We are trying to design a solution where we have several Smart devices and we can control every smart device from multiple phones. We will generate a Self-signed SSL Server Certificate and embed that in all the smart devices. And we will include the SSL Client certificate in all the phones. Now in order to connect a phone to the smart device the phone needs to obtain an ID (which can be obtained by scanning a QR code on the Smart device - this is just to ensure that the phone is in the vicinity of the smart device).
Smart Device:
- Embeds a Self signed Server certificate. Reason: No dependency on the internet connectivity
- Maintains a WiFi hotspot (Internet connectivity is not guaranteed always)
- Maintains a list of connected phones (each phone identified by the unique QR Code ID that is scanned by the phone)
Phone App:
- Implements Certificate pinning and hard codes the Client certificate
- Connects to the Wifi hotspot
- Establishes an SSL connection with the Smart device.
- In order to register for the first time it scans a QR code and for subsequent connections it sends the QR Code ID to provide its identity.
Can you please review the above architecture and identify any flaws with this?
Because we are installing the same server certificate in all the smart devices and the same client certificate in all the phones is there a way to hack the Smart device in some way?
If there is an SSL connection established between a smart device and a phone, can another device (which is on the same network with the same certificate) be able to hijack the packets sent between the Smart device and the first phone?
Once a secure link is established we send the QR Code ID in plain text format through the SSL socket. Do we need to encrypt this again or is the SSL link secure enough?