Back before dial up internet, the online experience was almost always text-based – just like time sharing systems were in the 60’s. You would run a terminal emulator on your computer that interpreted bytes being received by your modem and would draw your text-based UI – special codes allowed the cursor to be repositioned, the text color to be changed, and even basic graphic characters to be displayed. As with any restricted medium, people found ways to express themselves with this limited palette and the results were often quite amazing.

Then, the web came along and, almost overnight, wiped out dial-up bulletin boards. Why call a single machine shared by a few hundred users when you could browse the world? Happily, the communities didn’t die, they just moved onto web-based forums and the world moved on.

Serial: not dead yet!

So what happened to serial ports? Well, they never really went away. Though desktop and laptop computers lost their serial ports – replaced with USB – they still remain on many other devices, from servers to phone exchanges, UPSes, industrial equipment and embedded devices. The reason they never died is that you often need a way to configure or diagnose a device, and serial is simple, cheap and flexible enough to do the job; you can even have pretty menus if you use control codes!

The downside – or advantage, depending on your point of view – is that you need to be within a few feet of the port to plug in. Whilst that’s great for security (physical access to a device often opens up the attack surface) it’s often a real pain if you’re trying to diagnose a sporadic issue, or need to be able to reboot a server from its console port when you inadvertently screwed something up during a remote software install.

For those times, wouldn’t it be great to have a serial port you could connect to over the internet? Such things – TCP/IP to serial gateways, terminal servers, etc – have existed for a long time, but they’re often severely lacking in security as they date from back when the internet wasn’t quite the 24/7 hackers paradise it is now. A quick look at Shodan.io uncovers a disturbing number of pieces of presumably critical infrastructure which someone has wired up to one of these gateways – and because these serial connections were intended for use by an engineer in the same room as the device, they’re often completely unprotected. Not only that, in most cases someone has actually opened up a hole in a firewall or NAT to allow remote access to the device – another action fraught with risk.

So, how could this be done better? Well, Electric Imp devices have always made secure outbound internet connections to the Electric Imp service (or, for enterprise customers, their own copy of the imp service) – that means no firewall holes are needed. Also, the link is encrypted and protected with TLS1.2 & forward secrecy, meaning the connection is about as secure as current standards allow… but that doesn’t get us a serial port, does it?

Actually, it does. Every imp has several UART peripherals – 3v serial, essentially – and data to and from them can be transparently piped to every imp’s unique cloud virtual machine. This same cloud virtual machine – we call them “agents” – can also serve up a web page and an API, which gives us all the tools we need to build an in-browser serial terminal with – effectively – an infinitely long virtual cable to plug into anything we need to wrangle remotely. The imps that have a USB host – imp005 and the cellular impC001 – could also do this with a USB-serial adaptor, though that’s not part of the example code.

Building a secure web-based terminal

The Electric Imp platform allows us to exchange data between a webpage and a serial port – but how do we display this data? Luckily, someone has built some JavaScript to emulate an ANSI/VT100 terminal – and it’s called Xterm.js. If we feed bytes from the imp’s serial port to this JS component, it’ll render just as if we were sitting on the floor in the machine room running a terminal emulator program connected to a serial port. Xterm.js also captures keyboard input and we can then send this from the browser, to the agent and onwards to the imp and its UART.

Latency

When using a text-based UI, response time is important – it’s annoying to type something and have a long lag between pressing the key and seeing it appear on the screen. In an ideal world, agents would offer “websockets” – a transparent, persistent pipe between the browser and the agent, perfect for this application – but those are still a little way off in our roadmap and so we’ll have to make do with HTTPS input and output for now.

Fortunately, this isn’t as slow as you might think because HTTP/1.1 session reuse between the browser and the agent means that even though we still have to bear the overhead of HTTP headers and so on for every transaction, the underlying TLS connection is persistent; in order to provide a near-instant path from the agent back to the browser, we can also make use of an old (in web terms!) technique called “long polling”.

When long polling, the browser issues a request to the agent, but the agent doesn’t reply until it has something to send (like new data from the serial port). Requests can’t sit there forever though, so every 60 seconds pending requests are closed and the browser will issue a fresh one; this is a really effective way to provide low latency notifications, and one used by hundreds of thousands of commercial devices used on the Electric Imp cloud.

The round trip is pretty tortuous, though – when a key is pressed, it’s sent via an HTTPS POST to the agent, which sends it to the imp with device.send(). Once the imp receives it, the byte is written to the UART and clocked out (which, at 9600bps, takes a little over a millisecond). The remote system then echos the character (again, another millisecond), which is received by the imp & sent back to the agent with agent.send(), then the agent will send the new data out to the listening HTTP GET session. As the imp platform is low latency, we still get a decently responsive session – far preferable to sitting on a cold floor tethered to a serial port.

How about multiple sessions? One of the fun things here is that we can make the agent be responsive to several concurrent browser sessions, sending new data out to each one as it arrives – this means you can effectively share a terminal, allowing a colleague to watch you work and jump in if necessary. To make this work, the agent keeps up to 100kB of data that has been received from the device and, to keep everything in sync, each browser tells the agent what received byte number it has dealt with. When you open a new browser window, the past data is replayed and so everything – including a decent amount of scrollback in the terminal – is usable.

Security

There are a couple of aspects to this:

• Imp to cloud security: as noted before, this is a TLS1.2 outbound connection from the device to the imp server. Both ends use certificates to validate each other, and forward secrecy (an ephemeral link key) is also used for this connection. Every imp, developer or production, connects like this – and we take on the responsibility of maintaining the security stack of every device in the field, leaving you to spend your time on the application side of IoT.
• Agent endpoint security: in this example we’ve configured Rocky, the HTTP server helper library, to require HTTP basic auth. This ensures that every request has a header that contains the required username & password. Though it’s very unlikely that someone could find your agent by enumerating the very large agent namespace, this extra level of security will help prevent someone shoulder-surfing your agent’s URL and accessing your serial device. Ensuring that this connection can only be made over HTTPS prevents the username/password from being easily snooped too.

As ever, security needs to be appropriate for the application and threat model. Contact us if you are looking for guidance on securing imp applications.

Putting it all together

I’ve published the example code to our public GitHub repository; you can find it at https://github.com/electricimp/RemoteTerminal. To use it, create a new product & device group, then cut & paste agent.nut into the agent side of the IDE, and device.nut into the device side – then assign a device.

You’ll need to alter the device side code to suit your needs – selecting the appropriate serial port and baud rate – and you’ll also want to change the username and password at the top of the agent code; the format is “username:password”.

Pull requests to add features like configurable baudrate & spooling output to a file gratefully received!

Example application

Here, we’ve used an imp005 breakout board (though any imp breakout will work), a TTL to RS232 adaptor, a DB9 to RJ45 modular jack adaptor, and a patch cable to connect an imp to a Digi terminal server’s console port.

Click here to get to the live demo – the username is “username” and the password is, unsurprisingly “password”. Given that the terminal server the imp is connected to was picked up at DEFCON a couple of years back, it’s quite apt that we’ve just exposed it to the internet (the box itself is not connected to any network!).

The post Secure web-based serial terminal appeared first on Electric Imp.

This, in addition to its FCC/IC modular certifications and integrated SIM, means that customers do not need to perform any additional radio or carrier testing to ship their cellular connected products within the US & Canada – reducing risk and saving both tens of thousands of dollars and months of testing time.

This is another example of how Electric Imp is simplifying the process for getting IoT devices securely connected over any network — and, for cellular devices, with their additional test requirements and often byzantine carrier rules, it’s a particularly important one.

Whether you’re tracking goods as they ship cross country, connecting devices that can’t be served by WiFi or Ethernet – wind turbines, solar installations, vending machines or indeed any device where a network may not be available to use – you need cellular.

It’s this recognition that drove us to develop impCellular as a comprehensive and easy-to-use solution for IoT connectivity. We’ve eliminated all the complexity of the “plumbing” so you can focus on the unique requirements of your application and getting your solution to market quickly and on budget.

The post PTCRB Certification Helps Accelerate Your Cellular IoT Deployment appeared first on Electric Imp.

Getting Started with impCellular

The impC001 Cellular Breakout Board Kit with impCellular service is now available at the Electric Imp online store and includes everything you need:

• impC001 module with application processor and LTE-Cat 1 connectivity (2G/3G fallback based in regions)
• impC Breakout Board with a range of sensors, interfaces, and support for rechargeable battery (not included)
• LTE antenna & USB power supply
• Designed to fit into an New Age IPX7 enclosure (see picture, enclosure not included)
• Ready to use: Pre-provisioned multi-network cellular service, managed OS and security, and fully supported by the Electric Imp platform

To get started, follow the impC001 Breakout Board Getting Started Guide. You should have your first cellular end-to-end IoT application running in less than an hour. Using the commercial-grade Electric Imp service ensures that your IoT application is already fully secure, managed, and scalable — meaning it can move to a commercial product rapidly and seamlessly.

Moving to a Commercial Product

Moving from concept to a commercial product is easy: Use our no-cost reference designs to create your customized product hardware with an M2 connector. The impC001 module can be ordered in volume by contacting us, and is PTCRB “end device” certified. It plugs into the M2 connector on your customized hardware and enables your product intelligence and cloud connectivity via the Electric Imp service. The M2 connector also gives you the flexibility to configure your product with the upcoming lower-cost impC002 (LTE-Cat M/NB-IoT).

Then, deploy your application to all your devices and the cloud via the push of a button from the impCentral operations console. You will be shipping your connected product or service in record time, just like many of our customers.

Delivering Secure and Ubiquitous IoT Solutions has never been easier

impCellular is a new approach to IoT that is dramatically different from traditional cellular IoT offerings — more secure, more complete, and simpler to use. Rather than struggling with the complexity of connectivity, impCellular enables you to deliver the value of connectivity.

Product briefs:

• impCellular Product Brief
• impC001 Product Brief
• impC Breakout Board Product Brief

Want to learn more about how we are reinventing Cellular IoT? Check out our impCellular pages, including hardware and service pricing.

The post impCellular: Now Shipping in Volume to Kick-Start Your IoT Business appeared first on Electric Imp.

At first it seems obvious that letting your in house team of engineers take on the challenge of connecting devices is the right choice.  After all, they’re a fixed cost and subject matter experts on what your company does, what the connected devices need to do and the myriad protocols, standards and regulations unique to your industry.  

However, if you think about the 80/20 Rule, it seems to me that the best use of a manufacturer’s time is to spend the 80% focused on how you drive value from the data gained from connecting your devices and the interaction with your customers, not the ‘plumbing’ of how you connect, secure and support that device in the field for its life time.

Here’s what a secure IoT product requires over its lifespan from manufacture to end of life:

1. Security for data, apps and hardware that is designed in at the beginning and maintained for the life of the product
2. Unified hardware and software development process from idea to proof of concept, connected manufacturing, OS and application updates, as well as security maintenance through end-of-life
3. Scalability from one to hundreds of thousands of connected devices in an instant
4. Tightly controlled and monitored software provisioning of OS and apps
5. Standards compliance, including existing and future standards for security, communications, messaging, networking and storage
6. Ongoing integration and support for different connectivity options
7. Application layer between the device and cloud that enables the device to be personalized for custom services, actions and data management
8. Out-of-the box integration with leading cloud vendors

So the question is, what is the value gained by creating the connectivity and security layers yourself?

Instead of dedicating time and resources to building and supporting complex IoT technology, we believe the best strategy is to use the power of the Electric Imp IoT Connectivity Platform to manage the plumbing that includes all the above requirements. This will free you to focus on creating value from your connected products to grow your business.

Want to learn more? Join our webinar–IoT: Combining the Best of Build and Buy, August 7th, 9am PT

The post IoT…Do It Yourself? appeared first on Electric Imp.

Low-Cost Cellular Connectivity will Speed IoT Adoption  

As discussed in our previous posts, the endless potential for real-time connectivity in business and industrial applications is supporting steady growth in the IoT industry. In turn, the IoT is playing a major role in the transformation of business — generating cost savings, new revenue streams and other benefits.

For IoT to make sense in a new application, solutions need to be integrated on platforms that can scale and handle millions of devices efficiently. The total cost of ownership must also be low enough for the business case to make sense. This is where we believe cellular connectivity will play a major role in 2018

The Benefits of Cellular IoT

When combined with low-cost devices in low energy consumption applications, cellular channels can provide the reliable coverage needed to cost-effectively implement IoT. Additionally, this wide-range and highly reliable form of connectivity offers customers with mobile or remote applications a compelling option to easily, rapidly and cost-effectively achieve secure connectivity.

Cellular IoT solutions can now be developed using a hybrid approach with a managed IoT platform such as Electric Imp’s. Unlike many cellular IoT solutions currently on the market, Electric Imp offers data transmission for the same connected device across multiple carrier networks to help customers reduce coverage costs and simplify logistical challenges. The operating system and security software on Electric Imp’s cellular channels and connected devices are continuously maintained and updated to help reduce the costs and complexities of lifecycle security management and device maintenance.  

By combining cellular connectivity with a platform as a service, you can support long distance, low-power data applications such as asset optimization, telematics and location tracking — without the traditional complexities of deploying connected devices at scale.

Example of impCellular solution with Cold Chain. 

Solving the Carrier Challenge
Unlike many cellular IoT solutions currently on the market, the Electric Imp cellular solution works seamlessly with multiple carriers to ensure the best performance and to maximize coverage which helps customers reduce coverage costs and simplify logistical challenges. This means that wherever your devices go, Electric Imp’s solution will automatically connect to the network with the best coverage — with no interruption and only one contract.

As mentioned above, this packaged solution helps advance security and ease internal management burdens, as the operating system and security software on Electric Imp’s cellular channels and connected devices are continuously maintained and updated to help reduce the costs and complexities of lifecycle security management and device maintenance.  

It may seem too good to be true, but pricing for Electric Imp’s cellular connectivity is based solely on the number of devices connected over time, with no activation or associated costs for transmitting or receiving OS software updates. This means that you only pay for the data you transmit when you transmit it, which is a stark contrast to the cellular contract models of the past.

Enabling a Hybrid Approach
Although we believe that cellular connectivity will change the face of IoT over the next year, we continue to recognize the proven value of traditional connectivity methods such as WiFi or Bluetooth.

What is particularly unique to Electric Imp’s approach to cellular IoT is that you can have a native WiFi or Ethernet solution that can include integrated cellular backup. With this approach, you can utilize cellular connectivity as a cost-effective “failover” or back-up option for traditional connectivity methods. This helps optimize data volumes dependent on the currently active network type. For example, your WiFi connected device would automatically switch over to the most effective cellular network if it were to lose signal — and you’d only pay for the data transmitted until WiFi connection was restored.

Closing thoughts
The strength and coverage areas of cellular networks continue to expand as pricing becomes more competitive, leading to affordable IoT applications that can go beyond the constraints of local area networks. These networks also provide the same levels of security and scalability as traditional connectivity options when paired with the right IoT platform.

Just like our WiFi and Bluetooth offerings, Electric Imp manages the burden of threat mitigation and security updates with all cellular devices. This continuous support ensures products remain safe and securely operational without expending in-house engineering resources. On a platform with this level of device support, cellular IoT truly has the capability to provide unmatched levels of reliability, flexibility and time-to-market.

To learn more join our webinar Reinventing Cellular IoT with CEO Hugo Fiennes 

The post Electric Imp’s Tips for IoT Success in 2018: Part 3 appeared first on Electric Imp.

However, there is considerable confusion in the market about what ‘strong IoT security’ actually means in practice and how to achieve it — causing many IoT projects to fail because the security challenges seem insurmountable with no solution in sight. It doesn’t help that many vendors are making a lot of noise with bold marketing claims about ‘complete IoT security,’ when upon closer inspection these offerings are often incomplete, or worse, have significant security gaps or flaws.

Since our inception, Electric Imp’s view has been that the best way to deliver IoT security is with a security-first end-to-end design that tightly integrates security across all layers and lifecycle phases of the IoT platform. From the device silicon at the edge to the cloud, and from manufacturing through deployment and on-going security maintenance, we have focused on eliminating dangerous weak links and common security gaps. We call this ‘impSecureTM: Integrated Silicon-to-Cloud Security as a Service’:

Increasingly, we see the industry confirming this integrated approach. For example, the Industrial Internet Consortium (IIC) Security Framework defines a set of recommendations and best practices for industrial IoT security, and the Electric Imp offering is very much aligned with that framework. Furthermore, in 2017 Microsoft published the paper “The Seven Properties of Highly Secure Devices,” which has become an important turning point in the market by defining principles and practices which help ensure cybersecurity of network-connected devices at scale. We concur with Microsoft’s conclusions in the paper on the importance of bringing “high-value security to low-cost devices,” and this is the new minimum security bar IoT systems need to clear.

Because of our long-standing focus on security, the Electric Imp offering since 2015 meets all seven properties described in the Microsoft paper while also addressing additional challenges that are critical for real-world IoT, such as secure manufacturing and large-scale commissioning. Underscoring our security approach is the fact that the Electric Imp Platform is also the first and only IoT platform to be UL 2900-2-2 Cybersecurity Certified.

Electric Imp has been enabling our customers — including large public companies such as Pitney Bowes, EATON, and ABInBev — to ship secure, reliable, mass-scale IoT solutions. With over 1.5 million imp-powered devices on our platform and more than 100 customers around the world, Electric Imp provides the scalability, fast time-to-market, and worry-free security that is critical to a successful IoT deployment.

Want to learn more? Read our White Paper: Shipping “The Seven Properties of Highly Secure Devices” in Volume

The post Raising the Bar on Security of Mass-Scale IoT appeared first on Electric Imp.