title: Authenticating mobile device
body: <p>I'm developing client-server application, where client applications will run on mobile devices (Android, iOS) and will communicate with the server via HTTP protocol. Mobile applications will be available for free at the market and multiple users will be using the same application instance on the same device.</p>
  
  <p>I need to authenticate each request to the server and <strong>I need to authenticate a device, not a user</strong> and practically anybody could be in a possession of a device.</p>
  
  <p>I've worked arround this solution:</p>
  
  <p><strong>After installing the application:</strong></p>
  
  <p>Let's presume this is done on a secure network:</p>
  
  <ol>
  <li>An administrator (not a regular user) runs the application on the given device and uses app's authentication form once (filling his login and password).</li>
  <li>Server authenticates the administrator and sends back a secret <em>device key</em> and a "public" <em>device id</em> specific for the device.</li>
  <li>Server stores the <em>device key</em> and <em>device id</em>.</li>
  <li>Device stores the <em>device key</em> in a <em>secure storage</em> and <em>device id</em> wherever.</li>
  </ol>
  
  <p>Now the device has its own "credentials".</p>
  
  <p><strong>With each client request:</strong></p>
  
  <ol>
  <li>Client requests a <em>request key</em>. The request contains the <em>device id</em>.</li>
  <li>Server genenerates the <em>request key</em>, stores it along with the <em>device id</em> and sends it to the client.</li>
  <li>Client sends request data with <em>device id</em> and a hash of (the data + <em>request key</em> + <em>device key</em>) and thus signs the request.</li>
  <li>Server checks the hash. Server also invalidates the <em>request key</em>.</li>
  </ol>
  
  <p><strong>My questions:</strong></p>
  
  <ol>
  <li><p>Presuming something like the <em>secure storage</em> exists: how secure would this approach be?</p></li>
  <li><p>Is there anything like <em>secure storage</em> what nobody (but the only application) can read in iOS and Android? Could you provide some links to study (especially for android). Does this depend on rooting the device?</p></li>
  </ol>
  
  <hr>
  
  <p><strong>Some notes:</strong></p>
  
  <p>I believe that thanks to the <em>request key</em>, the client really needs to prove the knowledge of the secret <em>device key</em> (without the <em>request key</em> a hacker could send again intercepted data). Since the <em>device key</em> is sent over a secure network, it can not be intercepted and since it is stored in a <em>secure storage</em> it can not be stolen from the device.</p>
  
  <p>However I expect there is no 100% secure storage (minimally on android) and if the device is rooted the secret <em>device key</em> can be stolen. Storing it encrypted makes it only harder for a hacker - he would need to decompile the client application and find how to decrypt it.</p>
  
  <hr>
  
  <p>EDIT: Little change in the suggested approach (there was a security gap), added some notes and some other minor details.</p>