---
type: entity
tags: [parking, hardware, access-control, upgrade-path]
sources: [parking-system-architecture]
updated: 2026-06-15
status: deferred
---

# Custom ESP32 Controller (prevention alternative)

> **Status: deferred — not being implemented for now.** Access control stays on the
> [[uhppote-controller]] behind [[network-isolation]] (tamper-*evident*). This page is kept as
> the documented upgrade path; revisit only if prevention-grade device authentication becomes a
> requirement. See [[open-questions]] #6.

A small custom controller for **device-level authentication** — a control path that holds even
against an attacker on the wire. The prevention-grade upgrade from the [[uhppote-controller]]
(which is only tamper-*evident*). It moves the [[trust-boundary]] to the device. (See
[[parking-system-architecture]] §7.)

## Requirement reframed

The threat is **forged or replayed commands**, not eavesdropping ("open lane 2" isn't secret).
So the essential requirement is **authenticity + freshness (anti-replay)**; encryption is
optional defence-in-depth. This is implemented as [[challenge-response-auth]].

## Hardware

- **Olimex ESP32-POE** (wired Ethernet + PoE, open-source hardware) or **ESP32-S3 + W5500**.
- **[[atecc608]]** secure element holding the key(s), generated on-chip, non-extractable.
- **Opto-isolated relay** between GPIO and the barrier operator's dry-contact open input.
- Enable **ESP32 flash encryption + secure boot** regardless.
- Transport: Ethernet (one network paradigm on the managed switch), or **RS-485** multidrop for
  long/noisy runs.

## Safety — treat as seriously as the crypto

Governed by [[fail-state-safety]]: **entry fails closed, exit fails open**, a **hardware manual
override** (key switch) that works with the ESP32 dead, a watchdog with a safe default, and the
barrier operator still owns physical safety ([[barrier-not-a-door]]).

## Trade-offs

You take on firmware reliability, EMC/surge protection (TVS diodes, isolation, grounding,
Ethernet surge arrestor outdoors), and field maintenance. Mitigate by keeping firmware **tiny
and auditable**: verify a signed fresh command, pulse a relay, watchdog + safe state, nothing
more. All parking logic stays on the host.