How to be sure that only my application can interact with my server

[mariano_donati]

Hi,

I'm developing a client/server application. If I know for sure that only my client can interact with the server, I can avoid a lot of business logic in my server since I can assert that all received data has the right format and type.
So, I'd like to know if there is some standard way to let the server knows that the client which is trying to connect is the right one.
I have thought of some kind of private handshake, but the trouble I see here is that if someone takes the ildasm tool will see how the client implements the handshake, so it'll be easy then to replicate the behaviour to cheat the server.
What would you recommend?.

Cheers.

[cicatrix]

Encrypt all traffic.

[opus]

Even with encryption a copied message coiuld be re-sent by someone else.
It all depends on how deep you want to go.
At pretty much save approach would be to store the mac-address of the allowed user, and only accept messages from such a user. If you enter the allowed mac-address-list manually there would be no way to intercept that.

[cicatrix]

Say, you have implemented some protocol.
Imagine, the server issues a challenge, client responds, server authenticates.
I.e.
Server: HELLO
Client: CLIENT #1
Server: LOGIN/PASS?
Client: *****/*****
Server: OK

Then you encrypt everything with some encryption algorhythm. Every new message looks differently even if it contains the same data.
Additionally, to lessen the risk of re-sending a captured message, the server can count messages and add the count number to the decryption key (client should do the same):

ie, the first time server issues a challenge with the password: PASSWORD0 and transmits some random number, i.e 252
client replies with encrypted message with: PASSWORD252
server asks for authentication with: PASSWORD252 and transmits a new random number, i.e. 348
client replies with PASSWORD348, etc.
what i mean that each new message can be encrypted with different key.

[mariano_donati]

About mac-address, my application will be (at least I hope that) a high-volume app, so there's no way to do it with mac-address.
The client needs to implement the encryption algorithm, isn't that a security hole considering disassembler tools?