08-03-2018, 02:33 PM
EdgeX Adds Security and Reduces Footprint with “California” Release
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/edgex-adds-security-and-reduces-footprint-with-california-release.jpg" width="1687" height="883" title="" alt="" /></div><div><div><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/edgex-adds-security-and-reduces-footprint-with-california-release.jpg" class="ff-og-image-inserted" /></div>
<p><span><span>The Linux Foundation’s</span><a href="https://wiki.edgexfoundry.org/display/FA/California+Release#CaliforniaRelease-TargetPerformance"><span> </span></a><span>EdgeX Foundry announced its </span><a href="https://wiki.edgexfoundry.org/display/FA/California+Release#CaliforniaRelease-TargetPerformance"><span>second major EdgeX release</span></a><span> of its EdgeX IoT middleware for edge computing. The “California” release adds security features including reverse proxy and secure credentials storage. It’s also rewritten in Go to offer a smaller footprint This makes it possible to run EdgeX on the Raspberry Pi 3, which has been chosen as the official target platform for California.</span></span></p>
<p><span><span>EdgeX Foundry was </span><a href="https://www.linux.com/blog/2017/7/iot-framework-edge-computing-gains-ground"><span>announced</span></a><span> in late July 2017, with a goal of </span><span>developing a standardized, open source interoperability framework for Internet of Things edge computing. </span><span>EdgeX Foundry is creating and certifying an ecosystem of interoperable, plug-and-play components to create an open source EdgeX stack that will mediate between multiple sensor network messaging protocols as well as cloud and analytics platforms. </span></span></p>
<p><span><span>The framework facilitates interoperability code that spans edge analytics, security, system management, and services. It also eases the integration of pre-certified software for IoT gateways and smart edge devices.</span></span></p>
<h3><span><span>Security and flexibility</span></span></h3>
<p><span><span>“Our goal is to decouple connectivity standards and device interfaces from applications,” said Dell developer and major EdgeX contributor Jason A. Shepherd in an email interview with Linux.com. “EdgeX will enable flexibility and scalability through platform independence, loosely-coupled microservices, and the ability to bring together services written in different languages through common APIs. These cloud-native tenets are absolutely required at the edge to scale in an inherently fragmented, multi-edge and multi-cloud world.”</span></span></p>
<p><span><span>EdgeX is based on Dell’s seminal </span><a href="https://medium.com/@gigastacey/dell-plans-an-open-source-iot-stack-3dde43f24feb"><span>FUSE</span></a><span> IoT middleware framework, with inputs from a similar AllJoyn-compliant project called IoTX. Dell is one of three Platinum members alongside Analog Devices, and Samsung. EdgeX Foundry now has 61 members overall, including AMD, Canonical, Cloud Foundry, Linaro, Mocana, NetFoundry, Opto 22, RFMicron, and VMware.</span></span></p>
<p><span><span>The California release follows the initial </span><a href="https://www.edgexfoundry.org/announcement/2017/10/02/edgex-foundry-announces-major-milestone-with-first-barcelona-release/"><span>Barcelona</span></a><span> release, which arrived last October. Barcelona provided r</span><span>eference Device Services supporting BACNet, Modbus, Bluetooth Low Energy (BLE), MQTT, SNMP, and Fischertechnik, as well as connectors to Azure IoT Suite and Google IoT Core.</span></span></p>
<p><span><span>The major new features in in EdgeX California aim to improve security. A new reverse proxy based on </span><a href="https://docs.konghq.com/"><span>Kong</span></a><span> helps protect REST API communications and secrets storage. The reverse proxy requires any external client of an EdgeX microservice to first authenticate itself before loading an EdgeX API.</span></span></p>
<p><span><span>The new secure storage facility for secrets is based on HashiCorp’s open source </span><a href="https://www.vaultproject.io/"><span>Vault</span></a><span>. It lets you securely store sensitive data such as username/password credentials, certificates, and tokens within EdgeX for performing tasks such as encryption, making HTTPS calls to the enterprise, or securely connecting EdgeX to a cloud provider.</span></span></p>
<p><span><span>“Our Barcelona release had no security features because we wanted all the security layers to be defined by a community of industry experts such as RSA, Analog Devices, Thales, ForgeRock, and Mocana, rather than only from Dell,” said Shepherd. “The Reverse Proxy and Secrets Store is the foundation from which everything else is built.”</span></span></p>
<h3><span><span>Shift to Go</span></span></h3>
<p><span><span>The other major change in California was that the code was rebuilt from the original Java with the </span><a href="https://golang.org/"><span>Go</span></a><span> programming language. The process delayed the release by several months, but as a result, </span><span>California has a significantly reduced footprint, startup time, memory, and CPU usage. It fits into 42MB — or 68MB with container – and can now boot in less than a second per service compared to about 35 seconds (see chart below). </span></span></p>
<p>Additional new features in the California release include:</p>
<ul>
<li>Export services additions for “northbound” connectivity to the <a href="https://xmpp.org/">XMPP</a> messaging standard, the <a href="https://thingsboard.io/">ThingsBoard IoT</a> platform for device management, data collection, processing, and visualization, and Samsung’s <a href="https://www.samsungsds.com/global/en/solutions/off/insa/brighticsIoT.html">Brightics IoT</a> IoT interoperability platform,</li>
<li>Improved documentation, now available in Github</li>
<li>Full support for Arm 64</li>
<li>Blackbox tests for all micro services within build and continuous integration processes</li>
<li>Improved continuous integration to streamline developer contributions</li>
</ul>
<p><span><span>According to Dell’s Shepherd, the switch to Go was not only about reducing footprint, but to avoid the need for vendors to pay a Java license fee for commercial deployments. In addition, Go has expanded EdgeX’s developer base.</span></span></p>
<p><span><span>“Go’s concurrency model is superior to most programming languages, has the support of Google, is used by Docker, Kubernetes and many other large software development efforts, and is growing broadly in IoT circles,” said Shepherd. “We doubled our community in the months after the January Go-Lang Preview. There is a learning curve associated with getting a typical object (Java, C++) developer to move to Go (a functional versus object language), but overall the move has been good for fostering more enthusiasm about the platform as well as improving it.”</span></span></p>
<p><span><span>Shepherd noted that Go is only a baseline reference language. Developers can use the same APIs with other languages, and the project will support C in addition to Go for the Device Service SDKs. Because C can reduce the footprint even further than Go, it may be the better choice for applications built on a low-end “thin edge” gateway with a lot of Device Services, such as many different sensor protocols, said Shepherd. However, EdgeX Foundry chose Go because it is more platform independent in terms of hardware and OS.</span></span></p>
<h3><span><span>Next up: Delhi and beyond</span></span></h3>
<p><span><span>The upcoming Delhi release due in October will include components such as manageability services, Device Service SDKs, improved unit and performance testing, and a basic EdgeX UI for demos. It will also add more security features including </span><span>improved security service bootstrapping of Kong and Vault.</span></span></p>
<p><span><span>According to Shepherd, other security enhancements planned for Delhi include “tying Kong and potentially other security services to an access control system providing access control lists for granting access to various services.” Future versions of EdgeX will also establish a Chain of Trust API for systems that don’t have something like TPM. “We want to build out an API that allows EdgeX to establish a root of trust with the platform it rides on,” said Shepherd.</span></span></p>
<p><span><span>Other plans call for automating security testing, including “building an entire security testing apparatus and look at pen-testing type of needs,” said Shepherd. The project will also enhance the Vault-based secure storage system. “Today, EdgeX microservices get their configuration and secrets from the Consul configuration/registry service, but the secrets, such as passwords for database connections, are not secure. We want application secrets to come from Vault. Vault and Consul are provided by HashiCorp and we think there is a good way to use the two together.”</span></span></p>
<p><span><span>Looking forward to future releases, EdgeX plans to reduce the footprint even more to run in 128MB or lower. There are also </span><span>roadmap items for “more integration to edge analytics, rules engines, and CEPs,” said Shepherd. “We are currently working with NodeRed as an example. “</span></span></p>
<p><span><span>When asked about the potential for integrating with other cloud-driven IoT platforms such as </span><a href="http://linuxgizmos.com/amazon-releases-aws-greengrass-for-local-iot-processing-on-linux-devices/"><span>AWS Greengrass</span></a><span> or Google’s new </span><a href="http://linuxgizmos.com/google-tips-ai-co-processor-and-iot-framework-for-linux-and-android-things-gateways/"><span>Cloud IoT Edge</span></a><span> </span><span>platform, Shepherd had this to say:</span></span></p>
<p><span><span>“</span><span>Our ability to work with some of the proprietary cloud stacks depends on their openness and architecture, but we are certainly exploring the opportunities. The whole point is that a developer or end user can use their choice of edge analytics and backend services without having to reinvent the foundational elements for data ingestion, security and manageability.”</span></span></p>
<p><span><span>Separately, Shepherd noted: “Our completely open APIs — managed by the vendor-neutral Technical Steering Committee (TSC) to ensure stability and transparency — decouple developers’ choice of standards and application/cloud services to prevent them from being locked in via one particular provider’s proprietary APIs when the data meter starts spinning.”</span></span></p>
<p><span><span>Join us at </span><a href="https://events.linuxfoundation.org/events/elc-openiot-europe-2018/"><span>Open Source Summit + Embedded Linux Conference Europe</span></a><span> in Edinburgh, UK on October 22-24, 2018, for 100+ sessions on Linux, Cloud, Containers, AI, Community, and more.</span></span></p>
</div>
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/edgex-adds-security-and-reduces-footprint-with-california-release.jpg" width="1687" height="883" title="" alt="" /></div><div><div><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/edgex-adds-security-and-reduces-footprint-with-california-release.jpg" class="ff-og-image-inserted" /></div>
<p><span><span>The Linux Foundation’s</span><a href="https://wiki.edgexfoundry.org/display/FA/California+Release#CaliforniaRelease-TargetPerformance"><span> </span></a><span>EdgeX Foundry announced its </span><a href="https://wiki.edgexfoundry.org/display/FA/California+Release#CaliforniaRelease-TargetPerformance"><span>second major EdgeX release</span></a><span> of its EdgeX IoT middleware for edge computing. The “California” release adds security features including reverse proxy and secure credentials storage. It’s also rewritten in Go to offer a smaller footprint This makes it possible to run EdgeX on the Raspberry Pi 3, which has been chosen as the official target platform for California.</span></span></p>
<p><span><span>EdgeX Foundry was </span><a href="https://www.linux.com/blog/2017/7/iot-framework-edge-computing-gains-ground"><span>announced</span></a><span> in late July 2017, with a goal of </span><span>developing a standardized, open source interoperability framework for Internet of Things edge computing. </span><span>EdgeX Foundry is creating and certifying an ecosystem of interoperable, plug-and-play components to create an open source EdgeX stack that will mediate between multiple sensor network messaging protocols as well as cloud and analytics platforms. </span></span></p>
<p><span><span>The framework facilitates interoperability code that spans edge analytics, security, system management, and services. It also eases the integration of pre-certified software for IoT gateways and smart edge devices.</span></span></p>
<h3><span><span>Security and flexibility</span></span></h3>
<p><span><span>“Our goal is to decouple connectivity standards and device interfaces from applications,” said Dell developer and major EdgeX contributor Jason A. Shepherd in an email interview with Linux.com. “EdgeX will enable flexibility and scalability through platform independence, loosely-coupled microservices, and the ability to bring together services written in different languages through common APIs. These cloud-native tenets are absolutely required at the edge to scale in an inherently fragmented, multi-edge and multi-cloud world.”</span></span></p>
<p><span><span>EdgeX is based on Dell’s seminal </span><a href="https://medium.com/@gigastacey/dell-plans-an-open-source-iot-stack-3dde43f24feb"><span>FUSE</span></a><span> IoT middleware framework, with inputs from a similar AllJoyn-compliant project called IoTX. Dell is one of three Platinum members alongside Analog Devices, and Samsung. EdgeX Foundry now has 61 members overall, including AMD, Canonical, Cloud Foundry, Linaro, Mocana, NetFoundry, Opto 22, RFMicron, and VMware.</span></span></p>
<p><span><span>The California release follows the initial </span><a href="https://www.edgexfoundry.org/announcement/2017/10/02/edgex-foundry-announces-major-milestone-with-first-barcelona-release/"><span>Barcelona</span></a><span> release, which arrived last October. Barcelona provided r</span><span>eference Device Services supporting BACNet, Modbus, Bluetooth Low Energy (BLE), MQTT, SNMP, and Fischertechnik, as well as connectors to Azure IoT Suite and Google IoT Core.</span></span></p>
<p><span><span>The major new features in in EdgeX California aim to improve security. A new reverse proxy based on </span><a href="https://docs.konghq.com/"><span>Kong</span></a><span> helps protect REST API communications and secrets storage. The reverse proxy requires any external client of an EdgeX microservice to first authenticate itself before loading an EdgeX API.</span></span></p>
<p><span><span>The new secure storage facility for secrets is based on HashiCorp’s open source </span><a href="https://www.vaultproject.io/"><span>Vault</span></a><span>. It lets you securely store sensitive data such as username/password credentials, certificates, and tokens within EdgeX for performing tasks such as encryption, making HTTPS calls to the enterprise, or securely connecting EdgeX to a cloud provider.</span></span></p>
<p><span><span>“Our Barcelona release had no security features because we wanted all the security layers to be defined by a community of industry experts such as RSA, Analog Devices, Thales, ForgeRock, and Mocana, rather than only from Dell,” said Shepherd. “The Reverse Proxy and Secrets Store is the foundation from which everything else is built.”</span></span></p>
<h3><span><span>Shift to Go</span></span></h3>
<p><span><span>The other major change in California was that the code was rebuilt from the original Java with the </span><a href="https://golang.org/"><span>Go</span></a><span> programming language. The process delayed the release by several months, but as a result, </span><span>California has a significantly reduced footprint, startup time, memory, and CPU usage. It fits into 42MB — or 68MB with container – and can now boot in less than a second per service compared to about 35 seconds (see chart below). </span></span></p>
<p>Additional new features in the California release include:</p>
<ul>
<li>Export services additions for “northbound” connectivity to the <a href="https://xmpp.org/">XMPP</a> messaging standard, the <a href="https://thingsboard.io/">ThingsBoard IoT</a> platform for device management, data collection, processing, and visualization, and Samsung’s <a href="https://www.samsungsds.com/global/en/solutions/off/insa/brighticsIoT.html">Brightics IoT</a> IoT interoperability platform,</li>
<li>Improved documentation, now available in Github</li>
<li>Full support for Arm 64</li>
<li>Blackbox tests for all micro services within build and continuous integration processes</li>
<li>Improved continuous integration to streamline developer contributions</li>
</ul>
<p><span><span>According to Dell’s Shepherd, the switch to Go was not only about reducing footprint, but to avoid the need for vendors to pay a Java license fee for commercial deployments. In addition, Go has expanded EdgeX’s developer base.</span></span></p>
<p><span><span>“Go’s concurrency model is superior to most programming languages, has the support of Google, is used by Docker, Kubernetes and many other large software development efforts, and is growing broadly in IoT circles,” said Shepherd. “We doubled our community in the months after the January Go-Lang Preview. There is a learning curve associated with getting a typical object (Java, C++) developer to move to Go (a functional versus object language), but overall the move has been good for fostering more enthusiasm about the platform as well as improving it.”</span></span></p>
<p><span><span>Shepherd noted that Go is only a baseline reference language. Developers can use the same APIs with other languages, and the project will support C in addition to Go for the Device Service SDKs. Because C can reduce the footprint even further than Go, it may be the better choice for applications built on a low-end “thin edge” gateway with a lot of Device Services, such as many different sensor protocols, said Shepherd. However, EdgeX Foundry chose Go because it is more platform independent in terms of hardware and OS.</span></span></p>
<h3><span><span>Next up: Delhi and beyond</span></span></h3>
<p><span><span>The upcoming Delhi release due in October will include components such as manageability services, Device Service SDKs, improved unit and performance testing, and a basic EdgeX UI for demos. It will also add more security features including </span><span>improved security service bootstrapping of Kong and Vault.</span></span></p>
<p><span><span>According to Shepherd, other security enhancements planned for Delhi include “tying Kong and potentially other security services to an access control system providing access control lists for granting access to various services.” Future versions of EdgeX will also establish a Chain of Trust API for systems that don’t have something like TPM. “We want to build out an API that allows EdgeX to establish a root of trust with the platform it rides on,” said Shepherd.</span></span></p>
<p><span><span>Other plans call for automating security testing, including “building an entire security testing apparatus and look at pen-testing type of needs,” said Shepherd. The project will also enhance the Vault-based secure storage system. “Today, EdgeX microservices get their configuration and secrets from the Consul configuration/registry service, but the secrets, such as passwords for database connections, are not secure. We want application secrets to come from Vault. Vault and Consul are provided by HashiCorp and we think there is a good way to use the two together.”</span></span></p>
<p><span><span>Looking forward to future releases, EdgeX plans to reduce the footprint even more to run in 128MB or lower. There are also </span><span>roadmap items for “more integration to edge analytics, rules engines, and CEPs,” said Shepherd. “We are currently working with NodeRed as an example. “</span></span></p>
<p><span><span>When asked about the potential for integrating with other cloud-driven IoT platforms such as </span><a href="http://linuxgizmos.com/amazon-releases-aws-greengrass-for-local-iot-processing-on-linux-devices/"><span>AWS Greengrass</span></a><span> or Google’s new </span><a href="http://linuxgizmos.com/google-tips-ai-co-processor-and-iot-framework-for-linux-and-android-things-gateways/"><span>Cloud IoT Edge</span></a><span> </span><span>platform, Shepherd had this to say:</span></span></p>
<p><span><span>“</span><span>Our ability to work with some of the proprietary cloud stacks depends on their openness and architecture, but we are certainly exploring the opportunities. The whole point is that a developer or end user can use their choice of edge analytics and backend services without having to reinvent the foundational elements for data ingestion, security and manageability.”</span></span></p>
<p><span><span>Separately, Shepherd noted: “Our completely open APIs — managed by the vendor-neutral Technical Steering Committee (TSC) to ensure stability and transparency — decouple developers’ choice of standards and application/cloud services to prevent them from being locked in via one particular provider’s proprietary APIs when the data meter starts spinning.”</span></span></p>
<p><span><span>Join us at </span><a href="https://events.linuxfoundation.org/events/elc-openiot-europe-2018/"><span>Open Source Summit + Embedded Linux Conference Europe</span></a><span> in Edinburgh, UK on October 22-24, 2018, for 100+ sessions on Linux, Cloud, Containers, AI, Community, and more.</span></span></p>
</div>