Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Achieve device provisioning during production (CA-289) #180

Closed
albatros96 opened this issue Apr 28, 2023 · 14 comments
Closed

Achieve device provisioning during production (CA-289) #180

albatros96 opened this issue Apr 28, 2023 · 14 comments

Comments

@albatros96
Copy link

albatros96 commented Apr 28, 2023 •
edited
Loading

Hello,

Synthesis

We'd like to know how to achieve the provisioning step during production.

Details

I'm using the example tls_mutual_auth with AWS platform.
I've been able to use a device with certificates and key uploaded as binary hardcoded text files (the standard way).

Now, I suppose we will do a next step soon and we'll need a production provisioning. In other words, I cannot simply adjust everytime the private key, the device ID and the device certificate.

We need a way which enables us to gain provisioning of a lot of devices.
So I saw this README file related to digital signature that seems to explain how to use configure_esp_secure_cert.py in order to create a special partition where the certificates will be flashed.
However I'm not sure this will work, because I won't modify the device ID.

Question

  1. Is there a more accurate way to gain the same result for production? Should I look at fleet provisioning?
  2. If yes, could you provide me docs/explanation for Espressif?
  3. If no, is this way correct or it needs other steps?

I hope I've been clear. Thank you.
@github-actions github-actions bot changed the title Achieve device provisioning during production Achieve device provisioning during production (CA-289) Apr 28, 2023
@SolidStateLEDLighting
Copy link

YES -- and "not really". Espressif doesn't document fleet provisioning other than publishing a demo project. On the up-side, fleet provisioning is nothing more than subscribing, publishing, and unsubscribing to topics. Once you understand it -- the idea is fairly simple.

The tricky part is getting AWS set up with certificates, roles, policies, and the provisioning template. AWS does publish all the information that you need, but getting it all sorted out is a challenge.

@albatros96
Copy link
Author

YES -- and "not really". Espressif doesn't document fleet provisioning other than publishing a demo project. On the up-side, fleet provisioning is nothing more than subscribing, publishing, and unsubscribing to topics. Once you understand it -- the idea is fairly simple.

Thank you, I've just read how to perform fleet provisioning. I agree with you, it is a challenge conveyed by production necessity.
However starting to use fleet provisioning requires to set-up the properties on the AWS portal.
I'll try to go ahead and I'll update you.

If there are other suggestions, I'll be pleased to receive them.

@SolidStateLEDLighting
Copy link

I may have some suggestions. Can you give me an idea of what you are working on? I'm assuming this is a commercial product of some type? You can communicate with me privately if you like -- here is my e mail address Keith at SSLEDLighting dot com.

@albatros96
Copy link
Author

@SolidStateLEDLighting after a week we have a clearer idea of what we want. Thank you for giving me you e-mail address!

Here the fact: our customer wants to create an application in order to achieve the fleet provisioning by trusted user.
Of all the possibilities, this is the one that seems more "user friendly" but it is also a complication on our side.

First of all, there isn't an official example to achieve this provisioning. The fleet provisioning example is by claim.
I understood that the claim of credentials is performed either by CreateCertificatefromCsr() if by claim (the example), or by CreateKeysAndCertificate() if by trusted user.

Is there any sort of documentation (or better working example) to understand the implementation of fleet provisioning by trusted user?

@SolidStateLEDLighting
Copy link

SolidStateLEDLighting commented May 9, 2023 via email

@albatros96
Copy link
Author

Gosh, it has been a while since I have read up on all this -- but, if my memory serves me well enough -- I think that "trusted user" was someone walking out to the field with a piece of hardware and provisioning a device through a physical connection??? This is the circumstance where the product leaves the factory but must be provisioned physically after delivery?

It is partially true: the device will exit from production as non-provisioned. The end user then will use a mobile application (ad-hoc) which will complete the provision step. This can be done via Wi-Fi, BLE or USB.

However at the moment I don't know how to proceed inside the aws SDK.

@SolidStateLEDLighting
Copy link

SolidStateLEDLighting commented May 9, 2023 via email

@albatros96
Copy link
Author

You haven't answered the important question. Why would the client NOT want the unit to self-provision at the factory?

It's a matter of security, in fact fleet provisioning by claim is less secure.
Also, it's a matter of complication: a provisioned device means it has been already registered by using unique private key and certificate.

@SolidStateLEDLighting
Copy link

SolidStateLEDLighting commented May 9, 2023 via email

@albatros96
Copy link
Author

It looks just like "provision by claim" except that the first credential is delivered by phone app and is only good for 5 minutes. Everything else looks exactly the same to me. The publishing topics and chronological order of steps are identical once the phone app delivers the first credential. K.

Do you mean I should only manage the exchange of the credentials between the smartphone and the IoT device (and the remaining part is like fleet provisioning by claim)? Is there any built-in function of the AWS SDK which is able to handle this step?

Thank you for your patience.

@SolidStateLEDLighting
Copy link

SolidStateLEDLighting commented May 15, 2023 via email

@albatros96
Copy link
Author

However, I were doing it, I think I would start with the Unified Provisioning tool and build on that. That code normally is used to securly deliver Wifi credentials from phone to device -- but it could delivery anything. Most of the code you will want is publically available.

Nice to know! Now I have a starting point I can look at!!

The easiest way forward is likely convincing your client that they don't need provisioning by trusted user???

Unfortunately I can't do this in my position. I think it will be a challenge to implement this provisioning but I hope I'll make it work 😊

Thank you, at the moment I'm not implementing the code and I was trying to find as much informations as I can.

@martmalo
Copy link

@filgra96 Hey, I'm currently in the provisioning phase and cannot decide what to choose. I wanted to know what you ended up choosing and what worked best for you?

@albatros96
Copy link
Author

@filgra96 Hey, I'm currently in the provisioning phase and cannot decide what to choose. I wanted to know what you ended up choosing and what worked best for you?

In my case the customer choose the provisioning by using an external application.
I'm closing this issue, I'll reopen it if necessary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@SolidStateLEDLighting @martmalo @albatros96