Unique Serial On Each Unit?

[sinoth]

I apologize for my noobness, but I've been wondering about this lately. Commercial handhelds such as the DS and PSP have unique serial numbers that can be accessed through software... will the Pandora have something similar? Does the GP2X? I ask because it seems like a decent form of online authentication, if it can't be spoofed easily.

 

[Squidge]

The GP2X has embedded software-accessible serial numbers, but I wouldn't call them unique (there are several people with the same serial number).

I've no idea about the Pandora, maybe craigix can answer?

 

[peca]

Doesn't SD card have some unique identifier? Maybe it can be use instead of Pandora's one, if there is no one.

 

[cosam]

Commercial handhelds such as the DS and PSP have unique serial numbers that can be accessed through software... will the Pandora have something similar? Does the GP2X? I ask because it seems like a decent form of online authentication, if it can't be spoofed easily.

Even if it does have a serial number somewhere, it's not something you'd want to use for authentication purposes. As you said, it's software readable, which means that software can be altered to return an arbitrary serial number.

 

[Squidge]

Doesn't SD card have some unique identifier? Maybe it can be use instead of Pandora's one, if there is no one.

Yes, SD cards do, and they even have secret areas which are not user accessible. They are perfect for authentication, and people use them as such.

 

[hotblack]

You could also use something like the MAC address or Bluetooth ID as SD cards can and will be removed. There are ways of spoofing these, but depending upon your needs it could be a good solution.

If you need something more complex you could always use combinations of identifiers and your own algorithms to write unique identifiers to flash.

 

[Trip]

Wouldn't a scan of the actual hardware (checking for all the right identifiers) be a good way to go?
e.g If all the correct hardware isn't reported back to the software, then it won't let you join a server.

 

[icurafu]

client auth would be an easier solution that all devs could use, rather one that is unique to hardware and expolitable once the software is released.

The OMAP hardware is already seup to use that method for DRM.

 

[sinoth]

The OMAP hardware is already seup to use that method for DRM.

Could you expand any more on this? I searched the tubes for OMAP DRM and all I can find are product sheets that are pretty vague. DRM is such a nasty, nasty topic... but in this case I think if it was used simply to authenticate a unit online with little intervention from the user, it would be fine.

 

[icurafu]

Do a search on m-sheild. That's the hardware security module for the OMAP.

It's just a bit that stores keys in hardware and accelerates encryption for certain common algorothms. It comes down to programming after that. You could port OpenSSL to for example to be faster and more secure.

If you are a game developer, you will rely on a certificate authority of some kind to be created and implemented automatically via DRM. Someone needs to create it for it to be seemless for game developers... like what you see with ngage, zodiac or the iPhone.