Idea for Encrypting and Decrypting flows.json realtime

[Joe Morris]

I have been trying to determine a way to deliver end node solutions (Raspberry Pi) using node-red while at the same time protecting my IP that is embedded in the node-red flows.json file.

I came up with the following idea and would appreciate any thoughts.

I envision what I call a container flow that would control the dynamic encryption/decryption of the flows.json file.

Contained in the end-node devices would be an encrypted flows.json file along with the container json flow. The container flow would be the flow that loads upon startup of node-red..

Upon boot up the container flow, using a secure method (MQQT, HTTPS, etc.) would "phone home" to a control cloud server and receive the decryption key.

The control flow would then decrypt the flows.json and then use admin api .addFlow to add the decrypted flows.json file to the active configuration.

Once the decrypted flows.json file is added to the active configuration the decrypted flows.json file would be deleted.

If I can do this decryption in some sort of memory based storage I will so that there would be no trace of the decrypted file on any storage device.

In theory this should work. One aspect that I have yet to determine is whether the active configuration has any state in storage or not. I will be researching this next.

I would appreciate any questions/thoughts/ideas/recommendations.

Thanks

Joe

[Nick O'Leary]

Hi Joe,

the problem with that approach is your container json flow will contain everything someone needs in order to receive the decryption key to access your encrypted flow.

If there's code on the device that is able to decode your flows (regardless of whether it uses the network or not) then there's code that can be exploited by someone with physical access to the device.

The best you can do is make it inconvenient to access.

So those comments aside, if you want to encrypt the flows then write a custom storage plugin that does that for you - don't try to dynamically modify the flows of the running system - that's needlessly complex.

There's no easy answer to a fully secure device here without the use of specialist hardware.

Nick

--
http://nodered.org
 
Join us on Slack to continue the conversation: http://nodered.org/slack
---
You received this message because you are subscribed to the Google Groups "Node-RED" group.
To unsubscribe from this group and stop receiving emails from it, send an email to node-red+unsubscribe@googlegroups.com.
To post to this group, send email to node...@googlegroups.com.
Visit this group at https://groups.google.com/group/node-red.
To view this discussion on the web, visit https://groups.google.com/d/msgid/node-red/21fb2715-f75c-4204-a53f-aaabda84b90f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.