Security

Connected devices all around our lives

Nowadays we are introducing Internet of Things devices in our homes, cars, factories, homebrew equipment and many other facilities. While some of them are not really critical environments, having insecure IoT devices surrounding our lives can condition our physical security and privacy.

From the archive: written in September 2016, when the Arduino MKR1000 and its crypto chip brought TLS by default to the Thinger.io Arduino library. Today TLS runs on every transport of the platform, with mutual TLS for devices that carry a client certificate: see Security and the 2025 post on IoT platform security.

It is easy today to take an Arduino or a similar device, like a cheap ESP8266, connect it to the Internet and start feeding your cat remotely. A quick search shows multiple alternatives:

One of many maker projects: an Internet-enabled cat feeder powered by Arduino.

The risk

Unsecured connections leave devices open to attacks

Aside from cool cat feeders, there are maker projects for controlling garage doors, blinds and smart locks, tracking cars, controlling temperature and humidity levels, and so on.

The security of these devices needs some extra attention, starting from the connection between the device and the Cloud infrastructure. Most microcontrollers today are not powerful enough to handle secure connections, like SSL or TLS, so all the communication between the device and the server is open to attacks: sniffing values, taking device credentials, faking values, granting unauthorized access to physical facilities, unlocking doors, and many other possibilities.

The options

Secure communications on microcontrollers

The security of the Internet of Things does not only rely on secure communications, but it is a great start.

The maker community must be aware of the security concerns of untrusted communications, and must have the appropriate resources to handle them. This is why it is common to see different alternatives to offer secure communications in microcontrollers:

TLS in software

Porting SSL/TLS libraries to cheap devices like the ESP8266.

TLS in hardware

Device vendors that already integrate a crypto chip that processes all this by hardware, like the recent Arduino MKR1000.

Thinger.io support

TLS by default on the Arduino MKR1000

At Thinger.io we are concerned about this security aspect, so our cloud supports secure connections for any device with this capability.

In the recent Arduino library update, starting from version 2.4.1, we have introduced support for the Arduino MKR1000, including secure TLS connections by default. Just start with the following sample sketch for the MKR1000, and you will have encrypted connections by default.

MKR1000 sketch
#include <WiFi101.h>
#include <ThingerWifi101.h>

#define USERNAME "your_user_name"
#define DEVICE_ID "your_device_id"
#define DEVICE_CREDENTIAL "your_device_credential"

#define SSID "your_wifi_ssid"
#define SSID_PASSWORD "your_wifi_ssid_password"
#define LED_PIN 6

ThingerWifi101 thing(USERNAME, DEVICE_ID, DEVICE_CREDENTIAL);

void setup() {
  // configure wifi network
  thing.add_wifi(SSID, SSID_PASSWORD);

  pinMode(LED_PIN, OUTPUT);

  // pin control example (i.e. turning on/off a light, a relay, etc)
  thing["led"] << digitalPin(LED_PIN);

  // resource output example (i.e. reading a sensor value, a variable, etc)
  thing["millis"] >> outputValue(millis());
}

void loop() {
  thing.handle();
}

A month later the ESP8266 followed, with TLS in software and secure connections by default: Adding SSL/TLS support to the ESP8266.

How the platform is secured today

Encrypted transports, per-device credentials and mutual TLS, under an ISO 27001 certified management system.

Explore platform securityConnect your devices