently posed with the question of “how do I prevent someone from writing their own client application and using our server?” I really didn’t have an answer to that question because all of the secure communication stuff I have done to date is to ensure the communications between the client and server are encrypted. This would be a departure from that train of thought in that – how do I ensure the client application on the other end is the client application I want to talk to (and not someone pretending to be my client application)?

Anyone have any thoughts on a reasonable way to do this?

Answer 1

You can't ensure such a thing. The only thing that the server sees is the communication, and if a different client application behaves exactly like your client application, you can't see the difference.

Why is it important that only your own client application can talk to your server? If it's about security, then your security design is wrong. The simple fact is that the client application can never be trusted by the server, not even if it's your own client application.

Answer 2

This is difficult to answer without knowing more about what your server does and who the clients are. But there are a couple of options:

1. Look at the IP of your clients. If the number of clients is small, it should be easy to maintain a list of IPs that are allowed to use your system.
2. Since you are already using encryption, why not go one step further and work with client certificates?

Answer 3

Why? If client environment isn't controlled and some third party client can be installed there, nothing can completely prevent user from tampering with official client, so anything security related should be done at server-side and in this case third party client isn't problem, or environment should be controlled.

If it's requested, frequent protocol changes with auto-updates pushed to client can hinder alternative client development. (exterrogated case: client consist only of bootstrap, downloading application from server. Protocol and corresponding application parts change virus-like with every copy).

License and lawyers can help here too

Answer 4

challenge/response is one way.

Embed a serial number and a key unique to that serial number within your application (client and server). Then, when the client attaches and sends it's serial number, the server will compute a challenge to be sent to the client (using the known key). When the client receives the challenge, it has to respond with the response (which it computes from it's internal key).