I'm designing on an IoT device that connects to a web server and publishes/subscribes to the MQTT service. Users download an iOS app to setup/register/use their device.
Question: What's the recommended way of registering a user and connecting their IoT device to that account?
Here's my first architecture to achieve this user/IoT onboard flow:
Apps required for connect flow:
- iOS app (User interface)
- IoT app (node on a RPI3)
- web server w/MQTT
On-boarding flow:
- User downloads iOS/Android App
- User creates account online (through web server)
- User turns on IoT device
- IoT device (RPI) launches app, tries to connect to any existing wifi network.
- After X attempts to connect to a wifi, RPI switches into AP mode (starts broadcasting a SSID)
- User connects phone to RPI’s broadcasted SSID
- User gets a list of nearby wifi SSIDs and selects a SSID and enters password for home SSID.
- User submits wifi ssid/password to the RPI (submit includes a token with user ID)
- RPI stops AP mode, connects to home wifi, registers itself online using user ID and RPI device ID.
- RPI continues node app (for MQTT pub/sub)
- User uses iOS app to communicate with web server, web server publishes changes (MQTT), IoT device receives the message.
I'm sure there are lots of ways to do this but I'm looking for the simplest secure implementation.
Is there anything inherently wrong with this approach and what are the best practices when creating new users and registering devices to users?