Connecting any device or machinery to the most advanced communication network in the world, the internet, opens endless possibilities for the progress of human beings.

The realization of an interconnected world involves many different technologies and technical aspects, regulations, and even ethical principles.

In this chapter, you will learn about the whole architecture of an end-to-end Internet of Things (IoT) application, including the different software layers and the communication channels required between its various components. We’ll also analyze similarities and differences between the IoT and its industrial version, the Industrial Internet of Things (IIoT), and we’ll look at the Industry 4.0 concept and what digital transformation for industry implies.

This information is fundamental for understanding the IoT, IIoT, and I4, as well as for evaluating its impact on our daily lives.

Finally, we will cover the principles and benefits behind the open source licensing model adopted by Arduino and some approaches to protecting your intellectual property in the source code of your projects.

By the end of this chapter, you will be able to specify the technical requirements of a commercial IoT application that implements new digital business model patterns enabled by the IoT and is built on the Arduino IoT Cloud platform with respect to the Arduino trademarks.

In this chapter, we’re going to cover the following main topics:

• What is the Internet of Things?
• Benefits for users
• The enablement of different business models
• The architecture of an end-to-end IoT application
• Communication technologies and protocols
• Security aspects and device provisioning
• Open source

There is not a single official definition of the IoT, but the following sentence covers the concept in its entirety:

The Internet of Things or, briefly, IoT is the concept of connecting physical objects to a network and other devices to let them interact with each other and with human beings to share information and take action through the Internet.

These physical objects are electronic devices using different telecommunication technologies to connect to a network. It’s not surprising that the choice of network falls to the internet, not only because of the name of this technology but the characteristics of the internet itself:

• A digital network
• Worldwide coverage
• Standardized specifications
• Widely used for personal and professional communications

IoT devices are often called IoT Nodes because they are part of this network.

They feature sensors to detect or measure a physical property, such as the temperature of the environment or the speed of a vehicle. In other cases, they are connected to external machinery, devices, or appliances, always with the same purpose: collecting the values of physical properties, often called Telemetry Elements, and transmitting them to the internet. Once the values have reached the internet, they can arrive almost everywhere in the world in a few hundredths of a second.

You may think about interfacing an IoT node to an industrial machine to remotely transmit the information about its running conditions, and eventually alert a maintenance operator, in case of a fault. Or, connecting the node to your coffee machine to measure the level of the coffee grounds with the possibility to check it remotely while you are at the supermarket so that you can buy another pack only if required.

As a matter of fact, the IoT opens up the possibility to virtually infinite applications because connecting a device to the internet implies the possibility to both monitor the environment and send commands to the node remotely.

In fact, the telecommunication technologies used in the IoT are bidirectional and information can flow from the IoT node to the internet and vice versa. The interaction among IoT nodes is mainly related to the exchange of digital information by using the internet as the communication media.

Intelligence at the edge versus on the cloud

It’s important to underline that IoT nodes also have processing capabilities to different extents; they can be programmed to receive information from the internet and implement some logic accordingly.

Another example might help. You can interface IoT Node #1 to a weather station, collect information about the forecast, and transmit it to IoT Node #2 connected to your automatic irrigation unit. You may program Node #2 to prevent a waste of water in case rain is expected in the next few hours. Another node, Node #3, can embed a sensor and share the soil moisture value with Node #2 through the internet so that irrigation is activated, if necessary, when the forecast is good and the soil requires water.

This may not be relevant to my small garden, but you might consider the benefits in the case of extensive fields, where different areas may be irrigated depending on the crop’s requirements.

When the control logic is programmed directly on a node, we say that it is at the edge, referring to the edge between the physical and the digital world.

The logic can also be programmed on the cloud. In this case, there is an application running on a computer connected to the internet. In fact, the cloud empowers a huge number of computers connected together and to the internet with the aim of sharing computational and storage power, as well as balancing the computational load across multiple systems. With the on-the-cloud approach, the application on the cloud receives telemetry elements from one or more IoT nodes, aggregates the information, and defines the commands to send back to the same or other IoT nodes.

I talk about commands because IoT nodes can also be interfaced with actuators, such as motors, pumps, electro valves, electrical relays, and any other device responsible for moving and controlling a mechanism. This means that an IoT node can interact with the physical world by performing physical, programmed actions as a reaction to certain measures.

Considering the example of irrigation, the IoT node is electrically connected to a hydraulic servo valve and drives it to control the flow of water to the nozzles.

IoT nodes always implement embedded control logic to some extent, even when the intelligence of the application resides on the cloud. This is required to receive, interpret, and react to the commands from the application server on the cloud.

The distinction between on the edge and on the cloud is mainly related to the real intelligence of the application, such as the capability to understand when it’s necessary to irrigate on the basis of the forecast and the moisture of the soil.

So, intelligence on the edge is completely programmed on the node by writing software code in a structured language such as C++ or MicroPython, or adopting artificial intelligence models based on neural networks. With the on-the-cloud approach, it is the responsibility of application software running on a cloud server to decide to automatically trigger a valve.

The choice between on-the-edge and on-the-cloud implementations is mainly driven by the application and the required response time. Implementations on the cloud allow more freedom in terms of programmable features. This is because the cloud is composed of multiple servers working together and it has virtually no constraints of memory and computational power. On the other hand, deployments on the edge remove some bottlenecks related to the latency of communication networks, reducing the response time of an IoT node and allowing it to interact with the physical world in real time.

It’s worth noting that an implementation on the edge doesn’t preclude the benefit of implementing manual remote control of the nodes in addition to automatic control. For example, an operator could interact with the devices in the field through a graphical user interface visualized on a web page (called a dashboard). They would see the actual values of environmental conditions and could trigger the valve as they liked.

The programmer of the application is responsible for defining and configuring the dashboards, which can be as complex as required, with widgets to visualize and insert data such as graphs and textboxes, and trigger commands such as switches, sliders, pushbuttons, and many others.

The market sees an increasing number of on-the-edge applications for various use cases where microcontroller devices can be successfully adopted as control units of IoT nodes. This trend has led to the continuous, fast improvements in hardware components, with augmented computational capabilities and a consequent decrease in their cost, as well as the mass availability of wireless telecommunication technologies characterized by very low power consumption and long-distance transmission range.

When we consider the installation of IoT nodes in remote and not easily accessible areas, energy autonomy is a very important aspect: we want to reduce the need for battery recharging as much as possible to decrease the costs of human intervention. Ideally, a good IoT application is supposed to be fully autonomous!

When you adopt one of the Low-Power Wide Area Network (LPWAN) technologies, you need to consider that a decreased power consumption comes at the expense of a reduced quantity of data that can be transmitted with a single message and a higher interval between messages. It’s like considering data as a form of energy and applying the energy conservation law: if you decrease the power, you decrease the amount of data, not only the transmission range.

A decreased amount of data per message and a longer interval between two transmissions mean that you need to reduce the information exchanged with the cloud so that the cloud needs less time to collect all the values to process.

When this duration, which we may call Cloud Latency Time, is too long, then it’s worth implementing intelligence on the edge.

The Arduino ecosystem

It’s not possible to connect a single device to every type of sensor, actuator, external machinery, and device in the same way, because each element implements different electrical interfaces and ways to communicate.

Manufacturers produce IoT nodes, or components suitable for building IoT nodes, focusing on defined use cases and technologies, and adopting some of the various standards available on the market. Every person developing an IoT project has the responsibility to select the nodes with the best characteristics for their application. When a complete product with the required features is not readily available in the market, you may use electronic modules to build your IoT nodes as you like. This is where Arduino comes in handy.

We assume you know what Arduino is since you’re reading this book. Anyway, I think it’s worth mentioning that Arduino is not only a technology but an ecosystem maintained by the commercial business of the same name. The modular ecosystem is composed of electronic microcontroller based development boards, firmware, software libraries and tools to program boards and the cloud platform described in this book.

The Arduino team engineers every single component with particular attention to its usability and the user experience, according to the mission of the company, which is to “enable anyone to innovate by making complex technologies open and simple to use.” (M. Banzi, cofounder of Arduino).

It’s not surprising that the Arduino Cloud also follows the same approach, and you’ll see how easy it is to develop an IoT cloud application with the Arduino Cloud, without programming but configuring it. The ease of use of the Arduino Cloud is related to the native on-the-edge model: Arduino follows the technology trend of implementing the intelligence on the nodes, leaving the data storage and visualization tasks to the cloud.

You may still deploy an IoT solution on the cloud with the Arduino Cloud when you interface the Arduino Cloud with third-party services where the application logic and the intelligence are implemented.

Besides officially Arduino-compatible development boards, you can also use popular development boards such as the ESP32 & ESP8266 series development boards with the Arduino IoT Cloud. This feature helps the developer to use existing hardware solutions to migrate their products to the Arduino IoT Cloud without changing existing hardware technologies.

The other important aspect of the Arduino ecosystem is related to making technologies open. Most of the hardware and software produced by Arduino is publicly released under open source licenses, and by the end of this chapter, you will know the benefits and the obligations related to open source licenses and how to protect your intellectual property. Arduino also provides professional hardware devices for industry use, such as the Portenta series, which is specially designed for IoT and AI solutions. Arduino Opta Programmable Logic Controllers (PLCs) are the new product line in the PRO series, which is designed for industry deployment. For more details regarding the PRO series, please visit https://store-usa.arduino.cc/collections/pro-family.

The IoT, big data, artificial intelligence, and machine learning

We have seen that an IoT application involves the connection between the physical and digital worlds to create some sort of digital automation of physical processes. The outcome is the result of the following:

• Connecting devices to the internet
• Allowing devices to share information to interact and collaborate
• Implementing smart applications that can take intelligent actions

When we talk about digitalization, other buzzwords are often used together with the IoT: big data, artificial intelligence, and machine learning. These are complementary sciences that can be used to realize complex digital projects. We’ll describe what they are and how they are used in conjunction with the IoT next.

Big data refers to extremely large and complex datasets and to the science that studies how to process them. Traditional data processing software is unable to handle big data in a reasonable amount of time due to the size of the datasets and their unstructured and disaggregated nature, so dedicated technologies are necessary to extract valuable insights and knowledge used to support decision-making and strategic planning.

When we consider hundreds or thousands of IoT nodes sharing different values in real time, collected from the physical world, you may understand that the size and variety of the data require much more than a traditional database.

Big data involves an implementation of logic on the cloud. Even when an on-the-edge model is used for a fast response time in the physical world, data can be sent to the cloud for long-term processing without time constraints. Here, big data can be supportive.

For example, with reference to our example of smart irrigation, a node can use values from soil moisture sensors to control a hydraulic valve on the edge and also share information with a cloud application that uses data from multiple nodes to adapt a model for weather forecast considering, and also additional information from national weather stations.

You may consider big data as the cloud application processing raw data to extract and store valuable information.

Artificial intelligence and machine learning are often referred to as being the same science, but they are not. Artificial Intelligence (AI), is a broad field that encompasses many different subdisciplines, including Machine Learning (ML).

AI is the broader concept of machines being able to carry out tasks in a way that would normally require human intelligence, such as visual perception, speech recognition, decision-making, language translation, and others.

ML is a specific subfield of AI that focuses on enabling computers to learn from data and make predictions or decisions without being explicitly programmed to do so. Usually, ML involves training a model on a dataset and using the trained model to make predictions or decisions on new data.

In summary, AI is the broader concept of the mimicking of human intelligence by machines, while ML is a specific method/technique to achieve AI, which allows the machine to learn from data, instead of being explicitly programmed.

AI and ML models can be trained by using the data collected by big data tools and used to interpret other new data from the same or another big data platform.

Once trained, the models can be deployed on the cloud and on the edge as well, depending on their size and the technical features of the nodes.

While big data tools processes the data directly with analytical models, AI/ML works on patterns in data in order to recognize situations and trends.

For example, you can use big data to extract the trends of soil moisture in a wide region where thousands of sensors collect values every hour and big data can support you in distinguishing between daily, monthly, and seasonal changes over a period of years.

ML works differently; it ingests values of different types, such as weather forecast parameters, and identifies patterns that affect your observations. You may create an ML model by training a neural network with temperature, atmospheric pressure, humidity, wind speed, and soil moisture values across a period. Then you provide another set of data from a different period, without the soil moisture values, and the model is able to suggest indications about irrigation needs.

With reference to the following diagram, you may see the complete dataflow of a complex application, where the IoT senses the physical world, reacts immediately on the edge when required, and forwards the values to big data for offline or batch processing (not in real time):

Figure 1.1 – Data integration with other technologies

Big data stores and aggregates the values that are used to train and run AI/ML models. These models make decisions and send commands back to IoT nodes that interact with the physical world.

The IoT, IIoT, and I4.0

The IoT concept has been widely applied in different aspects of our lives and some applications are already part of our daily routines.

For example, you may buy a smart doorbell online for tens of dollars. This device integrates a microphone and a loudspeaker and connects to your Wi-Fi. This IoT node remotely alerts you on your mobile when someone rings, and it allows you to have a conversation with the visitor in front of your door, even if you are miles away from your house. With some models, you may even unlock the door.

Have you ever switched on a light in your house by asking Alexa®, Google Assistant™, or Apple’s Siri to do so? All those IoT nodes are examples of applications in the smart building and home vertical.

Advanced solutions manage air conditioning, windows, and curtains depending on the environmental situation, measured by presence detection, temperature, and sunlight sensors.

We’ve already introduced an application in the agriculture market, with others related to tracking live animals and their conditions by localizing them with GPS technologies and measuring their vital parameters. For example, a rapid heartbeat can be a symptom of stress due to overheating or the presence of a predator.

We all like to receive frequently updated tracking information about the shipping of our last online purchase. The online tracking of deliveries is also useful to freight forwarding companies to reduce the risks of complaints and the associated operative costs. All this is possible thanks to the usage of handheld devices connected to the internet and small IoT nodes attached to valuable goods, capable of sending their location wirelessly to a cloud application. Logistics is definitely one of the sectors where the IoT is successfully adopted, but the healthcare, retail, smart infrastructure, security, and surveillance markets also offer many examples of IoT applications.

The deployment of an IoT application in the industrial environment is commonly referred to as the IIoT.

IIoT applications mainly focus on collecting data from the physical world to better understand how to improve industrial processes, make better use of plants, and optimize the consumption of energy, water, human work, and other resources involved in activities.

The main target is an increase in performance and a reduction of costs in all departments.

Important note

This is not the place to cover the implications in terms of the workforce, but I would like to say that the IIoT doesn’t directly imply the reduction of operators, but their training and technical growth can be managed from a cost-reduction perspective when good, fair employment policies are adopted.

The adoption of the IoT principles in the industrial environment requires particular attention in the implementation and deployment of nodes because the environment can be harsher in terms of temperatures, vibrations, and electromagnetic pollution.

The overheating caused by higher temperatures in certain industrial environments causes failures in the electronic components of nodes and reduces their lifespan.

Vibration fatigue is another main cause of failures of electronic devices. The vibrations transfer to the electronic board when a node is installed in contact with a machine, and they apply stress to the components, resulting in early failure.

Industrial environments are quite dense with industrial motors in machinery, power cables, the cellular devices of operators, and other sources of electromagnetic fields.

The preceding aspects affect IIoT nodes only, while the application of the IoT to the industrial environment has other implications on the cloud side:

• Scalability: Cloud infrastructures for the IIoT typically require it to easily handle and store large amounts of data from a vast number of IoT devices
• Data security: The industrial market requires improved cloud security measures to protect against cyber threats to cloud applications and IIoT devices
• Data localization: One of the frequent requests from the industrial market is that all data remains confidential and confined to the local country

Several reasons justify a request for cloud data to remain in the local country. Data privacy and security concerns are evident when you consider that keeping data within a country ensures that it is subject to the jurisdiction and protection of local laws.

Furthermore, some countries have strict regulations regarding the storage and handling of sensitive data, and keeping it within the country helps organizations comply with these regulations.

Last but not least are considerations related to performance and cost-effectiveness: accessing data and applications stored in a remote location can result in slower performance and higher latency. Likewise, transferring data across international borders can be expensive and complex, making it more cost-effective to store data within a country.

Industry 4.0, known as the Fourth Industrial Revolution, is a broader concept than the IIoT and refers to the application of the IIoT specifically in smart factories for the production of consumer goods.

In this way, production processes are controlled and monitored in real time and digitalization empowers machines and devices to make decisions, freeing up human workers for higher-level tasks. This is a decentralized decision-making approach, where production is driven by data collected and analyzed by machines and devices in order to speed up a continuous improvement of the production processes.

Flexible manufacturing processes allow the mass production of customized products in batches of one pace having features defined by every single customer at the time of online shopping.

Industry 4.0 means connecting a fully automated factory to the internet to improve the customer experience and optimize the overall business performance.

Customers can go to their preferred online store to buy a pair of running shoes, select the model, choose the materials, configure the colors of the different parts, and place an order. After payment by credit card, the order digitally arrives at the factory, where robots and machinery are configured in real time to get material from the warehouse, produce your custom shoes, including printing your name on them and the box, and then return the box to the warehouse ready for shipment.

Not a single piece of paper has been printed throughout the whole process. The facility managers can consult metrics online regarding the performance of the factory and the customer receives their personalized shoes delivered at home.

This is not a dream, and it’s already possible with the manufacturer Nike®, famous worldwide.

Industry 4.0 requires a wider software architecture than the IIoT cloud.

You may consider that the IIoT cloud is already interfaced with the machinery and devices of a production plant in an IIoT application. Industry 4.0 additionally connects digital systems from the different departments of the business, including the following:

• Enterprise Resource Planning (ERP): To automate and manage core business processes for optimal performance
• Computerized Maintenance Management System (CMMS): To manage assets, schedule maintenance, and track work orders
• Warehouse Management Systems (WMSs): To support inventory and manage supply chain fulfillment operations

Here, we have discussed the IoT in detail, as well as cloud versus edge processing and AI implementations. We have covered some details about the Arduino ecosystem, including their PRO line of products. Later, we discussed the IoT, big data, artificial intelligence, and machine learning, including the IIoT, as they all are very important pillars in high-level projects. In the next section, we will discuss what benefits there are for users by implementing the IoT in daily life as well as in industry.

Applications based on these smart technologies offer huge benefits to end users such as automating tasks and making Things remotely controllable and monitorable.

The IoT and IIoT improve our efficiency by letting IoT applications optimize the usage of resources and allowing us to reduce costs. They also enhance our safety and security, because IoT devices can provide real-time monitoring and alerts.

Data collection and analysis by IoT nodes can be used to personalize our experiences and the augmented connectivity provided by IoT solutions creates new possibilities for communication and collaboration.

Finally, the IoT and IIoT enable new and modern business models, as we’ll see in the next section.

You may ask why all this is happening now and if it comes without a cost.

The history of the IoT can be traced back to the 1980s when the term was first used by British technology pioneer Kevin Ashton in a presentation about the potential for interconnected devices.

In the early 2000s, the development of wireless networking standards such as Bluetooth and Wi-Fi made it easier to connect devices to the internet and cellular connectivity became a consumer market.

Ten years later, major technology companies, such as Microsoft, Google, and Amazon, began to invest in IoT cloud platforms.

Today, after 40 years, the progress of software technology has made big data, data analytics tools, and cloud platforms accessible and affordable for most people. The internet is a predominant medium of communication and the decreased cost of electronics, together with ecosystems such as Arduino, has made the technology easy to use.

The IoT indirectly brings costs to businesses of every size because they need to seize the moment, adopt these technologies, and keep up with progress to remain competitive in the market.

The social impact of the IoT is related to the introduction of different behaviors and the risk of human beings losing some manual and practical capabilities. For example, people who used to travel by car before navigation applications were available on mobile phones had a certain sense of orientation; nowadays, this skill has almost disappeared.

The IIoT introduces the risk of misleading managers to think that these technologies support cost savings by reducing the workforce because everything is automated. Actually, the personnel need training to maintain, troubleshoot, and improve the new systems, and it’s important that business managers understand this.

In the end, it is the responsibility of everyone involved in an IoT project to consider the application and manage the social effects properly. It means that it’s also your responsibility, dear reader.

Joseph Turow, the Robert Lewis Shayon Professor of Communication at the Annenberg School for Communication at the University of Pennsylvania, said “Despite hacks and privacy issues, people will feel a need to keep connected, partly because companies will reward them for doing so (or make life difficult if they don’t)”.

This improved connectivity among Things and people has an immediate consequence on the evolution of the patterns of digital business models.

The following figure, from the whitepaper Business Models and the Internet of Things by the Bosch IoT Lab, shows the evolution of web technologies and what business models were enabled in the different phases:

Figure 1.2 – Evolution of web technologies

We are now fully in the Web 3.0 phase where the IoT requires a drastic shift of mindset in the creation and the capture of commercial value. The Business School of Harvard University spotted this change and highlighted a series of implications.

First of all, customers require their needs to be addressed in real time. The IoT even allows businesses to address emergent needs in a predictive manner.

The possibilities offered by the IoT change the product management processes during their life cycle. The obsolescence reduces and it happens over a longer time because new versions of a product are evaluated by considering aggregated information about usage, collected automatically from products themselves, and analyzed to identify the effective requirements. Furthermore, the proposed user experience is based expressly on the collaboration of the products with others, eventually manufactured by third parties.

This moves the value of the products in such a way that customers perceive more benefits in the personalization of the products and their features than in commodity advantages such as lower cost, higher quality, and immediate availability. Or, in the case of professional and industrial products, brand and ownership of the intellectual property.

The appreciation for the collaboration capabilities of IoT products also suggests manufacturers should invest resources in understanding how other ecosystems work and make money, with the aim of developing a certain level of compatibility, more so than making a big effort to leverage internal core competencies and existing resources and processes.

Once the features of the new version are identified and implemented, manufacturers can often update many products at the same time, and remotely over the air. This is one of the appealing services that can be offered as the intrinsic value of a product or a paid service for subscribers.

The increased possibility to offer additional services moves the path to profit in the business strategy. The new approach is the search for the optimal balance between immediate and recurrent revenues. Immediate revenues, related to the traditional core business, often require a lot of effort and large investments to scale the number of sold products. On the other hand, the activities required to establish and maintain a good service offering, based on IoT capabilities, guarantee recurrent revenues in time.

Business models enabled by the IoT

When you buy a mobile phone from one of the two or three main manufacturers, typically, you don’t pay the real value of the device itself, but the perceived value of the product. Many people are keen on spending more on a mobile that represents a status symbol, rather than on an anonymous model, even with the same features. The status symbol is a benefit perceived as product value.

In a similar way, we may calculate the price of an IoT solution on the benefits it provides, instead of its costs. For example, we may consider a smart building project for energy efficiency: the IoT system tracks and analyzes energy usage, automatically controls illumination in common areas, and allows the owner of a building to identify areas for improvement and reduce their energy costs.

According to this model, called outcome-based, a solution provider may propose the system for a percentage of the savings on the energy bills of the customer, plus the installation and removal costs. They maintain the property using their IoT hardware without selling it but, when they close the contract, they have created a source of recurrent revenue for a certain amount of time. At the end of the contract period, they remove and reuse the IoT products for another installation. In this way, the cost of the IoT hardware is an investment of the solution provider and, considering the product life cycle mentioned previously and the low level of wear of these devices, it can generate a good return.

Paying for the benefits provided doesn’t implicitly mean paying more than the value of the product, but it can still be convenient for both parties involved. This is the case with the pay-per-usage model. Going back to the smart irrigation example, farmers can then use the IoT application provided by the water company to water their crops, with charges based on the amount of water used. The goal is not to make money on the IoT device itself but to use the data produced by the nodes to track usage.

The asset-sharing model is a pay-per-usage model characterized by the fact that the asset monitored by the IoT nodes is shared among multiple customers. For example, in the last few years, many businesses have bought and rented electric scooters in many different cities in the world. The user enrolls on the provider’s platform and uses their mobile, connected to the internet, to start and stop the rental and enable the scooter accordingly. This is a very good example of an IoT application in the smart cities vertical: both the user’s mobile and the scooter are connected to, and interact through, the internet. In this case, the user pays for the benefit of riding in certain areas less than they would pay to buy their own scooter because they share the IoT product, the scooter, with the local community. The asset-sharing model is based on the concept of selling extra capacity to the market and solves the big concern that everyone has when buying expensive equipment: will I be able to utilize it to its maximum capacity?

When we talk about business models related to the sale of services, the subscription model is the most well known: the user doesn’t pay to own the solution, but they pay an amount regularly to use it. This model is usually adopted by companies offering smart home devices such as connected thermostats, security cameras, and smart locks. Customers pay a monthly or annual fee for access to the devices, as well as the ability to control and monitor them through a mobile app.

One type of IoT subscription business model with a growing trend in its adoption is asset tracking. The reduction in power consumption and dimensions, as well as the decreased dimensions and costs of IoT nodes, enable a progressive adoption to localize different assets they are attached to. In this case, the subscriber doesn’t pay for the IoT nodes but for regular access to the localization data and the movements of the assets.

The IoT supports the proposal of other kinds of services; for example, a predictive maintenance IoT solution enables the sales of a convenient maintenance service, where the contract is appealing to both the contractor and the customer. The contractor can keep their tariffs lower because they don’t need to schedule periodical visits to their customer: the system will inform them in advance to plan the intervention before it becomes urgent. At the same time, they can enlarge their customer base to justify the cost of the installed solutions.

A consultancy company can install an IoT solution to measure the performance of machinery in a production plant without stopping any machine because all data is collected by autonomous IoT nodes that don’t need interfaces to the existing plant. Data is used to measure the Overall Equipment Effectiveness (OEE) and suggest how to optimize the usage of the plant. In this case, the core business of the company is not the sale of IoT solutions, but the services deriving from the data collected by the IoT application.

The razor-blade business model in the IoT is similar to traditional models but with the added convenience and customization of IoT technology. The goal is to get the product in the customer’s hands, at cost or even less, to start selling your other products. The name comes from the company Gillette®, the inventor and first adopter: its main revenues come from the sale of the blades while razors are just the main source to bring about the sales of blades as one razor sold will generate multiple purchases of blades. In a similar way, HP® sells inkjet printers at a very low price with the aim of gaining revenues from the sale of the cartridges. The IoT can monitor the customer’s habits and suggest the optimal model for the consumable. It can also increase the probability of reordering because an order can be placed automatically by a device.

There are cases where businesses provide IoT applications with their hardware for free because its purpose is to monetize by collecting and reselling users’ data. This pertains to the situation involving driving habit monitoring devices. While these devices offer valuable insights to users, insurance companies derive significant benefits by analyzing driving patterns across a large number of individuals. Introducing this model can be seen as an expansion of your primary business, where you initially focus on addressing the needs of your end users and subsequently explore opportunities to generate revenue from their data. These two approaches can coexist harmoniously as long as you prioritize transparency with your customers regarding data usage and take necessary measures to safeguard their privacy.

In the preceding section, we have discussed what innovations and improvements end users benefit from due to smart products. The IoT has not only improved end users’ lifestyles but has also helped new business models to emerge, as well as helping industries to shift toward Industry 4.0, which helps industries run their production lines securely, quickly, and cost-effectively.

Now that we know more about the IoT, we have seen its principles and some examples of different applications, the time is good to dig more into the technical aspects with the analysis of the architecture of an IoT application.

We have already introduced IoT nodes, cloud platforms, and applications. A picture is better than a thousand words to explain how they work together and the following diagram shows the architecture of an IoT solution in its entirety:

Figure 1.3 – High-level architecture of an IoT system

There is an important difference between cloud platforms and cloud applications. Cloud platforms implement communication, user and device management, data storage and security, and other basic services; cloud applications implement the logic of the application, the dashboards, and all the specific aspects of the application.

In this sense, the Arduino IoT Cloud can be considered a cloud application running on the AWS cloud platform.

Thanks to the connectivity offered by the internet, you may set up even a complex IoT solution that features many different functionalities, just by exploiting multiple cloud applications, frameworks, and services already implemented by third parties and interconnected via the internet. This means that you don’t need to develop or configure everything from scratch and you may save time and headaches; it also explains the reason why multiple cloud platforms and cloud applications are visualized in the preceding figure.

Examples of these functionalities can be Single Sign-On (SSO), a user authentication service that allows a user to use one set of login credentials (e.g., name and password) to access multiple applications – such as social media platforms, and tons of others. You just need to decide what you need, search on the internet for the preferred provider, and easily integrate those features in your application without the need to program them. This is also valid for the Arduino Cloud platform, which offers a couple of different ways to interface with third-party applications, as we’ll see in Chapter 12.

The gateway is the last type of module we need to talk about. Gateways support the connection between nodes and cloud platforms. Or, more precisely, they are the bridge connecting nodes to the internet and allowing the exchange of data between nodes and cloud applications. There are many different types of gateways, characterized by the communication technologies they implement.

Your Wi-Fi router is a perfect example of a gateway: it’s connected to the internet and it accepts connections from other devices via Wi-Fi. It converts the Wi-Fi device into the data transportation technology of your internet provider (landline, Ethernet, or fiber-optic cable).

Gateways may also implement additional functionalities, such as data filtering, protocol conversion, and security. Every IoT application includes gateways in the architecture, even when they are not directly managed by you or the programmer of the solution.

Let’s consider an application with nodes using cellular connectivity. It may look like the nodes are directly connected to the internet, but it’s not the case. In fact, the nodes connect to the cellular network as well as dedicated gateways managed by the network provider. It’s important to clearly understand the presence of all the components in the architecture because each part can be a point of weakness in the case of an issue and can make the troubleshooting longer and more complex.

Data flows through a number of different devices during the back-and-forth between IoT nodes and cloud applications. These devices implement various communication technologies and protocols and the following diagram shows the most common choices:

Figure 1.4 – Communication technologies and protocols

In relation to the four main communication paths in the whole chain, the main distinction is related to the wireless or wired nature of the communication.

As per the preceding figure, the field-to-device path is usually wired: sensors, actuators, and devices connect to an IoT node thanks to wires. They pack and exchange data according to one of the standards for wired interfaces shown in the figure.

The device-to-gateway path can be wired or wireless depending on the technical requirement of the node for each specific application. Wireless IoT nodes offer the following benefits compared to wired IoT nodes:

• Mobility: Wireless IoT nodes are not restricted by physical connections and can be easily moved or relocated, providing more flexibility and freedom
• Ease of installation: Wireless nodes do not require cabling and can be installed much faster and more easily, reducing installation costs and time
• Scalability: Adding new nodes or devices to a wireless IoT network is easier and less expensive than adding wired nodes
• No infrastructure requirements: Wireless IoT nodes do not require a pre-existing wired infrastructure, making them ideal for remote or hard-to-reach locations
• Improved reliability: Wireless nodes are less susceptible to failure caused by physical damage to cables, making them more reliable for many IoT applications

However, it’s worth mentioning that wireless IoT nodes may suffer from interference from other wireless devices, limited range, and potential security issues, so it’s important to consider these limitations when choosing between wired and wireless IoT nodes.

For example, the IoT nodes for the load, vibrations, and structural monitoring of a bridge over a river, which respectively provide useful information about the maintenance, traffic balance, and improvement requirements, don’t need to be wireless. Many smart agriculture applications, on the other hand, benefit from long-range wireless technologies because of the difficulties and the installation costs of a wired network covering huge areas.

Considering the Kids park has a lot of IoT nodes, we can roughly divide the applications in the different market verticals into four main groups:

• Consumer devices with a very short transmission range: Wearables, safety devices, remote controls, and toys that typically use a Bluetooth or a Bluetooth Low Energy (BLE) connection to a mobile phone that shares the connectivity to the internet. This approach demonstrates the possibility of daisy-chaining multiple gateways with different technologies to reach the required connectivity.
• Consumer devices with a short transmission range: This is the case for home automation devices, such as the thermostat of your house or appliances, entertainment devices, personal instruments, and healthcare devices connected to the internet through a cabled Wi-Fi access point.
• Wireless professional devices: Automotive, smart agriculture, mining, and some logistics and outdoor industrial applications require very long-distance transmission ranges provided by the latest cellular technologies, which includes 3G/4G/5G or LPWAN.
• Wired professional devices: Some infrastructural projects, such as the monitoring of bridges and dams or indoor industrial projects, require wired nodes to increase reliability, increase the data throughput of the transmission, reduce the maintenance required for battery replacement, and increase data security.

The gateway-to-cloud link is wired in most IoT applications and, eventually, the gateway provides a backhaul wireless connectivity to the internet. This is the case of professional Wi-Fi and LoRa gateways that implement an Ethernet interface and also a cellular modem: the gateway automatically swaps to cellular if the Ethernet connection fails.

Defining the nature of the cloud-to-cloud communication path is a little bit trickier because we need to consider that cloud apps run on cloud platforms, and these are composed of servers interconnected to each other. The physical connection among the servers is definitely wired, but we may consider the logical connection between cloud applications wireless because, when compared to applications installed on a single server on the internet, wireless and wired IoT nodes offer the same benefits.

Figure 1.5 – Wired/wireless communication technologies

In this section, we discussed the high-level architecture of an end-to-end IoT application with multiple nodes, gateways, and the cloud. In the second part of the section, we discussed communication technologies and protocols, where we divided different communication technologies into wireless and wired mediums for better understanding. In the next section, we will discuss the security of IoT solutions, as well as device provisioning services, in detail.

In many applications, IoT devices collect and transmit sensitive data, such as personal information or financial data, which can be at risk of theft or unauthorized access if the data is not properly secured. Security must be a top priority in the design and implementation of any IoT application to ensure the safety and privacy of the data transmitted through the system.

The weakest link in the chain of IoT architecture in terms of security is the IoT node and the interface between the IoT device and the cloud.

I know that we said that there is always a gateway between the IoT node and the cloud. The fact is that the gateway implements all the communication layers for a reliable end-to-end communication channel between devices and the cloud. The node and the cloud are at the ends of this channel and, mainly at this layer, the data can be vulnerable to hacking, tampering, or unauthorized access, potentially compromising its security and privacy.

Hardware security

Attackers can exploit security vulnerabilities due to outdated or unpatched software, and this is even more probable when nodes are based on microcomputers running common operating systems. The probability decreases significantly when the node features a microcontroller that runs on bare metal as firmware, like in the case of the Arduino ecosystem. This is because the software running on the device is reduced to the minimum strictly necessary to run the device.

The adoption of strong data encryption algorithms on nodes protects the data transmitted over the network, making it less vulnerable to eavesdropping or tampering. In this case, too, the Arduino ecosystem demonstrates that it is a good choice for the implementation of an IoT application: Arduino devices for IoT embed secure elements, called crypto-chips, able to generate and manage security keys at the hardware level, without the need to include a password in the source code of the node application. We’ll see what this means and how it works toward the end of this section, but it’s now necessary to talk about another security risk related to IoT nodes.

That is inadequate access controls: some IoT devices with inadequate access controls may allow unauthorized individuals to access or control the device, potentially compromising the security of the system as a whole.

The access can be remote or even direct to the device to extract the original firmware from the device and overwrite it with a different version programmed by hackers. The extraction of the firmware could also be used just for replicating the functionalities of an original device on compatible but cloned hardware, threatening the results of an IoT business.

Arduino has engineered a safe version of their traditional bootloader to prevent these risks. A bootloader is the first software that is executed on the device and is responsible for loading the firmware and initializing the device’s hardware.

The Arduino Safe Bootloader adds a secure environment to the traditional bootloader by implementing mechanisms for firmware fail-safe authentication and secure updates. These prevent unauthorized access to the device’s firmware and ensure that only authorized firmware can be executed on the device.

An authenticity check of the firmware is based on digital signatures and guarantees security: the bootloader checks the digital signature of the firmware before loading it into the device’s memory and doesn’t proceed in the case of unauthorized or wrongly signed firmware, preventing the device from booting. In the same way, the safe bootloader protects against tampering, data corruption, and reverse engineering: it validates a new version of the firmware before overwriting the old one and can be configured to prevent the reading of the actual firmware from the device.

The programmer of the IoT node generates and manages their digital signatures, maintaining full control of the device, but excluding others at the same time.

I recommend the adoption of the secure bootloader in any IoT project because the minimal effort required to implement it is repaid immediately in terms of the security and integrity of the device and data.

Microcontroller-based nodes, with strong hardware encryption capabilities and secure boot mechanisms, address most of the security concerns on the node. Regular security audits ensure that the data exchanged between IoT devices and the backend systems is protected, while the providers of cloud platforms and cloud applications are responsible for securing the backend systems on the cloud that process and store the data by implementing secure data storage practices and regular backups, as well as regularly monitoring the systems to detect and respond promptly to potential security incidents.

Encryption for secure communication

Arduino considers the security of its IoT cloud and Arduino-based IoT nodes a top priority. The Arduino IoT Cloud requires connections with SSL/TLS encryption, and devices not implementing it cannot be provisioned to the cloud. The Arduino IoT Cloud regularly updates its security measures to address new threats and vulnerabilities and runs on the Amazon AWS platform, which has data centers and a network architecture built to meet the requirements of the most security-sensitive organizations.

The provisioning of IoT nodes refers to the process of configuring and setting up a device for operation and connecting it to a network or platform so that it can exchange data with it and interact with other devices. During this process, the device shall be configured with the information to establish a secure connection to the cloud and the cloud shall be configured to accept connections from the registered, well-known device and to manage the data exchanged with it.

Once the device is provisioned, it can connect to the cloud when required and exchange data in a secure way.

The SSL/TLS security protocols are the most adopted for secure communications on the Internet and use a combination of both symmetric and asymmetric encryption:

• Asymmetric encryption: Public-key cryptography, also referred to as asymmetric encryption, employs a set of public and private keys to perform encryption and decryption processes on data. In this method, the public key is utilized for encrypting the data, whereas the private key is employed for decrypting the data.
• Symmetric encryption, on the other hand, uses a single shared secret key to encrypt and decrypt data. It is faster and more efficient than asymmetric encryption but requires a secure method of exchanging the secret key between the client and the server.

In SSL/TLS, the initial handshake between the client and the server is performed using asymmetric encryption. The client and the server agree on a shared secret key, which is then used for symmetric encryption of the data transmitted between them. This approach provides both security and performance, making it a suitable encryption protocol for securing communications in IoT environments.

In the end, the device needs to know the public key for the SSL/TLS handshake and the cloud needs to know a unique device key or device identity to recognize the connection from a legitimate device. This data shall be configured during the provisioning phase for each IoT device that we want to deploy for our application.

The provisioning for a limited number of devices is usually manual or semi-automatic and is performed during the programming of each single device. In this phase, the programmer defines the unique identifier of their device and registers it on the cloud, then generates the security key on the cloud, and copies it to the device. It’s not a difficult process, but it may become complicated because different clouds have different architectures and ways to do this.

Bulk device provisioning

IoT solutions that require a medium or mass deployment of nodes usually adopt a fully automatic process that starts from the production of the electronics. The owner of the IoT solution provides a list of unique device identifiers and a security certificate to the manufacturer of the devices. The manufacturer assigns a device identifier from the list to each device, stores the certificate, and eventually flashes the application firmware on it, making each node ready to run out of the factory.

The Arduino IoT Cloud mainly provides semi-automatic provisioning, as we’ll see in detail in the next chapter. The user connects the device to a USB port of the programming PC and a web wizard is responsible for the rest of the job. The wizard recognizes the Arduino board model and flashes firmware on it responsible for the generation and storage of the security key on the crypto-chip. Finally, it completes the registration of the device on the Arduino IoT Cloud.

Even though the wizard does everything, I still consider this process semi-automatic; in fact, if you have multiple devices, you need to connect them to the USB one at a time. Actually, you may implement more automatic provisioning of Arduino boards on the Arduino IoT Cloud by programming a good script for Arduino CLI and using a smart USB hub that flexibly switches host connectivity between ports, but the topic is beyond this book.

Arduino PRO for commercial use cases

Arduino PRO can support businesses in their mass deployment by pre-provisioning devices during their production when several hundreds or thousands of devices are involved. You may contact the Arduino PRO team on the Arduino website and discuss your project with them.

We have already mentioned the crypto-chip a few times, so we’ll end this section by talking about this component. The crypto-chip, also known as a Secure Element or Trusted Platform Module (TPM), is a hardware component used to securely store and manage cryptographic keys and perform cryptographic operations. Having its own secure processor and memory, it provides a root of trust, meaning it acts as a foundation for secure operations on the device.

Storing the device’s unique identity, or a security certificate, in a secure element, as well as any other cryptographic keys used to encrypt and decrypt data, is much safer than writing them in the firmware or software code of the device. This is because the crypto-chip performs the cryptographic operations at the hardware level and the keys would not store on the hardware. Even reverse engineering activity wouldn’t be able to reveal sensitive information contained on the device.

In this section, we have talked about security aspects and device provisioning in detail. To address security issues, Arduino devices for the IoT embed secure elements, called crypto-chips. It is recommended to adopt a secure bootloader in any IoT project for better security. Use SSL/TLS for device-to-cloud communication, which will provide safe passage for your devices’ data for in/out operations. Next, we’ll discuss open source as we proceed with this chapter.

The concept of open source software and open source licenses was first introduced in the late 1960s and early 1970s by computer scientists and programmers who believed that the sharing and collaboration of software code would lead to better, more reliable, and more innovative software.

Arduino is considered to be one of the first companies in the world to adopt open source licenses for hardware engineering too. The company released the first version of the Arduino board in 2005, along with schematics for the board and the source code of the core firmware under an open source license.

This allowed anyone to use, modify, and redistribute the design freely, which greatly contributed to the success and popularity of the Arduino platform. The open source approach also enabled a community of developers and makers to collaborate and improve the platform, creating a wide range of libraries, tutorials, and projects that are still used today.

Benefits and obligations of different open source licenses

Open source licenses are legal agreements that define the terms and conditions under which licensed software or hardware can be used, modified, and distributed. There are several different types of open source licenses, each with its own set of terms and conditions, but the main concepts are generally the same.

Open source licenses generally retain the copyright of the software or hardware, but they allow users to use, modify, and distribute the code or design freely under certain conditions. Users are allowed to create derivative works (modifications) based on the original software or hardware, but these derivative works must also be made available under the same open source license, and a copy of the license must be distributed with the product.

Most licenses require credit to be given to the original authors when using or distributing the software or hardware and the acceptance of a disclaimer of liability that excludes any responsibility of authors and distributors for any damage or problems that may arise from using the licensed software or hardware.

Some of the main open source licenses that you may find in IoT projects are the following:

• MIT License: This is one of the most permissive open source licenses and allows users to use, modify, and distribute software or hardware for any purpose, including commercial purposes, without the need for attribution.
• GNU General Public License (GPL): This was the first widely recognized open source software license, released in 1989 by the Free Software Free Software Foundation.
• GNU Lesser General Public License (LGPL): The LGPL is primarily used for software libraries, although it is also used by some standalone applications. The LGPL was developed as a compromise between the strong copyleft of the GNU GPL and more permissive licenses such as the BSD licenses and the MIT License.
• Free Software Foundation (FSF): It is designed to ensure that software or hardware remains open source and free.
• Apache License: This is a permissive open source license that allows users to use, modify, and distribute the software or hardware for any purpose, including commercial purposes. However, users must provide attribution and must not use the original authors’ names or trademarks to promote their products.
• BSD Licenses, including the New BSD License and the Simplified BSD License: These are permissive open source licenses that allow users to use, modify, and distribute software or hardware for any purpose, including commercial purposes, without the need for attribution.
• Mozilla Public License (MPL): The MPL is a copyleft license that requires users to make any modifications to the software or hardware available under the same license, but allows them to add proprietary extensions to the software or hardware.

There are several benefits provided by an open source licensing model.

Open source licenses encourage collaboration and sharing, which can lead to faster innovation and better-quality software or hardware. Open source software or hardware engineering is often free, which can result in significant cost savings for users: they can modify the engineering and the products to meet their specific needs, without having to worry about proprietary restrictions. Open source brings an improved level of transparency and security because licensed products are reviewed and audited by many people, rather than just a few proprietary developers.

Arduino releases software and hardware under a combination of open source licenses. The Arduino Integrated Development Environment (IDE) software is released under the GPL v2 license; the hardware designs, including schematics and board layouts, are released under the Creative Commons Attribution Share-Alike license; while the software libraries are released under GPL v2, LGPL v2.1, and the MIT License, among others.

The protection of your intellectual property

The community of Arduino users appreciates the open source licensing model, for the benefits already mentioned earlier, while professionals still look with some reluctance at the adoption of open source for business purposes.

They may have concerns related to a lower or different level of support and maintenance that they can get compared to other proprietary products, but in many cases, they procure open source products because they compensate for that feeling with the cost savings of open source. A different thing is the consideration of intellectual property when releasing their own products: it is a critical barrier and, most of the time, professionals prefer to adopt proprietary licenses.

In my opinion, better knowledge of both the terms and conditions of the licenses and the available technologies would allow all professionals to opt in to open source, getting the benefits it provides without losing certain protection against unauthorized use or infringement of their proprietary solutions.

For example, not only may you protect the duplication of your open source IoT node just by adopting a secure bootloader, as we have seen, but you may also exploit open source software libraries without releasing the source code of your project and remaining compliant with the open source license.

In order to do this, you need to make a slight mind shift and consider your software as composed of two parts: the main software, which recalls the functionalities provided by third-party libraries, and your own proprietary library, with your know-how and proprietary technology.

If you structure your project by moving the intelligence of your device from the main application to the proprietary library, and the open source libraries provide their functionalities to the main application and not directly to your proprietary library, the game is done. In fact, your proprietary library can remain a binary library, without the need to publish its source code, and you need to publish the main application under open source and the binary code of your library only. Your main application doesn’t contain any strategic or valuable knowledge but is just a wrapping for calls and back-calls to your proprietary and third-party libraries.

Now, this approach requires some programming skills but you may get paid support from Arduino and its network of System Integrator Partners. These are industrial system integrators who joined a partnership program and are officially recognized by Arduino. This network also solves concerns about the after-sales support of Arduino-based IoT nodes and applications.

Respect for the Arduino trademarks in commercial applications

We have seen that the Arduino ecosystem fulfills all the requirements of an IoT application in terms of technical and licensing requirements. It’s now time to understand whether you can use it even for a commercial application without infringing any trademarks, incurring legal troubles.

Arduino technology is open source and you can copy an Arduino open source hardware design to further develop into your own product, but you must use your own brand name and logo for it.

You may use the Arduino software tools, such as the IDE, for free and as they are, to program the hardware even for commercial purposes.

If you would like to modify and further develop them, you may then redistribute them according to the included open source software license. So, the sale of derivative tools or their inclusion in commercial software products is not prohibited, but it may require modifications in order to be open sourced under the same license.

The usage of Arduino trademarks to identify hardware or software products not produced and maintained by Arduino is always forbidden. You may call them Arduino-compatible if you like and brand them with your own logo.

You may find many different success stories on the internet and the Arduino website of businesses that have successfully adopted the ecosystem for commercial IoT solutions in different verticals, respecting the principles mentioned here.

Some companies with large-volume projects have also successfully approached Arduino for co-branding or custom production licensing.

In the preceding section, we discussed the open source concept and discussed the details regarding different open source licenses and responsibilities while using these tools and related code in your projects. We also talked about intellectual property, which is very much related to commercial usage and preventing your product from being a copy or clone. This is the first chapter of the book and we have discussed in depth what the IoT is, its benefits, communication protocols and technologies, and a lot of other topics, giving you a broad overview of IoT architecture before starting the remainder of the book.

We have seen that two electronic devices can use the internet to interact with each other and exchange information, without the need for a direct physical connection between them. Nodes can be interfaced with other objects and cloud applications and this architecture allows the implementation of smart solutions in different markets and with huge benefits for users.

We’ve seen the architecture of an IoT solution, the different telecommunication technologies, and the security aspects involved.

We have talked about methods to protect your intellectual property against the duplication of your product and how to adopt open source libraries without the need to release your source code.

Finally, please respect the Arduino trademarks when implementing a commercial solution based on the Arduino ecosystem.

All this information is necessary to understand how things behind an IoT application work and for you to consider the right approach for your next IoT solution.

Before stepping into the next chapter, with the first example of an IoT project based on the Arduino IoT Cloud, it’s worth recapping the main steps to engineer a good IoT solution:

1. Identify the application and define the business model.
2. Determine the requirements and goals of the IoT application.
3. Identify on the edge versus on the cloud and structured code versus AI/ML model requirements.
4. Select the most appropriate telecommunication technologies.
5. Choose the appropriate hardware for the IoT node.
6. Select the provisioning mode according to the size of the project.
7. Develop the software for the node and configure the cloud, as we’ll see in the following chapters.
8. Deploy the application and periodically monitor performance and security.