Chapter 11. Product Life Cycle

 Managing devices in an IoT infrastructure is more complicated than just installing devices, finding them, and starting to communicate with them, as we did in the previous chapter. You need to manage the devices over their entire life cycle. Furthermore, if you're planning to host an open network of IoT devices, you need to make sure the owners of each device can manage their own devices. Otherwise, the operator of the network will quickly become overloaded with work managing other people's devices. Lastly, interaction between devices and other entities must also be done in a secure manner. This chapter presents a method for how to accomplish all these things. It covers:

• A definition of ownership of data
• Claiming things as your own
• Determining who is allowed to befriend your things
• Determining who can read your things
• Determining who can control your things
• Automatic decision support for things
• Transfer of ownership
• Decommissioning of things

Defining ownership of data

In recent years, the predatory exploitation of information on the internet has highlighted the problem that there's no clear definition of ownership of data on the internet. Huge corporations are pushing the big data paradigm to hoard as much information as they possibly can, in the hope that it can be mined in the future to create additional value. This value will obviously fall into the hands of the companies doing the hoarding themselves, not the original creators of the information being hoarded. While big data and data mining have their obvious valuable use cases, their drawbacks must be clearly understood to be effectively addressed.

While certain types of information are protected by different types of legislation, there's no generic legislation that can be used to define ownership of data, and control its use, as well as profit from its usage. There is intellectual property and copyright legislation to protect ideas and created content. Trade secrets, legislation...

Understanding provisioning

The major item still left to discuss, before we have an infrastructure where we can control ownership of the information it generates, is provisioning. Provisioning is the means to control who can access your devices, and do what with them.

The IEEE IoT Harmonization working group, which we presented in previous chapters, provides an extension to XMPP for provisioning. (This interface is based on legacy interfaces defined in XEP-0324.) The provisioning extension provides things with decision support in answering three main questions:

• Am I allowed to accept a presence subscription request from an entity?
• Am I allowed to be read by an entity, and if so, which data?
• Am I allowed to be controlled by an entity, and if so, which parameters?

The provisioning extension defines the concept of a provisioning server to which all things can ask the aforementioned questions when necessary. The provisioning server in turn makes sure to ask the owner, when the owner is available,...

Adding provisioning support to our devices

We are now ready to implement support for provisioning in our devices. We create two new projects, a SensorXmpp2 and an ActuatorXmpp2. We base these on the SensorXmpp and ActuatorXmpp projects, developed in the previous chapters. The Waher.Networking.XMPP.­Provisioning namespace, already made available in these projects, contains a ProvisioningClient class which will do most of the work. It supports both the device and owner interfaces of provisioning.

Note

Provisioning interfaces are published by the IEEE IoT Harmonization working group, introduced in Chapter 9, Social Interaction with Your Devices Using XMPP.

Searching for a provisioning server

For our purposes, we start with the device set of interfaces for provisioning. We add a member variable that will hold our provisioning client to both our SensorXmpp2 and ActuatorXmpp2 projects:

private ProvisioningClient provisioningClient = null;

When we search the components made available by the server to...

Managing the owner side

The ProvisioningClient instance allows you to create a GUI for the owner-side application that can be used to configure your network. When the device-side interface has requests, the owner side has corresponding events. The following events can be subscribed to, so as to listen for incoming questions from the provisioning server:

Event	Description
IsFriendQuestion	This event is raised when the owner needs to decide if a third party is allowed to subscribe to the device's presence or not.
CanReadQuestion	When the provisioning server needs to ask the owner if a third party is allowed to read one of its devices, this event is raised.
CanControlQuestion	When a new control operation is attempted, this event is raised to allow the owner to decide if it's allowed or not.

Note

Note that the owner does not need to be online when the device asks the provisioning server a question. The provisioning server keeps the message and sends it to the owner when the owner gets online.

Deciding...

Using tokens for identification

Devices, owners, or third-party services can use tokens to identify either a service, a device, or a user. These tokens are small and easy to distribute in distributed transactions. They can also be challenged: a process used to verify that a sender is allowed to use a given token.

To get a token, the corresponding entity registers a certificate with a public key with the provisioning server, and gets a token as a response. Anyone receiving a token can ask the provisioning server for the corresponding public certificate. But only the original sender of the certificate retains the private key. To challenge a token, a challenge message is sent to the sender of the token. If the token is resent from another source, the receiver of the challenge needs to forward the challenge to the original sender. The original sender can use the private key to respond to the challenge. Only the holder of the private key can do that. But anyone with the public key can verify that...

Testing provisioning

To test the provisioning capabilities of your devices, you can either develop your own GUI, or use the simple IoT Client available in the IoT Gateway GitHub repository. Setup files are available.

Note

The simple IoT Client can be downloaded from: https://github.com/PeterWaher/IoTGateway#clients

Note

For source code examples of how the owner interface is implemented, see https://github.com/PeterWaher/IoTGateway/blob/master/Clients/Waher.Client.WPF/Model/Provisioning/ThingRegistry.cs.

Provisioning your devices

When you open your IoT Client for the first time, you need to create a connection to an XMPP broker. This is done using the Connect to... command (the star icon). That allows you to create an account or connect to an existing account on an XMPP broker. Connect to the same broker your devices use, so that you can automatically use the same Thing Registry and provisioning server.

Once you're connected, you will see the Thing Registry and provisioning server component or components...

Summary

In this chapter, you've been shown the basic principles of how to add provisioning support to your devices, and how to control who can do what with your things.

In this chapter, you've learned:

• The fundamentals of ownership of information
• The basic principles of provisioning
• How to add provisioning support to your devices
• How to react to provisioning events
• How to manage your devices
• How certificates and tokens can be used for identification
• How to test your devices

In the next chapter, we will analyze how we can build even more powerful things, by analyzing the concept of concentrators, and how to manage multiple virtual devices inside a single physical entity.

 

The rest of the chapter is locked

Using tokens for identification

Devices, owners, or third-party services can use tokens to identify either a service, a device, or a user. These tokens are small and easy to distribute in distributed transactions. They can also be challenged: a process used to verify that a sender is allowed to use a given token.

To get a token, the corresponding entity registers a certificate with a public key with the provisioning server, and gets a token as a response. Anyone receiving a token can ask the provisioning server for the corresponding public certificate. But only the original sender of the certificate retains the private key. To challenge a token, a challenge message is sent to the sender of the token. If the token is resent from another source, the receiver of the challenge needs to forward the challenge to the original sender. The original sender can use the private key to respond to the challenge. Only the holder of the private key can do that. But anyone with the public key can verify that...

Testing provisioning

To test the provisioning capabilities of your devices, you can either develop your own GUI, or use the simple IoT Client available in the IoT Gateway GitHub repository. Setup files are available.

Note

The simple IoT Client can be downloaded from: https://github.com/PeterWaher/IoTGateway#clients

Note

For source code examples of how the owner interface is implemented, see https://github.com/PeterWaher/IoTGateway/blob/master/Clients/Waher.Client.WPF/Model/Provisioning/ThingRegistry.cs.

Provisioning your devices

When you open your IoT Client for the first time, you need to create a connection to an XMPP broker. This is done using the Connect to... command (the star icon). That allows you to create an account or connect to an existing account on an XMPP broker. Connect to the same broker your devices use, so that you can automatically use the same Thing Registry and provisioning server.

Once you're connected, you will see the Thing Registry and provisioning server component or components...

Summary

In this chapter, you've been shown the basic principles of how to add provisioning support to your devices, and how to control who can do what with your things.

In this chapter, you've learned:

• The fundamentals of ownership of information
• The basic principles of provisioning
• How to add provisioning support to your devices
• How to react to provisioning events
• How to manage your devices
• How certificates and tokens can be used for identification
• How to test your devices

In the next chapter, we will analyze how we can build even more powerful things, by analyzing the concept of concentrators, and how to manage multiple virtual devices inside a single physical entity.