{"id":589,"date":"2014-11-19T17:49:47","date_gmt":"2014-11-19T16:49:47","guid":{"rendered":"https:\/\/www.yelloworb.com\/orbblog\/?p=589"},"modified":"2014-11-19T20:51:57","modified_gmt":"2014-11-19T19:51:57","slug":"how-to-create-a-reasonably-secure-arduino-client-that-post-data-into-a-rails-application-part-i","status":"publish","type":"post","link":"https:\/\/www.yelloworb.com\/orbblog\/how-to-create-a-reasonably-secure-arduino-client-that-post-data-into-a-rails-application-part-i\/","title":{"rendered":"How-to create a reasonably secure Arduino client that post data into a Rails application – part I"},"content":{"rendered":"

Arduinos get more and more connected and I use an Arduino together with a GSM\/GPRS shield to build the wind stations<\/a>.<\/p>\n

But the Arduino is a very limited platform and some (as the Nano<\/a>) has as little as 1k RAM! Then it becomes a real challenge to do web and HTTP communication. Here I will summarise the experience gathered during the construction of a tiny secure REST client for the Arduino.<\/p>\n

Why REST?
\nRuby on Rails is the framework I prefer when it comes to write web applications. It is powerful still quite fast to work with. Rails uses REST a lot and it is definite the easiest way to considering the server-side. Though HTML is quite talkative so lots of strings(which take RAM) will be needed in the Arduino, or clever use of PROGMEM with which we can put the strings in ROM.<\/p>\n

Secure?
\nWhat I mainly want to achieve is to make it hard for someone to send\/post false information into the Rails application. For the wind stations it does not matter so much but say we use an Arduino for some kind of real world game. Then some clever hacker could quite easily figure out the URL to make a post and then just start posting in actions or whatever the Arduino controls. So we want to make sure those post requests we receive comes from a unit we have put the software inside.<\/p>\n

HMAC
\nBut what kind of authentication should one use? Have read around a bit and regarding REST so seems HMAC(Hash based Message AuthentiCation) a good option and recommended(http:\/\/restcookbook.com\/Basics\/loggingin\/<\/a>). Also found an Arduino lib that supports HMAC called Cryptosuite<\/a>. It seems at first glance to be really memory efficient (uses PROGMEM) but when reading through the code it seems to use about 196 bytes of RAM which is still quite a lot in these circumstances.<\/p>\n

Rails application
\nLets start with the Rails application. API_AUTH<\/a> seems to be a good library to get HMAC support for Rails applications so that was my choice.<\/p>\n

Create a new Rails project:<\/p>\n

>rail new ArduinoAuthenticatedClientExample<\/code><\/pre>\n
Then using you favourite text editor add API_AUTH to the Gemfile:<\/p>\n
gem 'api-auth'<\/code><\/pre>\n
After that do a bundle update to get all gems installed.<\/p>\n
> bundle update<\/code><\/pre>\n
Our model is quite simple, we have probes(an Arduino) that can post temperature readings(Measures). So lets create these two:<\/p>\n
> rails generate scaffold Probe name:string secret:string\n> rails generate scaffold Measure temperature:float<\/code><\/pre>\n
We need to setup the relationships between these models, a probe has many measures and measures belongs to probes. In app\/models\/probe.rb add:<\/p>\n
has_many :measures<\/code><\/pre>\n
and in app\/models\/measure.rb add:<\/p>\n
belongs_to:probe<\/code><\/pre>\n
Now give the following command to generate the migration and have it create the needed index in measures:<\/p>\n
rails generate migration AddProbeRefToMeasures user:references<\/code><\/pre>\n
Now it is time to update the database:<\/p>\n
rake db:migrate<\/code><\/pre>\n
Add the following code to app\/controllers\/measures_controller.rb so that all REST calls that modify the model needs to be authenticated using HMAC:<\/p>\n
# require any kind of change and creation of a measure to come through our authenticated api using HMAC \n  # and we skip the CSRF check for these requests\n  before_action :require_authenticated_api, only: [:edit, :update, :destroy, :create]\n  skip_before_action :verify_authenticity_token, only: [:edit, :update, :destroy, :create]\n\n  def require_authenticated_api\n    @current_probe = Probe.find_by_id(ApiAuth.access_id(request))\n    logger.info request.raw_post # needed due to a bug in api_auth\n    # if a probe could not be found via the access id or the one found did not authenticate with the data in the request\n    # fail the call\n    if @current_probe.nil? || !ApiAuth.authentic?(request, @current_probe.secret) \n      flash[:error] = "Authentication required"\n      redirect_to measures_url, :status => :unauthorized\n    end\n  end \n<\/code><\/pre>\n
We added a flash error message in the code above so we need to add support in app\/views\/layouts\/application.html-erb to get that presented:<\/p>\n
< % flash.each do |name, msg| -%>\n      < %= content_tag :div, msg, class: name %>\n    < % end -%><\/code><\/pre>\n
We want the secret keys generated automatically rather then entered by the user. So in app\/controllers\/probes_controller.rb, in the create method change so the first lines looks like this:<\/p>\n
    @probe = Probe.new(probe_params)\n    @probe.secret = ApiAuth.generate_secret_key<\/code><\/pre>\n
And we want to remove the input field. Change in app\/views\/probes\/_form.html.erb so<\/p>\n
< %= f.text_field :secret %><\/code><\/pre>\n
becomes<\/p>\n
< %= @probe.secret %><\/code><\/pre>\n
Now we are almost done but we want to add some more security. We do not want anyone be able to change the secret keys and actually we would like to add user authentication so that like an admin is the only one who ca see the secrets but that is not a task for this tutorial. If you need that see for example the Devise getting started guide<\/a>. Add the following to app\/models\/probe.rb so that the secret only can be read and not modified:<\/p>\n
attr_readonly :secret<\/code><\/pre>\n
Now you can run the server and start creating probes. Do<\/p>\n
> rails server<\/code><\/pre>\n
and create a probe or two by going to http:\/\/localhost:3000\/probes\/<\/a><\/p>\n
To test that is’s working create a simple client:<\/p>\n
require 'openssl'\nrequire 'rest_client'\nrequire 'date'\nrequire 'api_auth'\n\n@probe_id = "2"\n@secret_key = "rNwtKjjVZ4UUTQWvL+ZpK1PVjXz5N1uKpYRCfLfTD+ySTMaeswfPhkokN\/ttjX3J78KNqclcYLHSw\/mzHeJDow=="\n    \nheaders = { 'Content-Type' => "text\/yaml", 'Timestamp' => DateTime.now.httpdate}\n\n@request = RestClient::Request.new(:url => "http:\/\/localhost:3000\/measures.json",\n        :payload => {:measure => { :temperature => 12}},\n        :headers => headers,\n        :method => :post)\n        \n@signed_request = ApiAuth.sign!(@request, @probe_id, @secret_key)    \n\nresponse = @signed_request.execute()\nputs "Response " + response.inspect<\/code><\/pre>\n
And run that and you should get something like:<\/p>\n
Response "{\\"id\\":19,\\"temperature\\":12.0,\\"created_at\\":\\"2014-09-30T15:04:26.286Z\\",\\"updated_at\\":\\"2014-09-30T15:04:26.286Z\\"}"<\/code><\/pre>\n
In part II<\/a> I describe how to create the client on the Arduino.<\/p>\n","protected":false},"excerpt":{"rendered":"
Arduinos get more and more connected and I use an Arduino together with a GSM\/GPRS shield to build the wind stations. But the Arduino is a very limited platform and some (as the Nano) has as little as 1k RAM! Then it becomes a real challenge to do web and HTTP communication. Here I will […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[67,68,28],"tags":[],"class_list":["post-589","post","type-post","status-publish","format-standard","hentry","category-arduino","category-rails","category-software-development"],"_links":{"self":[{"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/posts\/589","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/comments?post=589"}],"version-history":[{"count":14,"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/posts\/589\/revisions"}],"predecessor-version":[{"id":637,"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/posts\/589\/revisions\/637"}],"wp:attachment":[{"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/media?parent=589"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/categories?post=589"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yelloworb.com\/orbblog\/wp-json\/wp\/v2\/tags?post=589"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}