Experiment: Secure Sensor Data Transmission Using ESP-NOW

Aim

To implement secure wireless transmission of temperature and humidity data between two ESP32 devices using ESP-NOW with AES-128-based encryption.

Objectives

To understand the concept of ESP-NOW communication in IoT systems.
To interface a DHT11 temperature and humidity sensor with an ESP32.
To transmit sensor data directly between two ESP32 devices without using an access point or cloud server.
To configure ESP-NOW communication between a transmitter and receiver.
To understand peer-to-peer wireless communication in IoT systems.
To configure ESP-NOW encryption using a Primary Master Key (PMK) and Local Master Key (LMK).
To understand how AES-128-based encryption protects ESP-NOW communication.
To verify that the receiver successfully obtains the transmitted sensor data.

Components Required

Sr. No.	Component	Quantity	Purpose
1	ESP32 Development Board	2	One transmitter and one receiver
2	DHT11 Sensor	1	Measures temperature and humidity
3	USB Cable	2	Programming and powering ESP32 boards
4	Jumper Wires	As required	Electrical connections
5	Computer	1	Programming and monitoring
6	Arduino IDE	1	ESP32 programming

Theory

ESP-NOW

ESP-NOW is a connectionless wireless communication protocol developed by Espressif for communication between ESP devices.

It allows ESP32 devices to exchange data directly without requiring a traditional Wi-Fi access point or Internet connection. It is suitable for IoT applications such as sensors, remote controls and local device-to-device communication.

The communication structure used in this experiment is:

DHT11 Sensor
      ↓
ESP32 Transmitter
      ↓
   ESP-NOW
      ↓
ESP32 Receiver
      ↓
Serial Monitor

ESP-NOW Peer Communication

In ESP-NOW, devices communicate using peer-to-peer wireless communication.

The transmitter sends a sensor-data packet to the MAC address of the receiver.

Unlike a normal Wi-Fi application, the devices do not need to establish a conventional IP connection with each other.

ESP-NOW Security

ESP-NOW provides security using the CCMP security mechanism.

A Primary Master Key (PMK) and Local Master Keys (LMKs) are used for encrypted peer communication.

The PMK is used to protect the LMK using AES-128, while the LMK associated with a paired device is used to encrypt the ESP-NOW communication frame.

The basic security structure is:

             Primary Master Key
                     ↓
               Protects LMK
                     ↓
          Local Master Key
                     ↓
             AES-128 / CCMP
                     ↓
          Encrypted ESP-NOW
                Communication

If an LMK is not configured for a paired device, that ESP-NOW communication is not encrypted. Therefore, configuring the encrypted peer correctly is an important part of this experiment.

AES-128

AES stands for Advanced Encryption Standard.

ESP-NOW uses AES-128 as part of its security mechanism. AES-128 uses a 128-bit key to protect the communication.

In this experiment, the encryption is handled by the ESP-NOW security mechanism rather than manually implementing AES encryption in the application code.

Therefore:

Sensor Data
     ↓
ESP-NOW Security
     ↓
AES-128 / CCMP Protection
     ↓
Wireless Transmission
     ↓
ESP32 Receiver
     ↓
Decrypted Sensor Data

Advantages of ESP-NOW

Direct communication between ESP32 devices.
Does not require an Internet connection.
Does not require a cloud server.
Low communication overhead.
Suitable for local IoT applications.
Supports encrypted peer communication.
Suitable for sensor and control applications.

Pin Connections

DHT11 to ESP32 Transmitter

DHT11 Pin	ESP32 Pin	Description
VCC	3.3V	Power supply
DATA	GPIO 4	Digital sensor data
GND	GND	Ground

The second ESP32 is used only as the receiver and does not require a DHT11 sensor.

Connection Diagram

                 TRANSMITTER

        +-------------------+
        |       DHT11       |
        |                   |
        | VCC DATA GND      |
        +--+----+----+------+
           |    |    |
          3.3V GPIO4 GND
           |    |    |
     +-----+----+----+-----+
     |       ESP32 #1      |
     |    TRANSMITTER      |
     +----------+----------+
                |
                |
                |  Secure ESP-NOW
                |  AES-128 / CCMP
                |
                ↓
     +---------------------+
     |      ESP32 #2       |
     |      RECEIVER       |
     +----------+----------+
                |
                ↓
          Serial Monitor

Program

Important Configuration

The following example uses:

ESP32 #1 as the transmitter.
ESP32 #2 as the receiver.
DHT11 connected to GPIO 4 of ESP32 #1.
A fixed PMK for the ESP-NOW security configuration.
A fixed LMK for the encrypted transmitter-receiver peer.
The receiver's MAC address configured in the transmitter.
The transmitter's MAC address configured in the receiver.

The MAC addresses must be changed to match the two ESP32 boards being used.

Step 1: Find the MAC Address

Upload the following program to each ESP32 separately:

#include <WiFi.h>

void setup()
{
  Serial.begin(115200);

  WiFi.mode(WIFI_STA);

  Serial.print("ESP32 MAC Address: ");
  Serial.println(WiFi.macAddress());
}

void loop()
{
}

Open the Serial Monitor at 115200 baud.

Example:

ESP32 MAC Address: 24:6F:28:AA:BB:CC

Record the MAC address of both ESP32 boards.

Step 2: ESP32 Transmitter Program

#include <WiFi.h>
#include <esp_now.h>
#include <DHT.h>

#define DHTPIN 4
#define DHTTYPE DHT11

DHT dht(DHTPIN, DHTTYPE);

/*
   Replace this with the MAC address
   of ESP32 Receiver.
*/
uint8_t receiverAddress[] =
{
  0x24, 0x6F, 0x28, 0xAA, 0xBB, 0xCC
};

/*
   16-byte Primary Master Key.
*/
uint8_t PMK[] =
{
  'P','M','K','1','2','3','4','5',
  '6','7','8','9','A','B','C','D'
};

/*
   16-byte Local Master Key.
*/
uint8_t LMK[] =
{
  'L','M','K','1','2','3','4','5',
  '6','7','8','9','A','B','C','D'
};

typedef struct
{
  float temperature;
  float humidity;
} SensorData;

SensorData data;

void setup()
{
  Serial.begin(115200);

  dht.begin();

  WiFi.mode(WIFI_STA);

  Serial.print("Transmitter MAC: ");
  Serial.println(WiFi.macAddress());

  if (esp_now_init() != ESP_OK)
  {
    Serial.println("ESP-NOW initialization failed");
    return;
  }

  /*
     Set Primary Master Key.
  */
  if (esp_now_set_pmk(PMK) != ESP_OK)
  {
    Serial.println("PMK configuration failed");
    return;
  }

  /*
     Configure encrypted receiver.
  */
  esp_now_peer_info_t peerInfo = {};

  memcpy(
    peerInfo.peer_addr,
    receiverAddress,
    6
  );

  peerInfo.channel = 0;
  peerInfo.encrypt = true;

  memcpy(
    peerInfo.lmk,
    LMK,
    16
  );

  if (esp_now_add_peer(&peerInfo) != ESP_OK)
  {
    Serial.println("Failed to add encrypted peer");
    return;
  }

  Serial.println("Secure ESP-NOW transmitter ready");
}

void loop()
{
  data.temperature = dht.readTemperature();
  data.humidity = dht.readHumidity();

  if (isnan(data.temperature) ||
      isnan(data.humidity))
  {
    Serial.println("DHT11 reading failed");
    delay(2000);
    return;
  }

  esp_err_t result = esp_now_send(
    receiverAddress,
    (uint8_t *)&data,
    sizeof(data)
  );

  if (result == ESP_OK)
  {
    Serial.println("Encrypted sensor data sent");
  }
  else
  {
    Serial.println("Data transmission failed");
  }

  Serial.print("Temperature: ");
  Serial.print(data.temperature);
  Serial.println(" °C");

  Serial.print("Humidity: ");
  Serial.print(data.humidity);
  Serial.println(" %");

  Serial.println();

  delay(2000);
}

Step 3: ESP32 Receiver Program

#include <WiFi.h>
#include <esp_now.h>

/*
   Replace this with the MAC address
   of ESP32 Transmitter.
*/
uint8_t transmitterAddress[] =
{
  0x24, 0x6F, 0x28, 0x11, 0x22, 0x33
};

/*
   Same 16-byte Primary Master Key
   used by the transmitter.
*/
uint8_t PMK[] =
{
  'P','M','K','1','2','3','4','5',
  '6','7','8','9','A','B','C','D'
};

/*
   Same 16-byte Local Master Key
   used by the transmitter.
*/
uint8_t LMK[] =
{
  'L','M','K','1','2','3','4','5',
  '6','7','8','9','A','B','C','D'
};

typedef struct
{
  float temperature;
  float humidity;
} SensorData;

SensorData receivedData;

void onDataReceive(
  const esp_now_recv_info_t *info,
  const uint8_t *incomingData,
  int len
)
{
  if (len != sizeof(SensorData))
  {
    Serial.println("Invalid data size");
    return;
  }

  memcpy(
    &receivedData,
    incomingData,
    sizeof(receivedData)
  );

  Serial.println("Secure sensor data received");

  Serial.print("Temperature: ");
  Serial.print(receivedData.temperature);
  Serial.println(" °C");

  Serial.print("Humidity: ");
  Serial.print(receivedData.humidity);
  Serial.println(" %");

  Serial.println();
}

void setup()
{
  Serial.begin(115200);

  WiFi.mode(WIFI_STA);

  Serial.print("Receiver MAC: ");
  Serial.println(WiFi.macAddress());

  if (esp_now_init() != ESP_OK)
  {
    Serial.println("ESP-NOW initialization failed");
    return;
  }

  /*
     Set Primary Master Key.
  */
  if (esp_now_set_pmk(PMK) != ESP_OK)
  {
    Serial.println("PMK configuration failed");
    return;
  }

  /*
     Configure the encrypted transmitter peer.
  */
  esp_now_peer_info_t peerInfo = {};

  memcpy(
    peerInfo.peer_addr,
    transmitterAddress,
    6
  );

  peerInfo.channel = 0;
  peerInfo.encrypt = true;

  memcpy(
    peerInfo.lmk,
    LMK,
    16
  );

  if (esp_now_add_peer(&peerInfo) != ESP_OK)
  {
    Serial.println("Failed to add encrypted peer");
    return;
  }

  esp_now_register_recv_cb(onDataReceive);

  Serial.println("Secure ESP-NOW receiver ready");
}

void loop()
{
  delay(100);
}

Code Explanation

Code / Function	Explanation
`WiFi.mode(WIFI_STA)`	Configures the ESP32 Wi-Fi interface in station mode.
`esp_now_init()`	Initializes ESP-NOW communication.
`esp_now_set_pmk()`	Sets the Primary Master Key used by ESP-NOW security.
`esp_now_peer_info_t`	Stores information about the ESP-NOW peer.
`peer_addr`	Stores the MAC address of the communication peer.
`peerInfo.encrypt = true`	Enables encrypted ESP-NOW communication with the configured peer.
`peerInfo.lmk`	Stores the Local Master Key associated with the peer.
`esp_now_add_peer()`	Adds the encrypted peer to the ESP-NOW peer list.
`dht.readTemperature()`	Reads temperature from the DHT11.
`dht.readHumidity()`	Reads humidity from the DHT11.
`esp_now_send()`	Sends the sensor-data packet to the receiver.
`esp_now_register_recv_cb()`	Registers the function that is called when ESP-NOW data is received.
`memcpy()`	Copies the received byte data into the sensor-data structure.

Security Configuration

Two keys are used in the practical.

Key	Size	Purpose
PMK	16 bytes	Primary Master Key used to protect the LMK.
LMK	16 bytes	Local Master Key associated with the encrypted peer.

ESP-NOW documentation specifies 16-byte PMK and LMK values. The PMK is used to encrypt the LMK using AES-128, while the LMK is used for protecting the communication frame with CCMP.

The transmitter and receiver must use the corresponding key configuration.

Security Flow

The complete security process is:

                 Sensor Data
                     ↓
              ESP32 Transmitter
                     ↓
               ESP-NOW Peer
                     ↓
               LMK / PMK
                     ↓
             AES-128 / CCMP
                     ↓
             Encrypted Frame
                     ↓
              Wireless Transfer
                     ↓
               ESP32 Receiver
                     ↓
              Decryption /
              Security Check
                     ↓
               Sensor Data

Procedure

Connect the DHT11 sensor to GPIO 4 of the transmitter ESP32.
Connect both ESP32 boards to the computer using USB cables.
Install the ESP32 board package in Arduino IDE.
Install the DHT sensor library if required.
Upload the MAC-address program to both ESP32 boards.
Record the MAC address of the transmitter.
Record the MAC address of the receiver.
Enter the receiver MAC address in the transmitter program.
Enter the transmitter MAC address in the receiver program.
Keep the PMK and LMK identical on both ESP32 programs.
Upload the receiver program to ESP32 #2.
Open the receiver Serial Monitor at 115200 baud.
Upload the transmitter program to ESP32 #1.
Open the transmitter Serial Monitor at 115200 baud.
Verify that both devices report successful ESP-NOW initialization.
Verify that the encrypted peer is added successfully.
Observe the DHT11 temperature and humidity readings on the transmitter.
Observe the corresponding readings on the receiver.
Verify that the receiver obtains the sensor data through the secured ESP-NOW link.
Record the observed values.

Observations and Output

Transmitter Output

The transmitter Serial Monitor should display output similar to:

Transmitter MAC: 24:6F:28:AA:BB:CC
Secure ESP-NOW transmitter ready

Encrypted sensor data sent
Temperature: 27.40 °C
Humidity: 61.00 %

Encrypted sensor data sent
Temperature: 27.50 °C
Humidity: 61.00 %

Receiver Output

The receiver Serial Monitor should display:

Receiver MAC: 24:6F:28:11:22:33
Secure ESP-NOW receiver ready

Secure sensor data received
Temperature: 27.40 °C
Humidity: 61.00 %

Secure sensor data received
Temperature: 27.50 °C
Humidity: 61.00 %

Observation Table

Sr. No.	Transmitter Temperature	Receiver Temperature	Transmitter Humidity	Receiver Humidity
1	27.40 °C	27.40 °C	61 %	61 %
2	27.50 °C	27.50 °C	61 %	61 %
3	27.50 °C	27.50 °C	62 %	62 %

Note: The values shown above are example observations. Actual readings depend on the DHT11 sensor and surrounding environmental conditions.

Security Verification

The security can be demonstrated by intentionally changing the security configuration.

For example, the following tests can be performed:

Test	Expected Result
Correct receiver MAC and matching PMK/LMK	Sensor data is successfully received.
Incorrect receiver MAC	Data is not delivered to the intended receiver.
Incorrect LMK	Encrypted peer communication does not work correctly.
ESP-NOW peer encryption disabled	Communication is no longer using the configured encrypted peer mechanism.

This demonstrates that secure ESP-NOW communication depends on correctly configured peer security parameters.

ESP-NOW vs Normal Wi-Fi Communication

Feature	Normal Wi-Fi Application	ESP-NOW
Communication	Usually through an IP network	Direct device-to-device
Internet required	May be required	No
Access point required	Usually	Not for direct ESP-NOW communication
IoT sensor applications	Yes	Yes
Encrypted peer communication	Depends on the Wi-Fi/security protocol used	Supported through ESP-NOW security

ESP-NOW is specifically designed for direct communication between ESP devices and does not require an access point for device-to-device communication.

Security Considerations

The PMK and LMK used in this experiment are demonstration keys.
Real IoT systems should use properly managed, unique keys.
Keys should not be exposed publicly or hard-coded in production firmware without appropriate protection.
The experiment demonstrates link-level ESP-NOW security and does not represent complete IoT security.
Broadcast ESP-NOW communication does not provide the same encrypted peer mechanism as an encrypted unicast peer. Espressif notes that multicast vendor-specific action frames are not supported for encryption.
Only authorized peers should be added when transmitting sensitive information.

Result

The DHT11 sensor was successfully interfaced with the ESP32 transmitter, and temperature and humidity data were transmitted wirelessly to a second ESP32 using ESP-NOW. Encrypted peer communication was configured using a PMK and LMK, providing AES-128-based protection through ESP-NOW's CCMP security mechanism. The transmitted sensor values were successfully received by the second ESP32.

Viva Questions

Q1. What is ESP-NOW?

ESP-NOW is a connectionless wireless communication protocol developed by Espressif for direct communication between ESP devices.

Q2. Does ESP-NOW require an Internet connection?

No. ESP-NOW can communicate directly between ESP devices without an Internet connection.

Q3. Does ESP-NOW require a Wi-Fi router?

No. Direct ESP-NOW communication between ESP devices does not require a conventional Wi-Fi access point.

Q4. What is the role of the MAC address?

The MAC address identifies the ESP-NOW peer to which the data is transmitted.

Q5. What is PMK?

PMK stands for Primary Master Key. It is a 16-byte key used as part of the ESP-NOW security mechanism.

Q6. What is LMK?

LMK stands for Local Master Key. It is associated with an individual encrypted ESP-NOW peer.

Q7. Which encryption algorithm is associated with ESP-NOW security?

ESP-NOW security uses AES-128 as part of its PMK/LMK and CCMP-based protection mechanism.

Q8. What is CCMP?

CCMP stands for Counter Mode with Cipher Block Chaining Message Authentication Code Protocol. It is used to protect ESP-NOW communication frames.

Q9. Why is `peerInfo.encrypt = true` used?

It enables encrypted communication for the configured ESP-NOW peer.

Q10. What happens if the LMK is not configured for an encrypted peer?

The peer's ESP-NOW communication will not use the configured encrypted peer mechanism.

Q11. Why are two ESP32 boards used?

One ESP32 acts as the sensor transmitter and the other acts as the receiver, demonstrating direct IoT device-to-device communication.

Q12. Why is DHT11 connected only to the transmitter?

The transmitter reads the sensor data and sends it to the receiver. Therefore, the receiver does not need its own DHT11 sensor.

Q13. What is the advantage of ESP-NOW for IoT applications?

It provides direct, low-overhead communication between ESP devices and is suitable for sensor and control applications.

Q14. How is this experiment different from HTTPS communication?

HTTPS secures communication between a client and a server using TLS. This experiment demonstrates encrypted local device-to-device communication using ESP-NOW.

Q15. Is ESP-NOW itself an encryption algorithm?

No. ESP-NOW is a communication protocol. Its security mechanism uses CCMP and AES-128-based key management to protect encrypted peer communication.

Conclusion

This experiment demonstrates secure wireless sensor-data transmission between two ESP32 devices using ESP-NOW. The DHT11 sensor data is transmitted directly from the transmitter ESP32 to the receiver ESP32 without using the Internet or a cloud server. ESP-NOW peer encryption is configured using PMK and LMK keys, providing AES-128-based protection through CCMP. The experiment demonstrates how secure device-to-device communication can be implemented in an IoT system.