Network security
When building your own IoT network, protecting against unauthorized access is paramount. Due to the limitations of the ESP8266 in terms of memory and computational power, full support for TLS/SSL protocols for internet communication is not feasible. Therefore, alternative security measures are necessary.
Much of the security for unicontrol devices is inherited from the local network to which they are connected. It is imperative to only connect unicontrol devices to trusted, secured local networks with restricted access. Using public or inadequately secured wireless networks will compromise security.
HTTP
unicontrol devices use HTTP connections for communication with users. While all relevant URLs intended for HTTP communication are protected with usernames and passwords, they naturally lack a TLS/SSL layer. This setup is sufficient for operation within a protected local network but is inadequate for use in unrestricted networks or accessible from the internet.
SSL protection by intermediary
To address the lack of direct TLS/SSL support on unicontrol devices, a possible workaround involves setting up a locally hosted intermediary service like Node-RED. This intermediary is capable of adding an additional layer of security by establishing an SSL-protected connection externally. This secure connection forwards messages to the unicontrol device's unprotected local IP address, mitigating security concerns.
MQTT
Connection via MQTT consists of two legs, each with different security options:
- unicontrol to MQTT broker: The connection between unicontrol devices and MQTT brokers typically lacks SSL encryption and should only be used within a protected local network.
- MQTT broker to User Device: The link between the MQTT broker and user devices can typically be encrypted with an SSL layer, providing more secure communication externally from user devices such as smartphones or PCs.
This implies that while unicontrol device's connection with an MQTT broker is only safe as long as it is taking place within a secured local network with no access from the outside, connection to the MQTT broker established from the user's mobile device or PC can be secure also externally.