Skip to content
Identity and Access Management

Streamlined Device Onboarding with bedrock - Device-id-cert-tools

Introduction

Efficiently onboarding devices to the Trimble Cloud Platform is crucial for seamless operation. This is possible now with the device-id-cert-tools module integrated within Bedrock. It offers a robust solution for simplifying device registration and certificate management starting from manufacturing to the devices on field. This tool provides a streamlined process for administrators, manufacturing lines, and devices, ensuring a smooth integration with Trimble’s IoT ecosystem.

Key Benefits

  • Simplified Registration: Easily register devices with the Trimble Cloud Platform (IAM and IoT) using standardized procedures.
  • Certificate Management: Provides seamless certificate rotation out of the box by leveraging Bootstrap Service.
  • Reduced Development Time: Firmware teams can focus on application development rather than setting up and developing foundational aspects.
  • Consistency Across Teams: This would adhere to F2C established standards / polices thereby ensuring security and consistency across devices.

Workflow Overview

The device-id-cert-tools facilitate a three-part workflow:

Prerequisite

Any devices running on Linux running the device-id-cert-tools base image. To setup, please access the bamboo server and flash wic.xz which should be the base image. Also run the corresponding “.raucb” to stay on the latest recommended firmware version. For more information please see the bedrock workshop deck which is demonstrated at TTC.

Below are the major workflows which happens as part of this onboarding:

Device Group Creation (Administrator flow)

Please see the “Creating Device Group” section of read me to know more. Also look on this section to know more about how to secure the credentials to be passed on to manufacturing line for device provisioning.

Device Registration (Manufacturing Line flow)

The manufacturing line can efficiently register devices in the IAM and Bootstrap APIs, linking them to the appropriate device group. Please refer to “Register Devices” section of read me to know more.

Certificate Request (Device flow)

Devices can request certificates from the Bootstrap API, securing their connection to the Trimble Cloud Platform. The utility running on the device is smart enough to look for any operational certificates and have it fetched freshly or rotated based on the current state.

Device Activation in IoT

Once the device has obtained its operational certificate, it can be activated in IoT for MQTT connectivity. Please refer to the IoT device activation step in the “Register Devices” section of read me. A reference implementation for connecting IoT devices to AWS IoT Core and Azure IoT Hub over MQTT using PKCS#11 with HSM (supports both SoftHSM and hardware HSMs like YubiKey) is available in both Python and C# .NET. For more details, refer to the Trimble IoT SDK repository.

Getting Started

To get a flavour of what about using device-id-cert-tools, follow these steps. Please reach out to cloud support or the bedrock chat space for any integration clarifications.

The ideal recommendation is to get the device-id-cert-tools base image and follow the steps so that all the required features are provided out of the box.

Please go through the bedrock certificate management to understand the internal of the utility. If at all, any desire to play with utility locally, please raise a request for accessing device-id-cert-tools repository and follow the read me sections to setup the environment and try various workflows from onboarding to operational certificate rotation.

Out of the box features

  • Secure storage of keys and certificates
  • Teams can create their own apps and host as container in devices
  • Utility enables applications to fetch device tokens by exposing local apis in devices so that applications running on devices need worry about accessing certificates and private keys.
  • Plan is to provide interfaces for MQTT, OTA and other core iot stuffs so that applications can leverage those capabilities to build the product.

Further Information

For more detailed information, refer to the “Bedrock Certificate Management” section in the Bedrock documentation: