ESP32 has strong performance and built-in connection features that make it a popular option for Internet of Things (IoT) applications. If you’re new to ESP32, you can start with this beginner’s guide to ESP32 Wi-Fi and MQTT.

In this blog, we will discuss several methods to improve security for ESP32 Wi-Fi and Message Queuing Telemetry Transport (MQTT) communication, guard against harmful attacks, data breaches, and cyberthreats.

1. Secure Wi-Fi Connection

Using WPA2/WPA3 Encryption

To secure any IoT system, secure Wi-Fi is a must. To ensure a secure connection:

• WPA2-PSK or WPA3-PSK encryption settings provide protection against unwanted network access.
• Never use open Wi-Fi networks, since they are sensitive for Man-in-the-Middle (MITM) attacks and packet sniffing.
• Updating the firmware of the router regularly helps prevent security issues.

Hide SSID and Use MAC Filtering

• Hiding your Service Set Identifier (SSID) prevents normal attackers from discovering the network, but high-level attackers can still find it.
• Media Access Control (MAC) address filtering only allows devices with pre-approved MAC addresses to join the network. However, MAC spoofing is still a possible risk.

Enable Static IPs and Firewalls

• Assign a static IP to the ESP32 device. It can improve security and prevent Dynamic Host Configuration Protocol (DHCP)-based attacks and decrease dependency on dynamic addressing.
• Firewall rules can be set up to prevent unwanted traffic. It allows only necessary connections.

2. Implement Secure MQTT Communication

Use TLS/SSL for MQTT Encryption

Transport Layer Security/ Secure Sockets Layer (TLS/SSL) encryption for MQTT makes data private between ESP32 and broker. To make the ESP32 TLS-capable:

• Use SSL-compatible MQTT broker, like Mosquitto, AWS IoT, or HiveMQ.
• Configure the ESP32 device with the required SSL certificates.
• The PubSubClient library should be compatible, so it can support secure connections.
• Use TLS version 1.2 or higher to ensure secure communication. It provides robust encryption and has updated protocols.

Authenticate MQTT Clients

• Implement username and password authentication to restrict access to the MQTT broker.
• Use token-based authentication, like OAuth or JWT (JSON Web Tokens), to increase security.
• Before publishing or subscribing to topics, ensure that MQTT clients verify using legitimate credentials.

Restrict MQTT Topics and Permissions

• Use Access Control Lists (ACLs) on the MQTT broker to specify the topics a client can access.
• Role-based Access Control (RBAC) helps prevent unauthorized devices from publishing or subscribing to sensitive topics.
• Regularly audit topic permissions within a defined time frame to identify and reduce potential security threats.

3. Secure Storage of Credentials

Avoid Hardcoding Sensitive Information

• MQTT credentials and Wi-Fi passwords should never be hardcoded in the source code, as they can be exposed if the firmware is compromised.
• Use EEPROM, SPIFFS, or Secure Element chips to store credentials.

Use Secure Storage Mechanisms

• To store critical information in flash memory, use AES encryption.
• Rather than hardcoding credentials into the source code, store them as environment variables.
• Secure boot and flash encryption provide an additional layer of security.

Our product engineering services include secure element integration, AES-based data encryption, and secure boot implementation to help you design hardware that is secure from the ground up.

4. Protect Against Common Attacks

Prevent MITM Attacks

• To authenticate the server and stop connection from hijacking, use certificate pinning.
• Always connect to reliable MQTT brokers that have active SSL certificates to avoid MITM attacks.

Protect Against Denial-of-Service (DoS) Attacks

• Limit the number of connections retries to avoid excessive reconnections during network outages.
• MQTT brokers should implement rate restrictions to mitigate DoS attacks.
• Block IP addresses that have suspicious behavior with firewall rules.

Secure Over-the-Air (OTA) Updates

• Use signed firmware updates to prevent unauthorized changes or tampering with the firmware.
• Before installation of OTA updates, use checksum validation to ensure the validity and integrity of firmware updates.
• Encrypted OTA updates help avoid firmware reverse engineering.

5. Conclusion

For a reliable and robust IoT application, secure Wi-Fi and MQTT communication of ESP32 is essential. By using strong encryption (WPA3, TLS/SSL), proper authentication, and secure storage, we can improve the security of IoT projects. You can protect your devices from online threats by updating the firmware from time to time, implementing strong access controls, and adhering to the best security practices.