I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or encryption. I would like to add authentication to this so that only I can enter the house. I should be able to give friends/family access and revoke the access remotely (without being in Bluetooth range). I also would like to give other people (e.g. the cleaning lady) temporary access ("each Wednesday between 1pm and 5pm”). Since I would like to do this remotely I think I would need a server.
I remember the protocol Kerberos from my crypto class which seems like it would get the job done. But this seems overkill and not lightweight enough. I’m not sure whether Kerberos is the way to go and whether there are other protocols out there that would fit my needs?
I looked online to see what protocols the commercial smart locks (like August, Lockitron) use but couldn't find too much information on this.