AT+i Programmer's Manual - SE Spezial-Electronic AG

Firmware Version: ~RP1~
Serial Number: ~RP5~
Hardware Version: ~RP0~
26.10 Security and Restrictions
iChip Embedded Web Server
The authorization to view and update iChip‘s configuration parameters, firmware, or
application website via the web can be password-protected using the AT+iRPG parameter
(Remote Parameter Group/Password).
When the RPG parameter in an iChip device contains a value, it is considered a password
that restricts remote iChip parameter viewing/updates. By default, iChip‘s configuration
site can be viewed (browsed), unless the Security Disable Mode (SDM) bit 3 is set, in
which case the user is authenticated by submitting the RPG value. To enable remote
updates, a distant user is always authenticated by submitting that value. The iChip
configuration site includes an authentication form that automatically pops up on the
remote browser when parameter updates are attempted. The password submitted through
this form must match the actual value of iChip‘s local RPG parameter. Otherwise, remote
value updates are rejected.
iChip uses the industry standard SHA1 algorithm to authenticate the remote user.
According to SHA1, the password typed into the authentication form is not literally
communicated back to iChip. Rather, a SHA1-encrypted token is transferred. To achieve
this, iChip‘s web server sends a JavaScript, which calculates SHA1 encryption at the
browser end together with the authentication form. iChip also issues a different random
number, used as part of the encryption key, each time authentication is required, to
eliminate the possibility of impersonation based on eavesdropping to a legal
authentication session.
If the RPG parameter is empty (AT+iRPG=‗‘), remote iChip configuration parameter
update is fully restricted. In other words, it is not possible to update configuration
parameter values using a remote browser. Conversely, if the RPG parameter contains an
(*) character (match any), the configuration parameters can be updated freely, without
requiring authentication at all.
The Parameter Tags defined in the application website are secured from remote updates
in the same manner as the iChip configuration parameters. In this case, the authentication
password is stored in iChip‘s local parameter WPWD (Web Password). If the WPWD
parameter contains a value, a remote user needs to issue this value as an authentication
password in order to gain update access to the application level Parameter Tags. Like in
the case of the RPG parameter, if WPWD is empty, application level Parameter Tags are
fully restricted, whereas when WPWD contains an (*), updates are unrestricted and
authentication is not required.
When authentication is required, iChip‘s web server automatically issues an
authentication form to the remote browser in response to an attempt to update Parameter