Tuesday, August 1, 2017

ESP8266 anti cloning system



If you are investing time and money in developing a new module you want to have confidence that no one will clone it.

Assuring the authenticity of a product is a good for your brand image. No one wants that his nice and cheap power socket to also mine bit coins for someone else or do a DoS attack based on an external command. So, be aware on cheap IoT devices.

Since the flash memory of ESP8266 is external to the MCU then you will need an external encryption chip ( ATSHA204 EUR 0.5) that helps to authenticate your module.



Features:

  • Crypto Element with Protected Hardware-based Key Storage 
  • Secure Symmetric Authentication Device Host and Client Operations
  • Superior SHA-256 Hash Algorithm with Message Authentication Code (MAC) and Hash-Based Message Authentication Code (HMAC) Options 
  • Best-in-class, 256-bit Key Length; Storage for Up to 16 Keys
  • Guaranteed Unique 72-bit Serial Number 
  • Internal, High-quality Random Number Generator (RNG) 
  • 4.5Kb EEPROM for Keys and Data  512 bit OTP (One Time Programmable) Bits for Fixed Information
  •  Multiple I/O Options ̶ UART-compatible High-Speed, Single-Wire Interface ̶ 1MHz I2 C Interface
  • 2.0V to 5.5V Supply Voltage Range 
  • 1.8V to 5.5V Communications Voltage Range 
  • <150nA Sleep Current 
  • Secure Download and Boot ̶ Ecosystem Control ̶ Message Security ̶ Anti-Cloning 
  • 8-lead SOIC, 8-lead TSSOP(2), 3-lead SOT23, 8-pad UDFN, 8-pad XDFN, and 3-lead CONTACT Packages

Applications:

  • Secure Download and Boot 
  • Ecosystem Control 
  • Anti-cloning 
  • Message Security


Basically the ESP will compute a challenge and pass it to the encryption chip. Solution for the challenge is then compared with the expected one and if both matched then the board is authentic. The ESP8266 will not start if the challenge is not solved correctly.

ATSHA204 Challenge Response


The chip I've used is the ATSHA204 and it has I2C and SWI as interfaces.

You can read the Application Notes here.


SWI interface



And the I2C version.

I2C version

First check if some how the chip is not altered before arrives to you. Check the default registers values with the default values from the manual, so between factory and you nobody altered the chip.

Here you will find all documentation related to the chip, how to configure it, how to debug it and more.

Trying to clone an ESP8266 module:


Anti-cloning system in action



Sunday, July 23, 2017

18650 Li-Ion battery powered Wemos D1 with Wemos Battery Shield

Wemos has developed a series of shields for the Wemos D1 :

  • DHT Shield
  • Battery Shield
  • Matrix LED Shield
  • Buzzer Shield
  • Dual Base
  • SHT30 Shield
  • WS2812B RGB Shield
  • ProtoBoard Shield
  • 1-Button Shield
  • Micro SD Card Shield
  • Relay Shield
  • DC Power Shield
  • Tripler Base
  • Motor Shield
  • OLED Shield

The good thing is that you can stack them on top of another.

Let's take a look for now to the Battery Shield that is now on version 1.2.0 and it has a retired version 1.1.0

Get the schematics from here version 1.1.0 and 1.2.0 to see the differences. An immediate visual difference is the inductor on the V1.1.0 is much higher than the one on V1.2.0 but is not all.

Battery Shield V1.1.0


Since I didn't found yet the version 1.2.0, I used the V1.1.0 from here. and the Wemos D1 mini from here. I've also added an BMP180 pressure and temperature sensor.

Characteristics:

  • Charging Voltage: max: 10V, recommend: 5V
  • Charging Current: max: 1A
  • Lithium Battery voltage: 3.3-4.2V
  • Boost Power Supply: 5V(max: 1A)

 Connections between the Wemos D1 mini and Battery shield:

D1 mini Shield
5V         5V(max: 1A) Power Supply
GND GND
A0           Vbat f the jumper J2 is closed.


Now for the battery. Since I didn't find a decent LiIon flat battery on a good price I had to improvise and I've dismounted a EUR 5 Innergie 2600mA power bank.


Original Power Bank

I have disassembled the power bank and I've get the battery from it.

Samsung 18650 Li-Ion battery. Nice !!!

Then I've added the battery to this EUR 1 battery holder from tinytronics.nl.

Battery is charging 


I've connected the Battery Shield's miniUSB to 5V to charge the battery and the red LED start to light. When the battery was charged the LED red turned off and LED green turned ON signaling that the charging is done.  After I've removed the USB cable from the Battery Shield the green LED turned off not to consume from battery. At this moment I've added the BMP180 and flash the firmware.


BE AWARE OF SHORTING THE BATTERY WIRES. ALWAYS DOUBLE CHECK THEM..

This is happening when the battery is shorted. Don't try it at home. This was done so you not have to try it.

Melted wires and battery holder.



To log the battery level I've used again the good service offered by the thingspeak.com and log
the A0 value, a computed voltage which is not accurate at this time since I didn't had a voltmeter with me to do it.

#include <ESP8266WiFi.h>
#include <Wire.h>
#include <Adafruit_BMP085.h>

Adafruit_BMP085 bmp;

unsigned int raw=0;
float volt=0.0;
String apiKey = "YOUR_THINGSPEAK_API_KEY";

void setup() {
  Serial.begin(115200);
  if (!bmp.begin()) {
    Serial.println(F("Could not find a valid BMP180 sensor, check wiring!"));
  }
  Serial.println(F("\n"));
  const char* ssid     = "WIFI_SSID";
  const char* password = "WIFI_PASSWORD";
  const char* host = "api.thingspeak.com";

  pinMode(A0, INPUT);
  raw = analogRead(A0);
  volt=raw/1023.0;
  volt=volt*4.2;

  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
     delay(500);
  }
  Serial.println(F("Connected to WiFi"));
  String v=String(volt);// change float into string
  // make TCP connections
  WiFiClient client;
  if (client.connect(host,80))  // "184.106.153.149" or api.thingspeak.com
  {
      String postStr = apiKey;
      postStr +="&field1=";
      postStr += String(v);
      postStr +="&field2=";
      postStr += String(raw);
      postStr +="&field3=";
      postStr += String(bmp.readPressure()/100);
      postStr +="&field4=";
      postStr += String(bmp.readTemperature());
      postStr +="&field5=";
      postStr += String(bmp.readAltitude());      
      postStr += "\r\n\r\n";
      
      client.print("POST /update HTTP/1.1\n");
      client.print("Host: api.thingspeak.com\n");
      client.print("Connection: close\n");
      client.print("X-THINGSPEAKAPIKEY: "+apiKey+"\n");
      client.print("Content-Type: application/x-www-form-urlencoded\n");
      client.print("Content-Length: ");
      client.print(postStr.length());
      client.print("\n\n");
      client.print(postStr);    
  }
  client.stop(); 
  Serial.println(F("Sleep......")); 
  ESP.deepSleep( 10 * 60 * 1000000 ); //10 minutes  
}

void loop() {

}


For connecting the BMP180 to Wemos D1 mini see this post. 

The Wemos will enter in sleep mode and every 10 minutes will wake and log the data to cloud.

Don't forget to connect the RST pin to D0 to activate the deep sleep.

The 5V to 3V3 on the Wemos is always  powers so there is some energy lost on it but is ok.

After one day the graph is looking like this:




Total cost: EUR 14.

[ EDIT 1 ] 5 days later after 700 measurements the graph is:

I am considering adding a solar panel to charge the battery during the day.

5 days later
[ EDIT 2 ] I've measured battery's voltage today and the deviation is 0.5V. So I need to add 0.5V over the calculated value. Voltage measured on battery after 5 days is 4.11 V.

I don't find the any information if the shield module will stop providing voltage to Wemos D1 if the battery voltage drop under the 3.6 V or will dry the 18650 battery, but my guess is that will stop at 3.6 V.

[ EDIT 3 ] After 9 days the battery has 4.06 V

9 days later



[ EDIT 4 ] After 11 days the battery has 4.03 V
11 days 

[ EDIT 5 ] After 13 days the battery has 4.00 V. For one day the router decided to take a break. It looks like the battery still have 0.4 V left and it is enough for the rest of the month. I predict that the module can run 30 days without problems with only one charge. Discharging rate is is pretty linear and I hope it will stay linear.

13 days later
[ EDIT 6 ] After 16 days - 3.943 V


Saturday, July 22, 2017

BMP180 and wemos D1 reading temperature, pressure and altitude


To read the pressure, temperature and altitude you can use an BMP180 cheap i2c breakout.

1. Materials:

Wemos D1USD 3.99
BMP180USD 1.97
Total:USD 5.96


2. Libraries:

Install Adafruit BMP_085 libraries from Library Manager:


3. Connections:
VCC----3V3
GND----GND
SDA----D2
SCL----D1



4. Code:

#include <Wire.h>
#include <Adafruit_BMP085.h>

Adafruit_BMP085 bmp;

void setup()
{
  Serial.begin(115200);
  if (!bmp.begin()) {
    Serial.println(F("Could not find a valid BMP180 sensor, check wiring!"));
  }
}
void loop()
{
  // Wait a few seconds between measurements.
  delay(2000);

  Serial.print(F("Pressure: "));  Serial.println(bmp.readPressure()/100);
  Serial.print(F("Temperature: "));  Serial.print(bmp.readTemperature()); Serial.println(F("*C"));
  Serial.print(F("See level pressure: "));  Serial.println(bmp.readSealevelPressure());
  Serial.print(F("Altitude: "));  Serial.println(bmp.readAltitude());
  Serial.println(F("----------------------------------------"));
}



Friday, March 10, 2017

Magical Black Bean - Infrared control over WiFi/3G/4G



Few weeks ago I've received the Broadlink RM mini 3 Black Bean Smart Home Wifi  Universal IR and I've took some time to test it before I can give more details. 




Is absolutely fantastic ! 

As features:


  • -I was able to record any remote I had around
  • -I was able to connect to it from WiFi or 4G from my mobile
  • -I was able to make scenes for multiple remotes. 


The scenes part is very handy since allows me to control multiple devices with one touch. For example:
-start TV
-wait 1 sec
-start Set-box
-wait 1 sec
-put TV on HDMI 3 input
-change SetBox to channel 5.
-start amplifier

All of that with just one touch from the mobile app.

Learning procedure from the original remotes is very simple, just select the TV to emulate and set which button from virtual remote will be assigned to physical remote.





And for example the TV virtual remote is:






Other important feature was to move all defined remotes to another phone. For this there is a special menu and on one phone we will need to select the "Share to other phones in WLAN" options and on the receiver phone "Import from shared phone in WLAN". In one second I had all my remotes, scripts in the second phone, so no more relearning process. Super !!!.






As for what is inside:
-main processor is a 200MHz Cortex M3 Marvel 88MC200 and for WiFi a 88W8801 chip.
-6 snowflake positioned IR emitter LEDs.
-one IR Receiver for learning the codes from your remotes.




The PCB is looking like:




Make sure that:
- there is direct line of sight between the mini R and your appliances, otherwise the IR reflection will not always work.
-you have a power adapter to deliver 5V since you will not find one in the box. An old phone charger will be just fine.


Sunday, February 26, 2017

Kalman filter


In few projects I've needed the Kalman filter to suppress the noise and other inaccuracies especially from accelerometers. Below is a nice picture from a live stream of data transmitted by the ESP8266 LDR over websockets to an application server written in javascript. The data received in the browser looks like:






With red is raw data and with white is the predicted data after the Kalman filter was applied.

Inside of a 1000lx bulb LED




Since this Livarno bulb refused to work after few months of fine operation I decided to dismount it.








Power supply was covered in rubber and it take a while to clean it between the components.








32 LEDs are used for this bulb. I've tested few of them with a 5V power supply and are very bright (don't look at them since is not a nice feeling after that)




Here is the power supply. Still has rubber left between components.