If you can be reasonably sure that an attacker will not be able to get access to the hardware/software, you could easily obfuscate the data so that it's hard to decipher.
Note that this technically security through obscurity; it is only safe as long as an attacker doesn't have the code.
- Uses the pseudo-random number generator of your IOT platform to generate a specified number of bytes.
- Compresses the extended message using whatever compression method your platform makes available.
- Removes the header that compression programs usually prepend to the output. (this is the obfuscation bit; compression headers are a dead giveaway)
- Sends it.
- Receives the message.
- Adds the header back to the compressed data.
- Uncompresses it.
- Discards the specified number of speudo-random bytes from the beginning of the message.
An example in Python 3:
In : from os import urandom
In : salt = urandom(8)
In : salt
In : message = "This is a test. Since I am not sure what the real message should be.".encode('utf-8')
In : combination = salt + message
In : import zlib
In : out = zlib.compress(combination)
In : to_send = out[2:] # Cut off the header
In : to_send # This is what is sent out.
In : zlib.decompress(b'x\x9c' + to_send)
Out: b'Wa=\xd4\xc0\x15^\xefThis is a test. Since I am not sure what the real message should be.'
In : zlib.decompress(b'x\x9c' + to_send)[8:]
Out: b'This is a test. Since I am not sure what the real message should be.'
As you can see, the message that is sent does not look like the original message!
Note that because of the pseudo-random salt, the compressed string changes a lot even when you send the same message multiple times.