SecureFiware

Overview

End-to-end encryption

COAP Device to LWM2M IoT Agent encrypted communication

For the encrypted communication between the device and the IoT agent we've embedded a DTLS server feature in the lwm2m-node-lib source code that forwards any request to the plain-text lwm2m udp server via localhost network then forward the response back to the client. We designed this solution to be setup easily in the configuration .js file and is totally compatible with the lightweightm2m-iotagent as described here and also demonstrated on the PoC below. Notice that the other lightweightm2m-iotagent features are totally unnafected by this modifications. The dtls-proxy library was also developed by us and already have more than 300 downloads in the npm (search for node-dtls-proxy)

• Positive points:

  • Enables DTLS communication between UDP servers and UDP clients (of any kind) with minimal or none source code modifications.
  • Really quick to setup.

• Negative points:

  • A bit slower than a Pure DTLS solution.
  • The client requires dtls support or be able to run a software that implements the dtls proxy downgrade service.

• Links:

  • goldy - IBM Lightweight DTLS proxy
  • node-dtls-proxy

Orion ContextBroker and LWM2M IoT Agent HTTPS Communication and Support

For the HTTPS support on the Orion ContextBroker we've added a nginx container in the docker-compose.yml file that acts like a HTTPS reverse-proxy to the ContextBroker in HTTP context (SSL/TLS Termination), then we've modified the iotagent-node-lib used by the lightweightm2m-iotagent to support the ContextBroker in HTTPS context, the configuration can be setupt in the .js configuration file of the IoTa described here, also we modified the IoT Agent with a new feature that starts the NGSI server in HTTPS context too. the configuration can be easily set up in the .js configuration file of the IoTA as described here just like the https orion configuration.

Walkthrough

curl -X POST -k https://localhost:4041/iot/services \
  --header "fiware-service:light_control" \
  --header "fiware-servicepath:/light_control" \
  --header "Content-Type:application/json" -d  '{  
    "services": [
      {
        "resource": "/light_control",
        "apikey": "",
        "type": "Light Control",
        "commands": [],
        "attributes": [
          {
            "name": "On/Off",
            "type": "Boolean"
          }
        ]
      }
    ]
  }'

curl -X POST -k https://localhost:4041/iot/devices \
  --header "fiware-service:light_control" \
  --header "fiware-servicepath:/light_control" \
  --header "Content-Type:application/json" -d '{
    "devices": [
      {
        "device_id": "rasp1",
        "entity_type": "Raspberry",
        "attributes": [
          {
            "name": "On/Off",
            "type": "Boolean"
          }
        ],
        "internal_attributes": {
          "lwm2mResourceMapping": {
            "On/Off" : {
              "objectType": 3311,
              "objectInstance": 0,
              "objectResource": 5850 
            }
          }
        }
      }
    ]
  }'

$ udp2dtls 5687 localhost 5684

LWM2M-Client> create /3311/0
LWM2M-Client> connect localhost 5687 rasp1 /light_control
LWM2M-Client> set /3311/0 5850 On

curl -X POST -k https://localhost:1026/v1/queryContext \
  --header "fiware-service:light_control" \
  --header "fiware-servicepath:/light_control" \
  --header "Content-Type:application/json" \
  --header "Accept:application/json" -d \
  '{"entities": [{"id": "Raspberry:rasp1"}]}'

Contributors