[disclaimer: I'm a security / crypto professional and deal with security architecture questions like this every day.]
You have stumbled onto the problem of storing credentials in such a way that an unattended process can access them, but an attacker cannot. This is a well known and very difficult problem to solve.
If your IoT device has a hardware keystore built-in to the motherboard, like some TPMs, or the equivalent to the Android Hardware-backed Keystore or Apple Secure Enclave, then you can use that.
With traditional servers you can use HSMs or Smart Cards, but the only full software solution that I'm aware of is to derive an AES key from some sort of "hardware fingerprint" built by combining serial numbers of all the hardware devices. Then use that AES key to encrypt the credentials. A process running on the same server can reconstruct the AES key and decrypt the credentials, but once you extract the file from the server, it's essentially un-decryptable.
IoT throws a wrench into that for two reasons:
The assumption that hardware serial numbers are unique probably does not hold, and
Unlike servers, attackers have physical access to the device, therefore can probably get a shell on the device to run the decryption program.
Both hardware encryption (TPMs) and "hardware fingerprint" encryption are obfuscation at best because, fundamentally, if a local process can decrypt the data, then an attacker able to run that local process can also decrypt it.
So the standard trick looks like it doesn't work here. The first question you need to need to ask yourself is:
- What is my threat model / where does this project sit on the
Secure <--> Convenient scale ?
Ultimately, I think you either need to decide that security > convenience and have a human enter the credentials after each boot-up (using something like @BenceKaulics's answer), or you decide that security < convenience and just put the credentials on the device, maybe using some obfuscation if you feel that makes a difference.
This is a hard problem made harder by the nature of IoT devices.
For completeness, the full-blown industrial solution to this problem is:
- Give each IoT device a unique RSA public key at manufacture time. Record this public key in a db against the device serial number.
- Store the sensitive credentials on a proper server, let's call it a "gateway".
- When an IoT device authenticates to the gateway (using its RSA key), the gateway opens a session for it using the stored credentials and hands the session token back to the device.
- For best security, the gateway is a physical (or VPN) gateway so that all traffic from the IoT device passes through the gateway and you have more control over firewall rules and stuff - ideally preventing the device from having direct (non-VPN tunneled) access to the internet.
This way, and attacker who compromises a device can get a session opened, but never has direct access to the credentials.
