Wire and test access-control indicators

Trace the controller’s two active-low buttons and four indicators, then compare identity recognition with a zone access decision.

Shield Shelly: I want you to trace the button, the identity, and the permission before trusting the green light., your practice guide

Shield Shelly: I want you to trace the button, the identity, and the permission before trusting the green light.
Predict the reading, then compare it with the measurement.

Wokwi ESP32

Third party Tool

Tier 1 · Web · No account

Version tested: Compiled and booted by the Wokwi gate (ESP32 Arduino core 3.3.11); captured in the Wokwi web editor on 2026-09-09. Date: 2026-09-09.

Open the ESP32 editor, paste diagram.json, then paste sketch.ino.

Open Wokwi to paste in the files (new tab)

Get the files

Use both prepared files. This is a paste-in setup; saving a project requires a Wokwi account.

diagram.json

3,375 bytes · Circuit connections

Download

{
  "version": 1,
  "author": "IoTClass",
  "editor": "wokwi",
  "parts": [
    {
      "type": "wokwi-esp32-devkit-v1",
      "id": "esp",
      "top": 80,
      "left": 0,
      "attrs": {}
    },
    {
      "type": "wokwi-led",
      "id": "led0",
      "top": -100,
      "left": 0,
      "attrs": {
        "color": "green"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r0",
      "top": -25,
      "left": 0,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-led",
      "id": "led1",
      "top": -100,
      "left": 85,
      "attrs": {
        "color": "red"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r1",
      "top": -25,
      "left": 85,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-led",
      "id": "led2",
      "top": -100,
      "left": 170,
      "attrs": {
        "color": "yellow"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r2",
      "top": -25,
      "left": 170,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-led",
      "id": "led3",
      "top": -100,
      "left": 255,
      "attrs": {
        "color": "blue"
      }
    },
    {
      "type": "wokwi-resistor",
      "id": "r3",
      "top": -25,
      "left": 255,
      "attrs": {
        "value": "220"
      }
    },
    {
      "type": "wokwi-buzzer",
      "id": "buzzer",
      "top": 100,
      "left": 250,
      "attrs": {}
    },
    {
      "type": "wokwi-pushbutton",
      "id": "button0",
      "top": 220,
      "left": 250,
      "attrs": {
        "color": "green",
        "label": "Select card",
        "bounce": "0"
      }
    },
    {
      "type": "wokwi-pushbutton",
      "id": "button1",
      "top": 310,
      "left": 250,
      "attrs": {
        "color": "blue",
        "label": "Request access",
        "bounce": "0"
      }
    }
  ],
  "connections": [
    [
      "esp:TX0",
      "$serialMonitor:RX",
      "",
      []
    ],
    [
      "esp:RX0",
      "$serialMonitor:TX",
      "",
      []
    ],
    [
      "esp:D2",
      "led0:A",
      "green",
      []
    ],
    [
      "led0:C",
      "r0:1",
      "black",
      []
    ],
    [
      "r0:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D4",
      "led1:A",
      "red",
      []
    ],
    [
      "led1:C",
      "r1:1",
      "black",
      []
    ],
    [
      "r1:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D5",
      "led2:A",
      "yellow",
      []
    ],
    [
      "led2:C",
      "r2:1",
      "black",
      []
    ],
    [
      "r2:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D18",
      "led3:A",
      "blue",
      []
    ],
    [
      "led3:C",
      "r3:1",
      "black",
      []
    ],
    [
      "r3:2",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D19",
      "buzzer:2",
      "purple",
      []
    ],
    [
      "buzzer:1",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:D15",
      "button0:1.l",
      "green",
      []
    ],
    [
      "button0:2.l",
      "esp:GND.1",
      "black",
      []
    ],
    [
      "esp:RX2",
      "button1:1.l",
      "green",
      []
    ],
    [
      "button1:2.l",
      "esp:GND.1",
      "black",
      []
    ]
  ]
}

sketch.ino

13,675 bytes · ESP32 program

Download

// Setup definitions from auth-lab-basic-setup; runtime from its linked
// auth-lab-basic-implementation companion. Original serial output retained.

/*
 * Secure IoT Access Control System
 * Demonstrates: RFID-style authentication, role-based access control,
 *               lockout policies, and comprehensive audit logging
 *
 * Security Concepts Implemented:
 * 1. Token-based authentication (simulating RFID cards)
 * 2. Role-based access control (RBAC) with three access levels
 * 3. Account lockout after failed attempts
 * 4. Comprehensive audit logging with timestamps
 * 5. Visual and audio feedback for security events
 * 6. Constant-time comparison to prevent timing attacks
 */

#include <Arduino.h>

// ============== PIN DEFINITIONS ==============
const int LED_ACCESS_GRANTED = 2;   // Green LED
const int LED_ACCESS_DENIED = 4;    // Red LED
const int LED_SYSTEM_STATUS = 5;    // Yellow LED
const int LED_ADMIN_MODE = 18;      // Blue LED
const int BUZZER_PIN = 19;          // Buzzer for audio feedback
const int BUTTON_SELECT = 15;       // Select RFID card
const int BUTTON_ACCESS = 16;       // Request access

// ============== ACCESS LEVELS ==============
enum AccessLevel {
    ACCESS_NONE = 0,
    ACCESS_GUEST = 1,
    ACCESS_USER = 2,
    ACCESS_ADMIN = 3
};

// ============== USER CREDENTIAL STRUCTURE ==============
struct UserCredential {
    const char* cardId;       // Simulated RFID card ID
    const char* userName;     // User name for logging
    AccessLevel accessLevel;  // Permission level
    bool isActive;            // Account status
};

// ============== CREDENTIAL DATABASE ==============
// In production: Store in secure element, never in code!
const int NUM_USERS = 6;
UserCredential userDatabase[NUM_USERS] = {
    {"RFID_ADMIN_001", "Alice Admin", ACCESS_ADMIN, true},
    {"RFID_ADMIN_002", "Bob Admin", ACCESS_ADMIN, true},
    {"RFID_USER_001", "Charlie User", ACCESS_USER, true},
    {"RFID_USER_002", "Diana User", ACCESS_USER, true},
    {"RFID_GUEST_001", "Eve Guest", ACCESS_GUEST, true},
    {"RFID_DISABLED", "Frank Former", ACCESS_USER, false}  // Disabled account
};

// Test cards for simulation (includes invalid cards)
const int NUM_TEST_CARDS = 8;
const char* testCards[NUM_TEST_CARDS] = {
    "RFID_ADMIN_001",   // Valid admin
    "RFID_USER_001",    // Valid user
    "RFID_GUEST_001",   // Valid guest
    "RFID_DISABLED",    // Disabled account
    "RFID_UNKNOWN_1",   // Unknown card
    "RFID_UNKNOWN_2",   // Unknown card
    "RFID_ADMIN_002",   // Valid admin
    "RFID_USER_002"     // Valid user
};

// ============== SECURITY CONFIGURATION ==============
const int MAX_FAILED_ATTEMPTS = 3;
const unsigned long LOCKOUT_DURATION_MS = 60000;  // 1 minute lockout
const unsigned long LOCKOUT_ESCALATION_MS = 30000; // Add 30s per additional failure
const int MAX_LOCKOUT_DURATION_MS = 300000;  // Max 5 minutes

// ============== ACCESS CONTROL ZONES ==============
// Different areas with different access requirements
struct AccessZone {
    const char* zoneName;
    AccessLevel requiredLevel;
};

const int NUM_ZONES = 4;
AccessZone accessZones[NUM_ZONES] = {
    {"Public Lobby", ACCESS_GUEST},
    {"Office Area", ACCESS_USER},
    {"Server Room", ACCESS_ADMIN},
    {"Control Center", ACCESS_ADMIN}
};

// ============== SECURITY STATE ==============
struct SecurityState {
    int failedAttempts;
    unsigned long lockoutEndTime;
    bool isLocked;
    int currentCardIndex;
    String lastAuthenticatedUser;
    AccessLevel currentAccessLevel;
    unsigned long sessionStartTime;
} secState;

// ============== AUDIT LOG ==============
struct AuditEntry {
    unsigned long timestamp;
    const char* cardId;
    const char* userName;
    const char* eventType;
    const char* zoneName;
    bool success;
    AccessLevel attemptedLevel;
};

const int MAX_AUDIT_ENTRIES = 50;
AuditEntry auditLog[MAX_AUDIT_ENTRIES];
int auditIndex = 0;

// Constant-time string comparison prevents timing side-channel attacks
bool constantTimeCompare(const char* a, const char* b) {
    size_t lenA = strlen(a);
    size_t lenB = strlen(b);

// Always compare full length to prevent length-based timing
    size_t maxLen = (lenA > lenB) ? lenA : lenB;

volatile int result = 0;
    for (size_t i = 0; i < maxLen; i++) {
        char charA = (i < lenA) ? a[i] : 0;
        char charB = (i < lenB) ? b[i] : 0;
        result |= charA ^ charB;
    }

// Also check lengths match
    result |= (lenA != lenB);

return (result == 0);
}

unsigned long lastButtonSelectTime = 0;
unsigned long lastButtonAccessTime = 0;
const unsigned long DEBOUNCE_DELAY = 250;

// Forward declarations
void initializeSystem();  void handleButtons();
UserCredential* authenticateCard(const char* cardId);
bool authorizeAccess(AccessLevel userLevel, AccessLevel requiredLevel);
void requestAccess(int zoneIndex);
void logAuditEvent(const char* cardId, const char* userName,
    const char* eventType, const char* zoneName,
    bool success, AccessLevel level);
void printAuditLog();      void handleLockout();
void indicateAccessGranted(AccessLevel level);
void indicateAccessDenied(); void indicateSystemLocked();
void playTone(int frequency, int duration);
bool constantTimeCompare(const char* a, const char* b);
void processSerialCommands(); void printMenu();
const char* accessLevelToString(AccessLevel level);

void setup() {
    Serial.begin(115200);
    delay(1000);
    initializeSystem();
    Serial.println("\n=========================================");
    Serial.println("   IoT ACCESS CONTROL SYSTEM v1.0");
    Serial.println("=========================================");
    printMenu();
}

void loop() {
    handleButtons();
    handleLockout();
    processSerialCommands();
    delay(10);
}

void initializeSystem() {
    pinMode(LED_ACCESS_GRANTED, OUTPUT);
    pinMode(LED_ACCESS_DENIED, OUTPUT);
    pinMode(LED_SYSTEM_STATUS, OUTPUT);
    pinMode(LED_ADMIN_MODE, OUTPUT);
    pinMode(BUZZER_PIN, OUTPUT);
    pinMode(BUTTON_SELECT, INPUT_PULLUP);
    pinMode(BUTTON_ACCESS, INPUT_PULLUP);
    // All LEDs off, reset security state
    for (int pin : {LED_ACCESS_GRANTED, LED_ACCESS_DENIED,
                    LED_SYSTEM_STATUS, LED_ADMIN_MODE})
        digitalWrite(pin, LOW);
    secState = {0, 0, false, 0, "", ACCESS_NONE, 0};
    playTone(1000, 100); delay(100);
    playTone(1500, 100); delay(100);
    playTone(2000, 150);
}

UserCredential* authenticateCard(const char* cardId) {
    for (int i = 0; i < NUM_USERS; i++)
        if (constantTimeCompare(cardId, userDatabase[i].cardId))
            return &userDatabase[i];
    return NULL;
}

bool authorizeAccess(AccessLevel userLevel, AccessLevel required) {
    return userLevel >= required;
}

void requestAccess(int zoneIndex) {
    if (zoneIndex < 0 || zoneIndex >= NUM_ZONES) return;
    const char* cardId = testCards[secState.currentCardIndex];
    AccessZone* zone = &accessZones[zoneIndex];

Serial.println("\n=== ACCESS REQUEST ===");
    Serial.printf("Card: %s -> Zone: %s (Requires: %s)\n",
        cardId, zone->zoneName,
        accessLevelToString(zone->requiredLevel));

// Step 1: Check lockout
    if (secState.isLocked) {
        unsigned long remaining =
            (secState.lockoutEndTime - millis()) / 1000;
        Serial.printf("BLOCKED: Locked for %lu more seconds\n",
            remaining);
        logAuditEvent(cardId, "LOCKED_OUT", "ACCESS_BLOCKED",
            zone->zoneName, false, ACCESS_NONE);
        indicateSystemLocked();
        return;
    }

// Step 2: Authentication -- who are you?
    UserCredential* user = authenticateCard(cardId);
    if (user == NULL) {
        secState.failedAttempts++;
        Serial.printf("AUTH FAILED: Unknown card (%d/%d)\n",
            secState.failedAttempts, MAX_FAILED_ATTEMPTS);
        if (secState.failedAttempts >= MAX_FAILED_ATTEMPTS) {
            unsigned long lockTime = LOCKOUT_DURATION_MS +
                ((secState.failedAttempts - MAX_FAILED_ATTEMPTS)
                 * LOCKOUT_ESCALATION_MS);
            if (lockTime > MAX_LOCKOUT_DURATION_MS)
                lockTime = MAX_LOCKOUT_DURATION_MS;
            secState.isLocked = true;
            secState.lockoutEndTime = millis() + lockTime;
            Serial.println("!!! BRUTE FORCE LOCKOUT !!!");
        }
        logAuditEvent(cardId, "UNKNOWN", "AUTH_FAILED",
            zone->zoneName, false, ACCESS_NONE);
        indicateAccessDenied();
        return;
    }
    if (!user->isActive) {
        logAuditEvent(cardId, user->userName, "ACCOUNT_DISABLED",
            zone->zoneName, false, user->accessLevel);
        indicateAccessDenied();
        return;
    }

// Step 3: Authorization -- what can you do?
    if (authorizeAccess(user->accessLevel, zone->requiredLevel)) {
        Serial.printf("ACCESS GRANTED: %s -> %s\n",
            user->userName, zone->zoneName);
        secState.failedAttempts = 0;
        secState.lastAuthenticatedUser = user->userName;
        secState.currentAccessLevel = user->accessLevel;
        logAuditEvent(cardId, user->userName, "ACCESS_GRANTED",
            zone->zoneName, true, user->accessLevel);
        indicateAccessGranted(user->accessLevel);
    } else {
        Serial.printf("ACCESS DENIED: %s has %s, needs %s\n",
            user->userName,
            accessLevelToString(user->accessLevel),
            accessLevelToString(zone->requiredLevel));
        logAuditEvent(cardId, user->userName, "ACCESS_DENIED_AUTHZ",
            zone->zoneName, false, user->accessLevel);
        indicateAccessDenied();
    }
}

void handleLockout() {
    if (secState.isLocked && millis() >= secState.lockoutEndTime) {
        secState.isLocked = false;
        secState.failedAttempts = 0;
        Serial.println("Lockout expired -- system unlocked.");
        playTone(1000, 200); delay(100); playTone(1500, 200);
    }
}

void logAuditEvent(const char* cardId, const char* userName,
    const char* eventType, const char* zoneName,
    bool success, AccessLevel level) {
    AuditEntry* e = &auditLog[auditIndex];
    e->timestamp = millis(); e->cardId = cardId;
    e->userName = userName;  e->eventType = eventType;
    e->zoneName = zoneName;  e->success = success;
    e->attemptedLevel = level;
    auditIndex = (auditIndex + 1) % MAX_AUDIT_ENTRIES;
}

void indicateAccessGranted(AccessLevel level) {
    digitalWrite(LED_ACCESS_GRANTED, HIGH);
    digitalWrite(LED_ACCESS_DENIED, LOW);
    if (level == ACCESS_ADMIN) {
        digitalWrite(LED_ADMIN_MODE, HIGH);
        playTone(2000, 100); delay(50);
        playTone(2500, 100); delay(50);
        playTone(3000, 200);
    } else {
        playTone(1500, 150); delay(50);
        playTone(2000, 200);
    }
    delay(2000);
    digitalWrite(LED_ACCESS_GRANTED, LOW);
    digitalWrite(LED_ADMIN_MODE, LOW);
}

void indicateAccessDenied() {
    for (int i = 0; i < 3; i++) {
        digitalWrite(LED_ACCESS_DENIED, HIGH);
        playTone(400, 100); delay(100);
        digitalWrite(LED_ACCESS_DENIED, LOW); delay(100);
    }
}

void indicateSystemLocked() {
    for (int i = 0; i < 5; i++) {
        digitalWrite(LED_SYSTEM_STATUS, HIGH);
        digitalWrite(LED_ACCESS_DENIED, HIGH);
        playTone(300, 100); delay(100);
        digitalWrite(LED_SYSTEM_STATUS, LOW);
        digitalWrite(LED_ACCESS_DENIED, LOW); delay(100);
    }
}

void playTone(int frequency, int duration) {
    tone(BUZZER_PIN, frequency, duration);
}

void handleButtons() {
    unsigned long t = millis();
    if (digitalRead(BUTTON_SELECT) == LOW &&
        (t - lastButtonSelectTime) > DEBOUNCE_DELAY) {
        lastButtonSelectTime = t;
        secState.currentCardIndex =
            (secState.currentCardIndex + 1) % NUM_TEST_CARDS;
        Serial.printf("Card selected: %s\n",
            testCards[secState.currentCardIndex]);
    }
    if (digitalRead(BUTTON_ACCESS) == LOW &&
        (t - lastButtonAccessTime) > DEBOUNCE_DELAY) {
        lastButtonAccessTime = t;
        requestAccess(2);  // Default: Server Room
    }
}

void processSerialCommands() {
    if (!Serial.available()) return;
    String cmd = Serial.readStringUntil('\n');
    cmd.trim(); cmd.toUpperCase();

if (cmd == "HELP") printMenu();
    else if (cmd == "LOG")  printAuditLog();
    else if (cmd == "STATUS") {
        Serial.printf("Locked: %s | Fails: %d | Card: %s\n",
            secState.isLocked ? "YES":"NO",
            secState.failedAttempts,
            testCards[secState.currentCardIndex]);
    }
    else if (cmd.startsWith("ZONE "))
        requestAccess(cmd.substring(5).toInt());
    else if (cmd.startsWith("CARD ")) {
        int n = cmd.substring(5).toInt();
        if (n >= 0 && n < NUM_TEST_CARDS)
            secState.currentCardIndex = n;
    }
    else if (cmd == "RESET") {
        secState.failedAttempts = 0;
        secState.isLocked = false;
    }
}

void printMenu() {
    Serial.println("Commands: HELP STATUS USERS ZONES");
    Serial.println("  ZONE n | CARD n | LOG | RESET");
}

const char* accessLevelToString(AccessLevel level) {
    switch (level) {
        case ACCESS_NONE: return "NONE";
        case ACCESS_GUEST: return "GUEST";
        case ACCESS_USER: return "USER";
        case ACCESS_ADMIN: return "ADMIN";
        default: return "UNKNOWN";
    }
}

void printAuditLog() {
    Serial.println("\n=== SECURITY AUDIT LOG ===");
    for (int i = 0; i < MAX_AUDIT_ENTRIES; i++) {
        AuditEntry* e = &auditLog[i];
        if (e->timestamp > 0)
            Serial.printf("%8lu | %-16s | %-12s | %-13s | %s\n",
                e->timestamp, e->eventType, e->userName,
                e->zoneName, e->success ? "OK":"FAIL");
    }
}

Use the launch button above to open the ESP32 editor in Wokwi.
Select the editor’s diagram.json tab and replace all its text with the supplied diagram.json.
Select the sketch.ino tab, replace all its text with the supplied sketch.ino, then click Start Simulation.

Steps

Screens captured against Wokwi ESP32 Compiled and booted by the Wokwi gate (ESP32 Arduino core 3.3.11); captured in the Wokwi web editor on 2026-09-09 on 2026-09-09; the tool may have moved on — the text steps are the contract.

Step 1
Do
In Wokwi's project editor, paste the supplied diagram.json and sketch.ino into a new Wokwi ESP32 project. Trace each LED back to its GPIO and ground.
You will see
Input: inspect the running Wokwi diagram and its four LED paths. Green, red, yellow, and blue LEDs are visible above the ESP32. Each LED has a series 220 Ω resistor on the shared ground return. The sketch's GPIO 2, 4, 5, and 18 leads run to those indicators.
Why it matters
The four colours make controller outcomes observable in the model. The resistor limits simulated LED current in each path. The live Serial Monitor shows the access-control startup heading. A lit indicator can be compared with a later access decision.
Step 2
Do
On the Wokwi circuit canvas, trace the two pushbuttons and buzzer before starting.
You will see
Buzzer pin 2 connects to ESP32 GPIO19; pin 1 returns to ground (diagram.json lines 201, 207). Select-card button connects ESP32 GPIO15 to ground when pressed (diagram.json lines 213, 219). Request-access button connects ESP32 RX2/GPIO16 to ground when pressed (diagram.json lines 225, 231). The two buttons use separate input paths (diagram.json lines 213, 225).
Why it matters
The two grounded buttons make card selection and access requests separate later actions. The buzzer has its own GPIO19 output and ground return, so an audible decision can be checked independently of the four LEDs.
Step 3
Do
Start the simulation. Send STATUS in Serial Monitor at 115200 baud.
You will see
Input: send STATUS in the real Wokwi Serial Monitor. Startup heading: IoT ACCESS CONTROL SYSTEM v1.0. STATUS response: Locked: NO | Fails: 0 | Card: RFID_ADMIN_001. The circuit and this response appear together in the new capture.
Why it matters
The run begins unlocked with zero failures. The selected fictional card is RFID_ADMIN_001. STATUS identifies the current actor before a zone decision. The response is simulator output, not a real credential check.
Step 4
Do
On the Wokwi circuit canvas, briefly click Request access and release it.
You will see
ACCESS GRANTED: Alice Admin -> Server Room appears, with green and blue LED feedback.
Why it matters
The initial admin identity has the required role. Seeing a grant tests the complete input-to-output path, not just a successful lookup.
Step 5
Do
On the Wokwi circuit canvas, briefly click Select card once and release it; wait for Card selected: RFID_USER_001, then click Request access.
You will see
The selected card is recognized, but ACCESS DENIED: Charlie User has USER, needs ADMIN appears and the red LED flashes.
Why it matters
This is the host’s central distinction: authenticating Charlie does not authorize Charlie for every door.
Step 6
Do
Send ZONE 1 in Serial Monitor while the user card is selected.
You will see
Input: select the user card, then send ZONE 1 in Serial Monitor. The request names RFID_USER_001 and Office Area. Serial Monitor: Office Area requires USER access. Result: ACCESS GRANTED: Charlie User -> Office Area.
Why it matters
The selected user card meets this zone's USER requirement. The green grant indicator is lit in the capture. The decision is scoped to Office Area, not every zone. The real browser run distinguishes card selection from authorization.
Step 7
Do
In Wokwi's Serial Monitor, send LOG, inspect the grant and denial entries, then stop and restart the simulation and send LOG again.
You will see
The first log contains ACCESS_GRANTED and ACCESS_DENIED_AUTHZ rows. After restart only the SECURITY AUDIT LOG heading appears because the in-memory entries were cleared.
Why it matters
Evidence must survive the event it explains. This setup uses replayable fictional card strings and volatile logs; it does not implement the host’s fresh-nonce challenge-response protocol.

Chapter checks

These questions refer to the chapter’s examples. Use the return links to review their answers.

A smart-building controller correctly verifies every user's certificate, but once verified, every user can unlock every door and reconfigure the HVAC. Which control is missing?
Return to the chapter’s knowledge check
A challenge-response scheme uses HMAC over a strong 256-bit per-device key, but the verifier reuses the same challenge nonce for every device every hour. Why is this insecure despite the long key?
Return to the chapter’s knowledge check

Return to Authentication and Authorization · Browse Labs

Wokwi ESP32

Get the files

diagram.json

sketch.ino

Steps

1 Step 1

2 Step 2

3 Step 3

4 Step 4

5 Step 5

6 Step 6

7 Step 7

Chapter checks

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7