Assumptions
- The IoT Device is actually a software installable on supported operating system, e.g. Windows or Linux. Lets named it Software-Device.
- The Software-Device is available to download by signed-up customers.
- Customers can manage fleet of their Software-Devices through some management panel.
- Downloading and installing Software-Device should be as maintenance-free as possible for end-customer.
- AWS IoT Core is going to be base platform.
Workflow
Customer downloads Software-Device, installs it on a computer and runs. When Software-Device is ran for the first time, it's not connected to the network yet nor the customer's account. The connection and management will be handled by AWS IoT but in order to connect to the AWS IoT the device has to have valid certificates.
The idea is to display some digit code that customer must enter in the management panel (it's like connecting Android TV to your Google Account - TV displays code that you enter on google.com/device). In the background system will identify device, attach to the customer's account and provision it (sets certificates, IoT endpoint and any additional configuration).
How this may look from technical perspective?
- Software-Device connects to the WebSockets first and send metadata including digit code that is displayed to the user
- When user enters the code in the management panel, some background job verifies if it's valid and certificates are generated and send to the Software-Device (via WebSocket connection)
- Device can connect to the AWS IoT using received certificates
- Customer can manage their device
The concern
I'm thinking about how to secure connection to the WebSocket when the device is not provisioned yet? What I came with for now:
- Do not secure this endpoint just set some rate limits.
- Set some token on build phase.
- Include some certificate into Software-Device sources (one certificate for all downloaded Software-Device by different customers).
- Generate custom build with dedicated certificate when download is requested (build take some time so this may be frustrating for the customer).
What do you think about it? How this should be handled properly or at least the best way as possible?