Security model
Trust boundary
Section titled “Trust boundary”The 16-byte per-device key is the trust boundary. Whoever holds it can sign actions and queries for that controller and verify what it sends. State reads on the LAN require no key; they are protected only by network access.
Each key is unique to its controller, so compromising one key exposes exactly one controller. Keys are issued by SplashMe only to accounts that own the controller.
What is protected
Section titled “What is protected”| Property | Mechanism |
|---|---|
| Authenticity and integrity of every message | Authentication tag under the device key |
| Replay of actions and queries | Strict monotonic counter on the controller, checked after the tag |
| Commands reserved for SplashMe installation and service tooling | Refused over the LAN even with the key |
| Cloud access | OAuth bearer token plus device ownership on every request |
| Key delivery | Only to an owning account, over HTTPS, with Cache-Control: no-store |
What is not protected
Section titled “What is not protected”- Confidentiality. Frames are cleartext inside the transport. MQTT runs over TLS; the LAN transport is plain HTTP. Do not put secrets in payloads.
- State requests and event acknowledgements are not replay-protected. Replaying them is harmless: the controller re-sends its state or keeps a cursor that only moves forward.
- Ordering of controller-originated frames. The cloud records the controller’s counter for liveness only.
Older firmware
Section titled “Older firmware”Controllers on firmware earlier than 2.5.46 are not v2-capable: their v2 endpoints return 409 and they remain fully functional through Device API v1. A firmware update enables v2. For update options, contact support@splashmepool.com.au.
Key changes
Section titled “Key changes”A controller’s key can change after a firmware update. If LAN verification starts failing after an update, re-fetch the envelope key from the cloud. If the key endpoint no longer returns a key for a controller you still own, contact support@splashmepool.com.au.
Recommendations for integrators
Section titled “Recommendations for integrators”- Store keys encrypted at rest; never embed them in client-side code.
- Verify every frame you receive, including LAN responses, in constant time.
- Use Unix seconds as your counter and keep your clock synchronised.
- Watch
VERIFY_FAILevents for a controller you manage: they indicate a misconfigured or hostile sender on the network. - Re-check ownership through the cloud periodically and discard keys for controllers you no longer have access to.