Every electronic device is potentially the weak link in the security of your home automation system. It is important to understand where things can go wrong, how to prevent problems, and what to do when a problem occurs.
Commercial products are often "black boxes" with little or no transparency as to their workings. The manufacturer may say the product uses strong encryption, lacks backdoors, and so on, but how do you know? And how do you know the security features were implemented correctly and competently? It is not possible to know unless you or a trusted third party undertakes the job of reverse engineering the product and rigorously probing it. Otherwise, you're at the mercy of the manufacturer and the reliability of their words.
When you design your own system, you gain both the ability and the responsibility to ensure it is properly secured. This means there is some extra work up front, but the payoff is the peace of mind in knowing your data is protected and used only in ways that you approve.
Authentication
Authentication is the task of determining "who" is attempting to use a service. That "who" may be a human user, or it may be a program acting on behalf of a user (a user agent).
The most common authentication method is the simple username and password.
Authorization
Authorization is the task of determining what a user is allowed to do. Often, but not always, this happens in conjunction with authentication. Sometimes authorization is based on things like cryptographic tokens that do not necessarily link back to an identity.
Encryption
Encryption is especially important for any communications between your home network and the outside world, but it is also a good idea to encrypt connections between devices and services within your own network. This includes setting up Wi-Fi passwords as well as using a TLS/SSL certificate for any HTTP, MQTT, or other protocols for moving data between services.
TLS (often called SSL)
It is advisable to enable TLS on everything that supports it. Without TLS, things like usernames and passwords will be sent "in the clear," making them visible to anyone with the ability to eavesdrop on network traffic. TLS also prevents intruders from intercepting network traffic and inserting malicious messages. And finally, it prevents eavesdroppers from harvesting your data for any other unanticipated purposes.
Tags
- Log in to post comments