We’re putting 60 small ESP32 boards into roadside cabinets on a smart-lighting contract: energy pulses from the meter, a door contact, cabinet temperature. Each cabinet has a cellular router, the ESP32 joins its Wi-Fi.
Right now the firmware has this near the top of main.cpp:
#define WIFI_SSID "CAB-NET"
#define WIFI_PSK "................"
#define HM_TOKEN "................................" // per build, one per cabinetA colleague pointed out that anyone who walks off with a board can dump the flash with esptool in a minute and have both the PSK and the Hermetry token. Cabinets get opened by contractors all the time, and one board has already gone missing. What do people actually do about this on cheap hardware?
Flash encryption and secure boot on the ESP32 cover the dump. They’re one-way though, get the key handling wrong on a production unit and it’s a brick.
Or keep them out of the binary and write them to NVS at the bench? Then it’s one image for all 60 too.
Plant manager, not a security person, but we lost a board out of a remote pump house last year and I had to clean up after it, so this is what we do now.
One credential per device, never shared. If two boards ever run the same token, the second login takes over the first one’s session and you spend a week chasing «flapping» devices. Tokens and the PSK go into NVS at the bench, like Aoife says, so the binary carries no secrets. Flash encryption on production boards once you’ve practised on a couple of spares.
On the Hermetry side, the profile has an Allowed networks field. Put the public address range your cabinet routers use in it. A token dumped from a stolen board is then refused from anywhere else (CONNACK 5, and the reason shows on the device’s Log tab). That one setting made our IT people much calmer.
When a board goes missing, revoke its credential (the API has DELETE on the device’s credentials) or just delete the device, and the old token stops working at once, with every open session cut. Admins also get a notice when a device logs in from a network it hasn’t used before, so watch for those.
For the PSK, put the sensors on their own SSID or VLAN on the router so a leaked PSK only gets you onto a network with nothing else on it.
Most of this is on the device credentials page.
Allowed networks is the part I didn’t know about. But the cabinet routers get dynamic addresses on cellular, so I don’t have a range to put in.
Ask your operator for a fixed-IP APN. Ours sold us a /28 for the whole fleet. If that’s not possible, skip that control and lean on revoke plus the new-network notices.
Operator had a fixed-IP APN option, we got a /28. Allowed networks set on the cabinet profile. Tested with a dev board on my home broadband using a real cabinet token: CONNACK 5, and the Log tab shows the refusal reason. Tokens and PSK are in NVS now, flash encryption is next after I brick a spare or two learning it. Missing board’s token revoked.
- Debes estar registrado para responder a este debate.
Únete a la conversación
Inicia sesión para preguntar y responder, dar me gusta a las publicaciones útiles y marcar la respuesta que resolvió tu problema. Cada aportación suma puntos y niveles.