1. Security Architecture Principles
Edge gateways deployed in public community centers, solar farm enclosures, and rural schools cannot rely on perimeter firewalls. Physical access to the enclosure must be treated as a potential attack vector.
Our Zero-Trust Edge Protocol enforces three non-negotiable rules:
- Never Trust the Physical LAN: Treat local ethernet and Wi-Fi networks as untrusted internet conduits.
- Zero Open Inbound Ports: Gateways accept no incoming TCP/UDP connections; all telemetry and control pipelines originate via outbound WireGuard tunnels.
- Hardware-Anchored Identity: Each device holds a unique ECDSA P-256 certificate keypair sealed in secure hardware storage.
2. Mutual TLS (mTLS) Authentication Flow
plaintext
+-----------------------+ +-----------------------+
| Edge Gateway Node | | Central EMQX Broker |
+-----------+-----------+ +-----------+-----------+
| |
| -------- TCP SYN + ClientHello (TLS 1.3) -----> |
| <------- ServerHello + Server Certificate ----- |
| |
[Verify Server Cert] |
[against Root CA] |
| |
| -------- Client Certificate (Signed by CA) ---> |
| -------- CertificateVerify (Signed by TPM) ---> |
| |
| [Verify Client Cert]
| [against Device DB]
| |
| <======= Encrypted MQTT Telemetry Channel =====> |3. Gateway Hardening Automation Script (Bash)
This hardening script executes on freshly provisioned industrial Raspberry Pi and Debian edge micro-servers:
bash
#!/usr/bin/env bash
set -euo pipefail
echo "[+] Applying OurSiamDream Zero-Trust Edge Baseline..."
# 1. Disable unused kernel network protocols
cat << 'EOF' > /etc/sysctl.d/99-osd-security.conf
net.ipv4.ip_forward = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.tcp_syncookies = 1
EOF
sysctl -p /etc/sysctl.d/99-osd-security.conf
# 2. Configure nftables: Drop ALL inbound traffic except loopback
nft flush ruleset
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 ; policy drop ; }
nft add chain inet filter forward { type filter hook forward priority 0 ; policy drop ; }
nft add chain inet filter output { type filter hook output priority 0 ; policy accept ; }
nft add rule inet filter input iif lo accept
nft add rule inet filter input ct state established,related accept
# 3. Disable Root SSH and password authentication
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
systemctl restart sshd
echo "[+] Baseline Hardening Complete. Gateway is stealth."4. Security Verification Checklist
-
Run
nmap -Pn -p- <gateway_ip>from local switch to confirm 0 responsive open ports. -
Verify root filesystem is mounted as read-only (
ro) with overlayfs on temporary directories. -
Validate that client certificates are strictly scoped to specific MQTT topic namespaces (
devices/{id}/#). - Confirm that WireGuard peer configuration uses preshared keys (PSK) alongside 256-bit Curve25519 keys.
- Test simulated node theft: physical flash memory extraction yields encrypted LUKS volume without key material.