Security for Connected Devices

10 Lektionen in dieser Stufe

1. Threat Modelling a Connected Device
   Identify assets, attackers, entry points and impacts and rank the risks. · Lab: Write a threat model for the web thermostat from level 24.
2. Keeping Keys and Passwords Out of Source Code
   Provision secrets separately from firmware and never commit them. · Lab: Remove hard-coded credentials from a project and load them from protected storage written at provisioning.
3. Hashes, Message Authentication and Key Types in Practice
   Use hashing, HMAC, symmetric and asymmetric cryptography for the right jobs with library functions. · Lab: Compute a hash and an HMAC of a message on the device and verify them on a computer.
4. TLS on ESP32: Certificates, Validation and Pinning
   Establish encrypted connections that actually verify the server. · Lab: Connect over HTTPS with a root certificate and show the failure when the certificate does not match.
5. MQTT over TLS with Per-Device Credentials
   Secure broker connections and restrict each device to its own topics. · Lab: Configure broker TLS and access rules and connect two devices with separate identities.
6. Authenticating Local Web and BLE Interfaces
   Protect configuration interfaces with authentication, pairing and rate limiting. · Lab: Add login with session token to the web interface and require bonding for BLE writes.
7. Signed Firmware Images and Verified OTA
   Sign releases in the build pipeline and reject unsigned or modified images on the device. · Lab: Sign a firmware binary, update successfully, then flip one byte and watch the update be refused.
8. Secure Boot and Flash Encryption on ESP32
   Explain the chain of trust and enable irreversible protection features carefully. · Lab: Enable secure boot and flash encryption on a board set aside for this purpose and verify readout is useless.
9. Hardening: Debug Ports, Readout Protection and Rollback Prevention
   Close debug access, set readout protection on other MCU families and block downgrades. · Lab: Enable readout protection on an STM32 and anti-rollback on the ESP32 and test both.
10. Vulnerability Handling and a Security Update Policy
    Plan how issues are reported, fixed and communicated over the product's life. · Lab: Write a disclosure contact, support period and update process for your device.

Abschlussprojekt

A hardened ESP32 device with documented threat model, per-device credentials, TLS-secured MQTT, signed OTA updates and secure boot enabled on a sacrificial board.

Teile für diese Stufe

• 3 × ESP32 development board
• 2 × USB cable matching the board
• 1 × Solderless breadboard 830 points
• 1 × Jumper wire set male-male and male-female
• 1 × USB-to-serial adapter 3.3 V and 5 V
• 1 × BME280 pressure, humidity and temperature module
• 1 × Relay module 3.3 V compatible single channel
• 1 × Tactile push button
• 2 × LED 5 mm assorted
• 2 × Resistor 220 ohm
• 1 × USB logic analyzer 8 channel
• 1 × STM32 development board with Cortex-M3 or M4
• 1 × ST-Link compatible debug probe

In jeder Lektion legst du die passenden Teile direkt in den Warenkorb. Arduino-kompatibel →