Why I Built a $5 ESP32 Hardware Firewall to Stop Cyber-Physical Grid Attacks

`The Problem: Physics is Faster Than the CloudAs we rapidly deploy distributed high-voltage infrastructure—like public EV charging stations and autonomous drone landing pads—we are securing them exactly the wrong way. The industry standard relies on centralized cloud firewalls and heavy industrial controllers to authorize power delivery.But this creates a fatal vulnerability: Tight Coupling and Latency.If a threat actor breaches the central network and commands a fleet of remote chargers to draw maximum amperage simultaneously, the system relies on the cloud to detect the anomaly, encrypt a response, and send a "kill" command. That round-trip takes hundreds of milliseconds. In high-voltage AC engineering, a transformer or a drone's Li-Po battery can be fatally damaged in 50 milliseconds.You cannot outrun the physics of electricity with a cloud API.The Solution: A Hardware-Isolated Edge FirewallTo fix this, I designed a decentralized, physical air-gap mechanism using a simple ESP32. Instead of acting as a traditional software firewall that inspects packets, it monitors the physical physics of the charging cable.By placing the logic at the absolute edge—between the power grid and the vehicle—we reduce the attack surface to near zero.1. Rate-of-Change ($dI/dt$) Anomaly DetectionElectric vehicles and drone batteries use Battery Management Systems (BMS) to dynamically step power up and down. A simple static threshold (e.g., "trip if current > 32A") generates false positives.Instead, the ESP32 samples the instantaneous RMS current (using a PZEM-004T sensor) every 100ms and calculates the discrete derivative against a rolling window to ignore baseline noise. If the rate-of-change ($dI/dt$) exceeds the maximum allowable slew rate, the firewall recognizes a malicious overdraw attack.2. The Non-Blocking C++ LogicHere is the core C++ loop running on the ESP32. It uses millis() to ensure the dual-core processor can handle background TLS/MQTT tasks without ever interrupting the critical 100ms physical monitoring loop.C++void loop() {
// Latching failsafe: System halts on anomaly and requires physical reset

`
if (!isRelayClosed) {
// Wait for hardware/software interrupt
return;
}

unsigned long currentMillis = millis();

// Non-blocking 100ms polling interval
if (currentMillis - lastPollTime >= SENSOR_POLL_MS) {
lastPollTime = currentMillis;

float instantCurrent = readRMSCurrent(); // Poll UART sensor

// Calculate the previous window average to smooth noise
float windowSum = 0;
for (int i = 0; i < WINDOW_SIZE; i++) {
  windowSum += currentBuffer[i];
}
float windowAverage = windowSum / WINDOW_SIZE;

// Calculate derivative (dI/dt)
float deltaI = abs(instantCurrent - windowAverage);

// Anomaly Detection: Trip if spike exceeds safe BMS ramp
if (deltaI > MAX_DI_DT_THRESHOLD && windowAverage > 0.5) {
  digitalWrite(RELAY_PIN, LOW); // Drop the physical contactor
  isRelayClosed = false;

  Serial.println("\n!!!!! ANOMALY DETECTED !!!!!");
  Serial.print("Current spiked by: ");
  Serial.print(deltaI);
  Serial.println(" A/sample. GRID AIR-GAPPED.");
}

// Update the circular buffer
currentBuffer[bufferIndex] = instantCurrent;
bufferIndex = (bufferIndex + 1) % WINDOW_SIZE;

}
}
`

1. The Physical Failsafe (Latching)When an anomaly is detected, the ESP32 drops a relay connected to a heavy-duty AC contactor. The code deliberately executes a return; statement, locking the system into a "Halted" state.This prevents contactor chattering (where an attacker spams power spikes to rapidly open and close the relay, eventually melting and welding the switch closed). The charger remains completely air-gapped from the grid until a trusted human operator physically resets it.4. Optoisolated PCB LayoutTo ensure the 230V AC mains line can never arc and destroy the 3.3V ESP32 logic, the prototype strictly follows IPC-2221 standards. The high-voltage and low-voltage domains are physically separated by an 8mm clearance, bridged only by an optocoupler. To meet creepage requirements, a 2mm milling slot is routed entirely through the FR4 fiberglass board directly beneath the optocoupler.Why Simplicity WinsWhen we build massive, complex cybersecurity architectures, we inadvertently introduce zero-day vulnerabilities. An ESP32 running bare-metal C++ leaves an attacker almost no software surface to exploit. It does not care if the local network is jammed, spoofed, or taken down by a DDoS attack.Sometimes, the best way to secure a massive network isn't with more complex software. It’s with a simple, brutal hardware failsafe.What do you think?I am currently refining this architecture for upcoming technical challenges. I'd love to hear from fellow embedded devs and security engineers—how do you approach the gap between network security and physical infrastructure? Let me know in the comments.