Unique identification of a specific computer
I have the following scenario and cannot find anything on the net, or maybe I was looking for the wrong thing:
I am working on a web storage system. there are different users and different places, and only certain users are allowed access to some parts of the system. now we don't want them to connect to these parts of the house or with a different computer than they use in their workplace (there are various reasons for this).
now my question is, if there is a way to make the Work-place-pc identify itself to the server in some way above the browser, how can I do that? oh and yes, it is supposed to be a website.
I hope I have explained this so that everyone understands. thnx for your answers in advance.
... dg
a source to share
I agree with Lenni ... IP address is a possible solution if it is static or the DHCP server assigns the same IP address to the same computer sequentially.
Alternatively, you might also want to consider authenticating via "personal certificates" ... that what they refer to in Firefox doesn't know it's a common name or not. (Obviously I haven't worked with them before.)
Basically these are SSL or PKI certificates installed on the client (user) machine that identifies that computer as the machine it is talking about - that is, if the user tries to connect to a machine that does not have a certificate or does not have a certificate that you allow, you deny them.
I don't know of any problems with this ... it might be relatively easy for the same user to take a certificate from one computer and install it on another with the correct password (i.e. it authenticates the user) or it might be defined specifically for that machine in some way (i.e. it authenticates the machine). And a quick Google search didn’t come up with any obvious “how” instructions on how it all works, but it might be interesting to learn.
--- Lawrence
a source to share
Since you go to the website, you can:
Examine the IP address of the remote host (compare it with known internal subnets, etc.)
During the authentication process, you can ping the remote IP address and see the TTL on the returned packets, if it is too low, then the computer cannot be from the local network. (of course this can be broken, but that's just one more thing)
If you are doing this through IIS then you can integrate with SSO (probably best if you do this)
a source to share
If it is to be a website (and by that I mean the web server needs to be able to uniquely identify the user's machine) then the choice is limited: there is nothing in itself that can be obtained from the browser headers or the request body that allows the identification car. I am guessing this is by design due to the obvious privacy implications.
There is a choice, although none of which can be painless: you can use an ActiveX control, which however only works on Windows (not all browsers, I think) and requires elevated privileges. You could think of a Firefox plugin (obviously only Firefox). Anyway, a plain vanilla browser would otherwise escape identification.
a source to share