SAFE2小程序Pod IoT安全解決方案

描述

該項(xiàng)目旨在展示 Pod IoT 安全解決方案——SAFE2 小程序，可用于從云服務(wù)器以經(jīng)過身份驗(yàn)證的方式安全地獲取配置數(shù)據(jù)。

SAFE2 小程序是基于 GSMA IoT SAFE 理念的擴(kuò)展。該小程序旨在為最簡單且受限制的物聯(lián)網(wǎng)設(shè)備提供與服務(wù)器的雙向安全數(shù)據(jù)交換。

該解決方案適用于提高已部署項(xiàng)目的通信安全級別，在這些項(xiàng)目中沒有可用的免費(fèi)硬件資源來實(shí)現(xiàn)加密協(xié)議。

安全2

SIM 中的 SAFE2 小程序包含預(yù)共享密鑰模式下的 TLS1.3 協(xié)議的實(shí)現(xiàn)。SIM 不僅包含協(xié)議邏輯，還存儲唯一的預(yù)共享密鑰 (PSK)。SIM 能夠通過 OTA 命令以安全的方式進(jìn)行 PSK 更新。

SAFE2 部署架構(gòu)

?

SIM 存儲用于訪問服務(wù)器（物聯(lián)網(wǎng)平臺）的 url、端點(diǎn)和端口號。

SIM 負(fù)責(zé)所有協(xié)議步驟，包括域名解析和重復(fù)嘗試，直到請求被傳遞到服務(wù)器。

要通過 SAFE2 小程序從服務(wù)器獲取配置數(shù)據(jù)，設(shè)備應(yīng)用程序應(yīng)通過調(diào)制解調(diào)器中間件向 SIM 發(fā)送特定命令 - 用于通用 SIM 訪問的 AT 命令，即“AT+CSIM”。

首先必須打開補(bǔ)充邏輯信道（以免干擾調(diào)制解調(diào)器和基本信道中的 SIM 之間的 GSM 會話）。然后必須在新的邏輯通道中選擇小程序，并且應(yīng)向小程序發(fā)送特定命令以向服務(wù)器發(fā)起 HTTP GET 請求。每個(gè) GET 請求都包含 SIM 的 ICCID（SIM 卡的唯一標(biāo)識符）和 DeviceID，DeviceID 應(yīng)由 Device Application 提前提供。SIM 將建立 TLS 1.3 會話并以加密和認(rèn)證的方式將請求傳遞給代理。代理會將來自 SIM 的請求轉(zhuǎn)發(fā)到服務(wù)器，并將服務(wù)器的響應(yīng)轉(zhuǎn)發(fā)到 SIM。設(shè)備應(yīng)用程序應(yīng)輪詢請求的狀態(tài)并在數(shù)據(jù)可用時(shí)收集數(shù)據(jù)。

配置數(shù)據(jù)

配置數(shù)據(jù)應(yīng)通過 Luner IoT Suite 設(shè)置。

要創(chuàng)建配置，應(yīng)通過提供的憑據(jù)獲取訪問令牌。

設(shè)備 ID 是 Arduino MKR GSM 1400 板的唯一標(biāo)識符。scetch 包含提取設(shè)備 ID 并將其提供給 SAFE2 小程序的代碼。

ICCID 是使用的 SIM 卡的唯一標(biāo)識符。

“Body”包含將從 SIM 明文傳送到設(shè)備的配置。正文應(yīng)少于 255 個(gè)字符。

設(shè)備應(yīng)用程序應(yīng)能夠解析提供的配置數(shù)據(jù)。

配置開啟警報(bào) (LED)

?

執(zhí)行日志

下面提供的日志顯示了 2 個(gè)配置事件。設(shè)備啟動后 ( 23:36:58.376)，調(diào)制解調(diào)器返回注冊狀態(tài)“Registered in roaming” ( 23:37:05.412-23:37:14.656)。

23:36:55.420 -> MKR AT
23:36:55.420 -> B58D51C5504D5257352E3120FF0D1338
23:36:55.420 -> at
23:36:55.818 -> at
23:36:56.216 -> at
23:36:56.615 -> at
23:36:57.015 -> at
23:36:57.413 -> at
23:36:57.811 -> at
23:36:58.210 -> at
23:36:58.309 -> AT
23:36:58.376 -> OK
23:36:59.205 -> at+creg?
23:36:59.238 -> 0:0
23:36:59.238 -> cntr: 0
23:37:00.766 -> at+creg?
23:37:00.799 -> 0:0
23:37:00.799 -> cntr: 0
23:37:02.292 -> at+creg?
23:37:02.325 -> 0:0
23:37:02.325 -> cntr: 0
23:37:03.818 -> at+creg?
23:37:03.885 -> 0:0
23:37:03.885 -> cntr: 0
23:37:05.379 -> at+creg?
23:37:05.412 -> 0:5
23:37:05.412 -> cntr: 1
23:37:06.915 -> at+creg?
23:37:06.948 -> 0:5
23:37:06.948 -> cntr: 2
23:37:08.443 -> at+creg?
23:37:08.510 -> 0:5
23:37:08.510 -> cntr: 3
23:37:10.004 -> at+creg?
23:37:10.038 -> 0:5
23:37:10.038 -> cntr: 4
23:37:11.532 -> at+creg?
23:37:11.566 -> 0:5
23:37:11.566 -> cntr: 5
23:37:13.094 -> at+creg?
23:37:13.127 -> 0:5
23:37:13.127 -> cntr: 6
23:37:14.622 -> at+creg?
23:37:14.656 -> 0:5
23:37:14.656 -> cntr: 7
23:37:15.651 -> setup finished

設(shè)備 IDB58D51C5504D5257352E3120FF0D1338已提交給 SIM ( 23:37:16.017)，設(shè)備應(yīng)用程序發(fā)送了配置數(shù)據(jù)請求 ( 23:37:17.346)。

23:37:15.751 -> at+csim=10,"0070000001"
23:37:15.751 -> +CSIM: 6,"019000"
23:37:15.751 -> 
23:37:15.751 -> OK
23:37:15.884 -> at+csim=34,"01A4040C0CF0706F646773616665320101"
23:37:15.884 -> +CSIM: 4,"9000"
23:37:15.884 -> 
23:37:15.884 -> OK
23:37:16.017 -> at+csim=42,"01DA02C010B58D51C5504D5257352E3120FF0D1338"
23:37:16.017 -> +CSIM: 4,"9000"
23:37:16.017 -> 
23:37:16.017 -> OK
23:37:16.083 -> at+csim=10,"0070800100"
23:37:16.083 -> +CSIM: 4,"9000"
23:37:16.083 -> 
23:37:16.083 -> OK
23:37:16.083 -> Set Device ID: OK
23:37:16.183 -> at+csim=10,"0070000001"
23:37:16.183 -> +CSIM: 6,"019000"
23:37:16.183 -> 
23:37:16.183 -> OK
23:37:16.316 -> at+csim=34,"01A4040C0CF0706F646773616665320101"
23:37:16.316 -> +CSIM: 4,"9000"
23:37:16.316 -> 
23:37:16.316 -> OK
23:37:17.346 -> at+csim=10,"01CA000000"
23:37:17.346 -> +CSIM: 516,"6467736166653

比設(shè)備應(yīng)用程序每 15 秒 ( 23:37:32.429, 23:37:47.512, 23:38:17.672) 輪詢一次 SAFE2 小程序的狀態(tài)。

23:37:32.429 -> at+csim=10,"01CC020000"
23:37:32.429 -> +CSIM: 12,"000100009000"
23:37:32.429 -> 
23:37:32.429 -> OK
23:37:32.429 -> receiving state: 1
23:37:47.512 -> at+csim=10,"01CC020000"
23:37:47.512 -> +CSIM: 12,"000100009000"
23:37:47.512 -> 
23:37:47.512 -> OK
23:37:47.512 -> receiving state: 1
23:38:02.594 -> at+csim=10,"01CC020000"
23:38:02.594 -> +CSIM: 12,"000100009000"
23:38:02.594 -> 
23:38:02.594 -> OK
23:38:02.594 -> receiving state: 1
23:38:17.672 -> at+csim=10,"01CC020000"
23:38:17.672 -> +CSIM: 12,"000700009000"
23:38:17.672 -> 
23:38:17.672 -> OK
23:38:17.672 -> receiving state: 7

一旦狀態(tài)變?yōu)椤皵?shù)據(jù)可用”，設(shè)備應(yīng)用程序就會請求數(shù)據(jù) ( 23:38:17.938)，將它們?nèi)』?( 23:38:17.938) 并解碼 JSON 數(shù)據(jù)。配置已應(yīng)用，即 LED 已打開。

23:38:17.938 -> at+csim=10,"01CA010000"
23:38:17.938 -> +CSIM: 184,"7B22636F6E66696775726174696F6E223A7B2276657273696F6E223A22323032312D30352D3035222C22636F6E666967223A5B7B22616374696F6E223A22696F743A416C61726D222C22656666656374223A224F6E227D5D7D7D9000"
23:38:17.938 -> 
23:38:17.938 -> OK
23:38:17.938 -> received:90
23:38:17.938 -> {"configuration":{"version":"2021-05-05","config":[{"action":"iot:Alarm","effect":"On"}]}}
23:38:17.938 -> configuration version: 2021-05-05
23:38:17.938 -> iot:Alarm configured as ON

關(guān)閉補(bǔ)充邏輯通道后 ( 23:38:18.004) 設(shè)備應(yīng)用程序開始等待，并在 5 分鐘后 ( 23:43:17.836) 啟動下一個(gè)循環(huán)。在等待期間，服務(wù)器端的配置已更新以關(guān)閉警報(bào) (LED)。

23:38:18.004 -> at+csim=10,"0070800100"
23:38:18.004 -> +CSIM: 4,"9000"
23:38:18.004 -> 
23:38:18.004 -> OK
23:38:18.004 -> waiting.....
23:43:17.836 -> at+csim=10,"0070000001"
23:43:17.836 -> +CSIM: 6,"019000"
23:43:17.836 -> 
23:43:17.836 -> OK
23:43:17.970 -> at+csim=34,"01A4040C0CF0706F646773616665320101"
23:43:17.970 -> +CSIM: 4,"9000"
23:43:17.970 -> 
23:43:17.970 -> OK

設(shè)備應(yīng)用程序再次發(fā)送配置數(shù)據(jù)請求 ( 23:43:19.034) 并在第一次輪詢后 ( 23:43:34.102) 獲得響應(yīng)“數(shù)據(jù)可用”。在第二個(gè)循環(huán)中，請求的處理速度更快，因?yàn)?URL 已經(jīng)被 SAFE2 小程序解析和兌現(xiàn)。

設(shè)備應(yīng)用程序獲得了配置數(shù)據(jù)23:43:34.368。

這次配置包含“效果”：“關(guān)閉”并且 LED 已關(guān)閉。

在獲取配置數(shù)據(jù)結(jié)束時(shí)，補(bǔ)充邏輯通道關(guān)閉，下一次等待開始于23:43:34.435。

23:43:19.034 -> at+csim=10,"01CA000000"
23:43:19.034 -> +CSIM: 516,"6467736166653
23:43:34.102 -> at+csim=10,"01CC020000"
23:43:34.102 -> +CSIM: 12,"000700009000"
23:43:34.102 -> 
23:43:34.102 -> OK
23:43:34.102 -> receiving state: 7
23:43:34.368 -> at+csim=10,"01CA010000"
23:43:34.368 -> +CSIM: 186,"7B22636F6E66696775726174696F6E223A7B2276657273696F6E223A22323032312D30352D3035222C22636F6E666967223A5B7B22616374696F6E223A22696F743A416C61726D222C22656666656374223A224F6666227D5D7D7D9000"
23:43:34.368 -> 
23:43:34.368 -> OK
23:43:34.368 -> received:91
23:43:34.368 -> {"configuration":{"version":"2021-05-05","config":[{"action":"iot:Alarm","effect":"Off"}]}}
23:43:34.368 -> configuration version: 2021-05-05
23:43:34.368 -> iot:Alarm configured as OFF
23:43:34.435 -> at+csim=10,"0070800100"
23:43:34.435 -> +CSIM: 4,"9000"
23:43:34.435 -> 
23:43:34.435 -> OK
23:43:34.435 -> waiting