Device Provisioning Options with AWS IoT

Transcription

1 Device Provisioning Options with AWS IoT Philipp Sacha Specialist Solutions Architect IoT, Amazon Web Services 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

2 Endpoints Things Gateway/PLC Cloud AWS Enterprise Applications IoT SDK MQTT OPC-UA Edge Users IoT Users IoT with AWS IoT Partners Consulting / ISVs Amazo n Kinesis The picture can't be displayed. Enterprise Users Corp Apps Accenture, Aricent, ClearScale, CTP, Luxoft, Mobiquity, solstice, Storm Reply, Sturdy Networks, TCS, TrekIO, Cer t Amazon FreeRTOS Wi Fi Integrated Client Amazon FreeRTOS OTA Local Resources MQTT MQTT Local Comms Message Router Certificate Authority OPC-UA Adapter Device Shadow Local Resourc es Lambda Functions OTA AWS Greengrass MQT T Long-range Comms Message Broker Rules Engine Certificate Authority Device shadow AWS IoT Core Over-the-air (OTA) Updates Real-time Fleet Index & Search Batch Fleet Provisioning AWS IoT Device Management Scheduled or Ad-hoc Audit Detection Profiles Alerts Risk Mitigation AWS IoT Device Defender Data Pipelines Analytics Data Store Ad-hoc & Indepth Analysis Templated Reports AWS IoT Analytic s AWS IoT 1-click Amazon S3 Machine Learning Amazon QuickSigh t The picture can't be displayed. Amazon Redshift Amazon EMR AWS Lambda All AW S Platform Ayala, Bright Wolf, BSquare, C3IoT, Mnubo, PTC ThingLogix, Splunk, Connectivity Amdocs, Asavie, AT&T, Eseye, Soracom, TATA Communications Verizon, Gateway Adlink Technology, Advantech, MachineShop, Technicolor, Edge ARM, Broadcom, Digi, Expressif, Intel, MediaTek, Microchip, NXP, ST, TI, Qualcomm,

3 AWS IoT Starting To Explore

4 At Scale - How To Provision Devices? Architecture is developed How Do I onboard my devices??? Devices Secure device connectivity and messaging Fleet onboarding, management and SW updates AWS IoT Core

5 When a Device is Provisioned (Created in the device registry) Device certificate registered with AWS IoT Core (Certificate attached to the device) IoT Policy attached to the device through: Certificate Thing group

6 AWS IoT Provisioning Options API Calls Single Device Provisioning Bulk Device Provisioning Just-in-Time Provisioning Just-in-Time Registration IoT topic rule Lambda function

7 Device Onboarding API Using scripts with SDKs and call the API create-thing create-keys-and-certificate or register-certificate for BYOCA create-policy attach-principal-policy attach-thing-principal

8 Provisioning Template "Resources" : { "Parameters" : { "thing" : { "Type" : "AWS::IoT::Thing", "ThingName" : { "Type" : "String" }, "Properties" : { "SerialNumber" : { "Type""ThingName" : "String" }, : {"Ref" : "ThingName"}, "AttributePayload" : { "Location" : { "Type" : "String", "version" : "v1", "Default" : "WA "serialnumber" }, : {"Ref" : "SerialNumber"} }, "CSR" : { "Type" : "String } } "ThingTypeName" : "lightbulb-versiona", "ThingGroups" : ["v1-lightbulbs", {"Ref" : "Location"}] } }, "certificate" : { "Type" : "AWS::IoT::Certificate", "Properties" : { "CertificateSigningRequest": {"Ref" : "CSR"}, "Status" : "ACTIVE" } }

9 Single/Bulk Device Provisioning {"ThingName": "foo", "SerialNumber": "123", "CSR": "csr1"} {"ThingName": "bar", "SerialNumber": "456", "CSR": "csr2"} Parameters with device information are used in the provisioning template Single: on line as parameter to register a thing Bulk: multiple parameter lines in an S3 bucket

10 Device Onboarding JITP AWS IoT Own CA Own CA required Provisioning Template attached to own CA 1. Device connects to AWS IoT, device certificate gets registered 2. JITP provisions device according to the provisioning template

11 Device Onboarding JITR AWS IoT Own CA Topic Topicrule 1.Device connects to AWS IoT, device certificate gets registered 2.AWS IoT publishes message to $aws/events/certificates/registered/<cacertificateid> 3.Topic Rule is invoked 4.Topic Rule calls Lambda Function as action 5.Lambda provisions device Create thing Activate Certificate Create/Attach IoT Policy Attach policy to certificate Do more stuff

12 JITR vs. JITP JITR JITP Topic rule and Lambda function. No code, only body template Code must be written and maintained attached to CA Provisioning more complex: Device Easy provisioning: Device connects, connects, certificate registers with provisioning workflow run status PENDING_ACTIVATION, service automatically sends MQTT message, rule triggers Lambda, Lambda does provisioning and optionally more stuff Flexible, different policies for Static, same provisioning process for different devices can be every device created/attached. Information from/to the provisioning process can be put/read from other systems, etc.

13 Demo Time! 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

14 Please complete the session survey in the summit mobile app. 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.

15 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.