We're at the early planning stage for a new cloud IOT solution and i'm looking for some guidance or direction for the high level architecture for our use case:

Assume we sell 10,000 edge devices to various customers which all connect to the cloud:

  1. As the manufacturer, we would like to gain insights from all devices (a read-only subset of APIs).
  2. Our primary customers may purchase 100's of devices, and their support departments will need full read/write access to all devices that they have purchased
  3. The end users of the devices may need full read/write access to a further subset of devices (ie the devices assigned to their department)
  4. Customers must not have access/visibility of any other customer devices
  5. (Bonus requirement) Some customers may purchase a support package from us (the manufacturer) which will allow us controlled read/writer access to their devices

I imagine this is a relatively common use case, but i can't find much about it when reading about the various offerings from Amazon, Google, IBM etc.

So, is this something that can be implemented within existing offerings? Or do we register all devices in one cloud, and then use a seperate system to manage our customers/users and their relative access permissions?

Security/privacy is one of my concerns and this has been addressed very thoroughly by each of the cloud providers, but this could be easily compromised by an additional system managing user access control policies.

I appreciate any feedback or direction.

  • why don't you ask Amazon, Google, IBM etc.? ... tell them exactly what you need and ask them to provide a price quote
    – jsotola
    Feb 25 '20 at 1:40
  • 1
    Thanks, that's the plan but I wanted to try and get educated first before starting that process. It may be that this isn't part of their core offerings, but i'm sure that they will try and sell me a service anyway.
    – Sam
    Feb 26 '20 at 9:42
  • If you're using MQTT and your company prefers to develop things in house, you can organize your MQTT topic hierarchy like companyA/departmentB/deviceC and then set ACLs on the topic hierarchy so that logins have specific read/write permissions at only the proper company or department and below.
    – JustinB
    Feb 26 '20 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.