This question is about the design of a service I want to setup.
My purpose is to provide a client box which connects to a server and provides some features.
The client box is a small computer like OLinuXino or Raspberry-Pi which would contain an embedded system with some files (information like security keys or executable files) I want to protect from being copied.
Server is the centralized part of the service.
Size of the protected files: from 1kB to 500kB.
The client box will contain a Debian (wheezy) system which will be read-only and setup with tmpfs (as shown here).
How I want to secure it
This system will contain some configuration and executable files I want to keep hidden from curious eyes. So they will be strongly encrypted.
As the client box will connect to the server and open a reverse ssh tunnel (from server to client), the server will have the ability to decrypt the files (with a key that is on server-side) after some verification. These files, once decrypted, will stay in client's RAM until shutdown of the client.
This client box will be headless (no screen, no keyboard) and entirely automated, but I am not sure an user will not try to connect screen or keyboard to watch what is happening.
So I would like to make the server checks that no keyboard nor screen is connected to the client. So it would call (remotely through an ssh call from server to client) some commands
- to check the serial number, MAC address, some files checksum and other system specific information to verify that the client box was not compromised (nor the whole filesystem copied to another machine)
- to detect if a keyboard was plugged and eventually block it.
- to close all opened user sessions.
- to block any new connection (keyboard, new session, devices)
- to detect if a screen was plugged an block any output display.
After this, the server would remotely decrypt the files in RAM.
My first question: do you think this is a secure way to keep my files hidden ? Did I miss something ?
My second question: for items 1, 2 and 3 of the above list, I am pretty sure I will find a way to do this. But for items 4 and 5, I am not sure. Would you have any suggestions ? Or do you think it is not possible at all ?
Any advice (like "don't do this, it's silly" or "go, it will work") is welcome !