Connecting devices to the Azure IOT Hub
Ulrich (Uli) Homann PRD232A Infrastructure Services
Security & Management Platform Services Hybrid Operations Compute Cloud Services Batch Remote App Service Fabric Web and Mobile Web Apps Mobile Apps API Management Logic Notification Hubs Developer Services Visual Studio Application Insights Azure SDK Team Project Portal Azure AD Connect Health Active Directory AD Privileged Identity Mngt Multi-Factor Authentication Backup Integration Biztalk Services Hybrid Connections Service Bus Storage Queues Analytics & IoT HDInsight Machine Learning Stream Analytics Data Factory Event Hubs Mobile Engagement Data SQL Database DocumentDB Redis Cache Search Tables SQL Data Warehouse Automation Operational Insights Key Vault Import/Export IoT Hubs Store / Marketplace Media & CDN Content Delivery Network (CDN) Media Services Site Recovery VM Image Gallery & VM Depot StorSimple Infrastructure Services Virtual Machines Windows Linux Containers Network Attached Storage BLOB Storage Azure Files Premium Storage Software Defined Networking Virtual Network Express Route Traffic Manager Load Balancer DNS VPN Gateway Application Gateway Datacenter Infrastructure (24 Regions, 19 Online) More than AWS and Google combined Azure IoT Reference Architecture
Devices and Data Sources Data Transport Device and Event Processing Presentation Data Visualization & Presentation Azure IoT Hub Provisioning API Solution Portal IP capable devices Device Registry Store Device State Store Agent Existing IoT devices Stream Event Processor Agent Gateway Storage Analytics/ Machine Learning Agent Low power devices Many aspects of connectivity
Microsoft Ignite 2015 4/26/ :24 AM Many aspects of connectivity Functionality Device-to-cloud telemetry, Cloud-to-device commands and notifications, Bulk uploads/downloads Security Device security, Cloud security, Channel security, Monitoring Identify malfunctioning devices when they cannot bereached directly Reach and customization RTOS/Linux/Windows/non-IP capable, Network/application protocols, Authentication schemes IoT Hub Cloud protocol gateway Field gateway 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Azure IoT Hub Communication Patterns
4/26/2017 Azure IoT Hub Communication Patterns 1 IoT Hub (Cloud Gateway) Protocol Adaptation 2 Direct connection (HTTP,AMQP) Cloud Protocol Adaptation(e.g. MQTT) Field Protocol Adaptation(e.g. DDS) Gateway-assisted (e.g.Bluetooth LE) Field Gateway Protocol Adaptation 3 RTOS, Linux, Windows, Android, iOS Devices Field Gateway 4 Device Connectivity & Management 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Azure IoT Suite SDKs Device-facing Platforms Languages Service-facing
For devices and field gateway Platforms RTOS (FreeRTOS) Linux (Ubuntu, Debian, Fedora, Raspbian, Angstrom) Windows 7/8/10 ARM mbed Android iOS Languages C, Java, C#, Javascript Service-facing For back-ends and cloud gateway Languages .NET C# Java Node Heterogeneous clients
4/26/2017 Heterogeneous clients Device libraries & SDKs for many platforms Multiple Language Bindings C And more Js Real-time operating systems 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Azure IoT Device SDK Enable simple, secure device cloud connectivity & management Client agent software for devices and gateways Libraries that OEMs/SIs/ISVs can use in new and existing systems Open source software framework Base Library Communication, Encoding, etc Gateway Library Gateway Sample Telemetry / Commanding Library Device Management Library Stream Processing Library OS & Protocol Support Operating systems: C Libraries & Protocols:
4/26/2017 OS & Protocol Support Operating systems: Debian Linux (v 7.5) Fedora Linux (v 20) mbed OS (v 2.0) Raspbian Linux (v 3.18) Ubantu Linux (v 14.04) Windows Desktop (7, 8, 10) Windows IoT Core (v 10) Windows Server (v 2012 R2) Yocto Linux (v 2.1) C Libraries & Protocols: Debian Linux (v 7.5) HTTPS, AMQP, MQTT Fedora Linux (v 20) HTTPS, AMQP, MQTT mbed OS (v 2.0) HTTPS, AMQP Ubuntu Linux (v 14.04) HTTPS, AMQP, MQTT Windows Desktop (7,8,10) HTTPS, AMQP, MQTT Yocto Linux (v 2.1) HTTPS, AMQP 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Connect a device to Azure IoT Hub
Azure IoT Developer Center Follow the Connect Your Device Workflow Specify your connection string Gateways Microsoft Ignite 2015 4/26/2017 11:24 AM IoT Hub
Cloud protocol gateway Field gateway 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Field Gateways Communication assistance Manage connectivity cost
Secure data flows edge cloud Protocol translation Data buffering Manage connectivity cost Data filtering Data batching/aggregation Device management Provisioning Updates Cloud Gateway - What is it?
Gateway for IoT Hub allowing bi-directional communication using aprotocol that IoT Hub does not support natively Provides MQTT implementation for Azure IoT Hub Supports MQTT inbound connectivity (device or field gateway) Based on DotNetty port of netty (http://netty.io) Efficiently manages connections to Azure IoT Hub Allows for other customer processing such as: Custom authentication Encryption / decryption Compression / decompression Cloud Gateway - Why Why Gateway? (vs direct support in IoT Hub)
There is a need to support 3rd-party, legacy or custom protocols MQTT isnt refined enough for use in distributed systems and often needscustomizations Why DotNetty High performance Good framework for implementing protocols Flexible programming model Easy to reason about code Connect your devices to Azure IoT Suite
Microsoft Ignite 2015 4/26/ :24 AM Connect your devices to Azure IoT Suite IoT Hub Event processing and insight (e.g. hot and cold paths) IP-capable Cloud protocol gateway Device business logic, Connectivity monitoring Field gateway PAN-devices Application device provisioning and management field cloud 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. IoT Hub endpoints Your IoT Hub Event processing (hot and cold path)
Build 2015 4/26/ :24 AM IoT Hub endpoints Your IoT Hub Event processing (hot and cold path) Device id C2D queue endpoint D2C send endpoint D2C receive endpoint device Device business logic, Connectivity monitoring C2D send endpoint Field GW / Cloud GW Msg feedbackand monitoring endpoint Device Device Device provisioningand management Device identity management IoT Hub management Device 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Device-to-Cloud Device-to-cloud messages
Microsoft Ignite 2015 4/26/ :24 AM Device-to-cloud messages Interface AMQP and HTTPS device-side endpoint AMQP service-side endpoint Device and service SDKs Compatible with Event Hubs Partitioned receiver, client check-pointing Integrations with Azure Stream Analytics, Storm, 100% compatible with Event Hubs receivers IoT Hub services for D2C Millions of simultaneously connected devices Per-device authentication Connection-multiplexing: C2D and D2C traffic Across multiple devices for gateway scenarios IoT Hub Device id C2D queue endpoint D2C send endpoint Device D2C receive endpoint C2D send endpoint IoT Hub management 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Device identity in IoT Hub
Microsoft Ignite 2015 4/26/ :24 AM Device identity in IoT Hub Identity registry Contains per-device security materials Individual device blocking No queries keep a device registry toquery by app-data Authenticated comms Label incoming telemetry Ensure identity of devices receivingmessages Custom AAD integration Master key for gateway scenarios Device provisioning orchestration IoT Hub (identity registry) Device registry (e.g. DocDB, SQL) Other (e.g. ERP) 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Accessing IoT Hub from cloud components
Authorization policies Each hub allows multiple policies Each policy grants a set of permissions Primary and Secondary keys Permissions DeviceConnect for any component connecting as a device (e.g. send D2C, receive C2D, ) ServiceConnect for back-end components (e.g. read D2C, send C2D, receivefeedback/monitoring) RegistryRead for provisioning components that have to read the hubs device identity registry RegistryWrite for provisioning components that have to modify the hubs identity registry A sample scenario Simulated wind turbine Provision device
Microsoft Ignite 2015 4/26/ :24 AM A sample scenario Simulated wind turbine Emits telemetry every second State machine (StartingStartedStoppingStopped) Provision device Device registry to query devices and trackprovisioning Device identity and key stored in IoT hub Device emits telemetry Event processor receives telemetry and updatesportal visualization Send commands Portal sends commands to devices Command lifecycle is stored in device registry Event Processor IoT Hub Device id C2D queue endpoint D2C send endpoint Device D2C receive endpoint C2D send endpoint IoT Hub management Device registry Command store Portal 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Consuming D2C events Code against SB msg API Use any event processor
SMSG Readiness 4/26/2017 Consuming D2C events Interactive path Cold path Hot path Blob Cleaning, normalization, logging Analytics C&N&L Service Bus Q/T Workers Code against SB msg API Easy event processor implementation Enable deduplication on Q Easy routing to different subcomponents Create SB Q/T based on expected throughput Use any event processor Easy to select only real-time data. Storm / Spark Custom code Azure Stream Analytics Run batches from blob Reuse existing batch code Easy with Azure Data Factory D2C event router IoT Hub 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Consuming D2C events Code against SB msg API Use any event processor
SMSG Readiness 4/26/2017 Consuming D2C events Interactive path Cold path Hot path Blob Cleaning, normalization, logging Analytics C&N&L Service Bus Q/T Workers Code against SB msg API Easy event processor implementation Enable deduplication on Q Easy routing to different subcomponents Create SB Q/T based on expected throughput Use any event processor Easy to select only real-time data. Storm / Spark Custom code Azure Stream Analytics Run batches from blob Reuse existing batch code Easy with Azure Data Factory D2C event router IoT Hub 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Consuming D2C events Code against SB msg API Use any event processor
SMSG Readiness 4/26/2017 Consuming D2C events Interactive path Cold path Hot path Blob Cleaning, normalization, logging Analytics C&N&L Service Bus Q/T Workers Code against SB msg API Easy event processor implementation Enable deduplication on Q Easy routing to different subcomponents Create SB Q/T based on expected throughput Use any event processor Easy to select only real-time data. Storm / Spark Custom code Azure Stream Analytics Run batches from blob Reuse existing batch code Easy with Azure Data Factory D2C event router IoT Hub 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Pattern: file uploads App creates link to new blob Device uploads file
Microsoft Ignite 2015 4/26/ :24 AM Pattern: file uploads App creates link to new blob Appends temporary token Device uploads file Directly to storage Using block blobs: Use small block sizes Minimizes failure rates on slow connections Enable resumes (Optional) send D2C alert Notification of completion IoT Hub App Blob Cold path C&N&L 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Cloud-to-Device Cloud-to-device messages
Microsoft Ignite 2015 4/26/ :24 AM Cloud-to-device messages Interface AMQP and HTTPS device-side endpoint AMQP service-side endpoint At-least-once semantics Durable messages Device acknowledges receipt(Send - Receive - Abandon OR Complete) TTL and receipts Per-message TTL Per-message positive and negative receipts Command lifecycle pattern Use correlated D2C for responses Use feedback information to retry Store command state in command registry IoT Hub Device id C2D queue endpoint D2C send endpoint Device D2C receive endpoint C2D send endpoint IoT Hub management Msg feedback and monitoring endpoint 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. In the sample scenario Portal Device Event Processor
Microsoft Ignite 2015 4/26/ :24 AM In the sample scenario Portal Sends commands to individual turbines Store command in store Device Accepts Stop and Start commands Commands are long-running, when completed/rejected a response is sent Event Processor Correlation-id to filter responses from telemetry Updates outcome on command registry A message could be sent to a SB T/Q to parallelize work among multiple instances EventProcessor IoT Hub Device id C2D queue endpoint D2C send endpoint Device D2C receive endpoint C2D send endpoint IoT Hub management Msg feedback and monitoring endpoint Portal 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Pattern: publish file App creates link to blob Device download file
Microsoft Ignite 2015 4/26/ :24 AM Pattern: publish file App creates link to blob Appends temporary token Device download file Directly from storage Using block blobs: Use small block sizes Minimizes failure rates on slow connections Enable resumes (optional) verify integrity Very important for software/config updates. IoT Hub App Blob 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Security Security and IoT- Considerations
Constrained resources Geographic Distribution and off premisedeployments Low or no physical security Scale The analog loophole Azure IoT Security Principles and Capabilities
Service AssistedCommunications : Reduceattack surface and establishmutual trust Device Monitoring andUpdates: Must monitor geo- distributed constrained systemsthat are updatable over the air Pattern to enable hyper-scalemessaging for reliable D2C &C2D using per deviceauthentication over TLS Secure ingestion of telemetrystream ( such as security eventsfrom devices) that can beanalyzed for security breaches& C2D can be used to pushupdates Azure IoT Security Principles and Capabilities
Capabilities and Guidance In Depth defense Platform vendor and Solutionbuilder to work together. AzureIoT services include, Azure AAD,Key Vault and Security Center Azure IoT Hub Security Service-side Communication
RegistryRead and RegistryReadWrite : Grant permissions to the Identity registry Service connect - Grants access to service-facing comms & monitoring endpoints Device Connect - Grants access to device-facing communication endpoints Device side communication Device Identity Registry - Each device identity has a user-specified deviceId with aset of security credentials and status flag to enable/disable connectivity Key Rolling- Two symmetric keys for each device to simply process of updating byusing these to send commands to the authenticated devices Device Provisioning- By associating an identifier to the physical device, creating acorresponding entry in Device identity registry and securely distribute sharedaccess between IoT hub and Device (e.g. Storing security credentials duringmanufacturing) Other topics Cloud and field gateways
Microsoft Ignite 2015 4/26/ :24 AM Cloud and field gateways Use cases PAN-IP access Protocol translation IoT Hub capabilities Connection-multiplexing for multiple devices Individual device identities through gateway Extensible MQTT cloud gateway Patterns Transparent vs opaque Individual identities known to hub or not Pull vs push Individual devices acts as servers or maintainpersistent connection IoT Hub Cloud Gateway (MQTT, custom) Field gateway (OPC-UA, coAP,AllJoyn, ) 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Pattern: token service
Microsoft Ignite 2015 4/26/ :24 AM Pattern: token service Custom authentication Do not put a gateway in front of IoT Hub! Device requests token Token service perform custom auth E.g. using custom IDP Returns IotHub-specific token Using IoTHub key with DeviceConnect rights Device uses token with IoTHub Requests a new token from service if disconnected, orconnection is rejected Token service IoT Hub 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Advanced Topics Gateways and monitoring Cloud and field gateways
Microsoft Ignite 2015 4/26/ :24 AM Cloud and field gateways Use cases PAN-IP access Protocol translation IoT Hub capabilities Connection-multiplexing for multiple devices Individual device identities through gateway Extensible MQTT cloud gateway Patterns Transparent vs opaque Individual identities known to hub or not Pull vs push Individual devices acts as servers or maintain persistentconnection IoT Hub Cloud Gateway (MQTT, custom) Field gateway (OPC-UA, coAP,AllJoyn, ) 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Pattern: token service
Microsoft Ignite 2015 4/26/ :24 AM Pattern: token service Custom authentication Do not put a gateway in front of IoT Hub! Device requests token Token service perform custom auth E.g. using custom IDP Returns IotHub-specific token Using IoTHub key with DeviceConnect rights Device uses token with IoTHub Requests a new token from service ifdisconnected, or connection is rejected Token service IoT Hub 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. Monitoring device connectivity
Microsoft Ignite 2015 4/26/ :24 AM Monitoring device connectivity Feedbacks Device connection/disconnection events Device error reporting Event Hub-compatible endpoint Example Complex device blocking logic Stream Analytics job evaluates:number of failed connection attempts per device As a result device can be disabled in IoT Hub IoT Hub Device id C2D queue endpoint D2C send endpoint Device D2C receive endpoint C2D send endpoint IoT Hub management Msg feedback and monitoring endpoint 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. IoT Device Management Future Challenges The IoT Device Management Challenges
Device Provisioning and Bootstrapping Security/Identity Authorizing device to connect and be managed Discovery Discovering and describing device capabilities and data Device Management Service 1 Device The IoT Device Management Challenges
Device Provisioning and Bootstrapping Operating on devices Query devices for device state Define groups or logical topology Execute and track long-running actions (remote firmware/software update, remote restart, factory reset, ) Security - Ensure authority for users/admins operating on devices Device Management Service Operate on populations of devices 2 Device The IoT Device Management Challenges
Device Provisioning and Bootstrapping Operating on devices Integrating with specialized DM services Specialization through device management services that provide unique management scenarios Opportunity for OEMs to make services for their devices Device Management Service Operate on populations of devices Device 3 Your (or OEMs) DM Services Device The IoT Device Management Challenges
Device Provisioning and Bootstrapping Operating on devices Integrating with 3rd party services that already manage devices Device health and heartbeat Device health rules Alerts Device Management Service Operate on populations of devices Device 4 Device Health Alerts Your (or OEMs) DM Services Device The IoT Device Management Challenges
Device Provisioning and Bootstrapping Operating on devices Integrating with 3rd party services that already manage devices Device health and heartbeat DM Protocols Protocols: OMA LWM2M, OPC UA, OMA DM, CoAP, AllJoyn, Thread, TR-069, etc Device Management Service 5 Operate on populations of devices 5 Device Device Health Alerts Your (or OEMs) DM Services Device Complete your session evaluation onMy Ignite for your chance to win oneof many daily prizes. Continue your Ignite learning path
Microsoft Ignite 2015 4/26/ :24 AM Continue your Ignite learning path Visit Microsoft Virtual Academy for free online training visit https://www.microsoftvirtualacademy.com Visit Channel 9 to access a wide range of Microsoft training and event recordings https://channel9.msdn.com/ Head to the TechNet Eval Centre to download trials of the latest Microsoft products 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.