I have an IoT device that I have set up to communicate with AES-256-GCM encryption. The working version has the encryption key stored in plaintext in a file on the device (this is going to be improved). Every time it is communicated with, a new key is included inside the encrypted message and the device updates its key to match it ready for the next message.
I would like to prevent someone from being able to communicate with a device, even if they have accessed everything on it.
I am thinking of setting up a (what, salt? hash?) which is sent to the device with each encrypted communication, which it adds/multiplies/hashes with something it has stored to create the password it can use to decrypt the communication. What should I look into to do this properly?
Good or bad idea?
I know it's highly discouraged to 'roll your own' when it comes to crypto, so I want to know whether taking this step would be considered well- or ill-advised.