How to uniquely identify serial resources without relying on NI MAX aliases?

[mcduff]

Can you query the pump for its serial number? If so, that may work as a cached value to store.

Open the VISA Resource, check its Serial Number, see if it matches what have stored, etc.

The main problem is that this method would have to be done every time a new pump, system, etc is set up. You could have an encrypted text file that contains a list of known(good) serial numbers for each pump and have the option of adding to this list.

mcduff

[JÞB]

And we are back to "physical security "  

Realistically, a locked room and training about "do not disturb " while experiments are running signs...are GOLD!  Train or physically limit the operators. 

[JÞB]

---

@ijustlovemath wrote:

The post is not about the security concern of users tampering with registry settings; the app currently runs with read and write permissions to a single directory, the lowest possible level of access.

The concern is with NI MAX (which can be ran as a standard user, try it), in which a user can rename existing aliases with the app none the wiser.

As a proof of concept, try this:

1. Setup a serial device that writes to a port continuously, name this device "TestDeviceA" in MAX

2. Setup a second serial device that does the same, name this device "TestDeviceB" in MAX. Make sure they are writing different data.

3. Write a simple VI with two loops that reads from "TestDeviceA" in one loop, and "TestDeviceB" in another loop, outputting to a string (concatenating old to new with a feedback node or similar)

4. Run this VI.
5. While the VI is running, open NI MAX, rename "TestDeviceB" to "TestDeviceA." MAX will warn you about the existing alias, but will allow you to make the change.

6. TestDeviceA will now be named "TestDeviceA-1", and its loop will now be reading from TestDeviceB. TestDeviceB's loop will fail to read anything.

7. Rename "TestDeviceA-1" to "TestDeviceB" and the loops will have completely switched.

Perhaps that makes the original concern a bit more clear.

---

The System Hardware API is all you need then...although, I have never found a user that wants you to fail so badley that they will intentionally destroy your hardware configuration. 

Just because you are paranoid does not mean no one is out to get you! (it is....unusual)

[RTSLVU]

---

@JÞB wrote:

And we are back to "physical security "  

Realistically, a locked room and training about "do not disturb " while experiments are running signs...are GOLD!  Train or physically limit the operators. 

---

Right?...

Also while I understand the OP's concerns, one has to ask themselves "Who would do such a thing?".

Sabotage is a really awful thing to even suspect a coworker of doing. 

If a company feels the need to go to great lengths to prevent employee sabotage then that company probably has bigger issues than the employees trying to destroy the company from within... 

[ijustlovemath]

To illuminate my security concerns a bit, the pumps control a biological system, so vulnerabilities like this are literally life or death! I certainly don't suspect sabotage, but thinking about this kind of stuff is just part of our federally regulated risk assessment.

I understand 100% what you guys are saying, though. We'll probably enforce a GPO restriction on MAX if we can't get a system at least as reliable as MAX for aliasing hardware.

[mcduff]

Security is one issue, the other issue is incompetence or just making a mistake. Suppose somebody has to reset the MAX database, and enters the wrong aliases when re-doing the entries. Lots of people like to push buttons to see what happens. For this case, changing aliases in MAX is not like seeing a big red self destruct button, changing the settings seems quite a bit innocuous.

mcduff

[JÞB]

---

@ijustlovemath wrote:

To illuminate my security concerns a bit, the pumps control a biological system, so vulnerabilities like this are literally life or death! I certainly don't suspect sabotage, but thinking about this kind of stuff is just part of our federally regulated risk assessment.

I understand 100% what you guys are saying, though. We'll probably enforce a GPO restriction on MAX if we can't get a system at least as reliable as MAX for aliasing hardware.

---

If your concerns are above and beyond "normal "  you have larger problems.   "Life and death " issues are beyond the Forums. You may need some real security in this....there are OGAs that you might ask for assistance. 

[ijustlovemath]

We're working with one of the big LabVIEW consultant firms on this project, not to worry. I like to do independent research on problems before we invest in any given architecture.

[srikrishnaNF]

Hi ijustlovemath,

Did you ever try using some app lock programs using which you can lock the NI MAX application to be launched using a password?

[pincpanter]

Also while I understand the OP's concerns, one has to ask themselves "Who would do such a thing?".

---

Never forget Chernobyl...