Presentation by Juan A. Martinez Navarro Representative, Odin Solutions S.L. FIWARE Tech Summit 28-29 November, 2017 Malaga, Spain

1. FIWARE-based Smart City platforms
MiMurcia: a comprenhesive smart city platform pilot for the City of Murcia
Providing access control and privacy for IoT communications
Juan Antonio Martínez (jamartinez@odins.es)

2. 1
Odin Solutions
Odin Solutions. Let's invent Smart Solutions
We are involved in the design, development, production and
marketing of products for intelligent monitoring and remote
management of infrastructures.
We provide products and solutions based on the latest innovative
technologies such as Internet of Things (IoT), Cloud Computing
Platforms and Apps for mobile devices.

3. FIWARE-based Smart City platforms
MiMurcia: a comprenhesive smart city platform pilot for the City of Murcia
Juan Antonio Martínez (jamartinez@odins.es)

4. MiMurcia: Fiware platform deployment for Smart City
▪Heterogeneus information
▪Different nature of sources of information
▪Set up and develop different ways for integration
• Using enablers such as COMET and CYGNUS
• Developing new conectors to integrate the information
3

5. 4
Integrated services
▪ Incidences
▪ Temperature of town hall buildings
▪ Energy consumption of buildings
▪ Traffic measurements
▪ Parking slots of parking sites
▪ Free parking slots of public rental bike service
▪ Tramp
▪ Bus stops and vehicle locations
▪ Rainfall
▪ Solar panels

6. Platform instantiation
5
ORION
IoT Agent NGSI Connector NGSI Connector
COMETCKAN
Web Application
CYGNUS CYGNUS
IoT
Device
3er party
Platform
3er party
Platform

7. 6
Platform deployment

8. 7
Platform deployment

9. 8
Platform deployment

10. 9
Platform deployment

11. 10
Integration examples – Urban bus
▪They provide an API using SOAP
• We have to develop a Python-based conector to extract the
information and integrate it into our platform
• Using suds – Lighweight SOAP client
▪Organization of the information
• fiware-service: autobuses
• fiware-servicepath: /murcia

12. 11
Integration examples – Urban bus
Bus-stops are
represented as points.
They contain:
- Location
- Bus lines in each stops
- Id
- direction

13. 12
Integration examples – Urban bus
Our Python module connects to the remote
resource ns2:WsLinesDiscoveryStructure
to get the information of bus lines.
ns2:StopMonitoringRequestStructure for
bus stops.

14. 13
Integration examples – Urban bus
After obtaining this info. Our
module put this information
into the Context Broker using
updateContext

15. 14
Integration examples – Bike rental service
▪They provide a REST API
• We developed nodejs conector to extract the information and integrate it into our
platform
▪Organization of the information
• fiware-service: bicis
• fiware-servicepath: /murcia

16. 15
Integration examples – Bike rental service
Representation of bike parking
slots:
- Id: BikeParkingSite:*
- Free slots
- Occupied slots
- Enabled
- Description
- Location

17. 16
Integration examples – Bike rental service
Updating context to our FIWARE platform

18. 17
Integration examples – Tramp service
▪Two different services:
• Information in tramp stops
• Information and location of tramp vehicles
• We developed a nodejs conector
▪Organization of the information
• fiware-service: tranvia
• fiware-servicepath: /murcia

19. 18
Integration examples – Tramp service
Tramp stops:
- Id TrampStop.
- Location
- State: info of both
directions
Tramp vehicle:
- Id Tramp.
- Location

20. 19
Integration examples – Tramp service
Updating context to our FIWARE
platform

21. 20
Comet Integration
▪ We need to configure it:
▪ A manual subscription was also required to start the service

22. 21
Comet/Cygnus Integration - Subscription
(curl localhost:1026/v1/subscribeContext -s -S --header 'Content-Type: application/json’ --header
'fiware-service: tranvia’ –header ‘fiware-servicepath: /murcia' --header 'Accept: application/json' -d @-
| python -mjson.tool) <<EOF
{
"entities": [
{
"type": “Vehiculo",
"isPattern": “true",
"id": “Tranvia:*"
}
],
"attributes": [
“geoposicion"
],
"reference": "http://sth-host:port/notify",
"duration": "P1M",
"notifyConditions": [
{
"type": "ONCHANGE",
"condValues": [
“geoposicion"
]
}
],
"throttling": "PT5S"
}
EOF
Details about subscription
End point of subscriber

23. FIWARE-based Smart City platforms
Providing access control and privacy for IoT communications
Juan Antonio Martínez (jamartinez@odins.es)

24. 23
Providing security and privacy to FIWARE
▪Enablers
• KeyRock: Id Management
▪New components
• Capability Manager: DCapBAC - Authorization
• PEP_Proxy: Authorization enforcement and data encryption using
CP-ABE

25. XACML
Platform instantiation
24
ORION
IoT Agent NGSI Connector NGSI Connector
PEP_PROXYKEYROCK Service/Client
3, NGSI + CAP. TOKEN
IoT
Device
3er party
Platform
3er party
Platform
1. AUTHENTICATION
CAPABILITY
MANAGER
PAP PDP
2. AUTHORIZATION
It is able to perform
CP-ABE over data to
be stored

26. 25
Authentication
KeyRock is the component responsible for
verifying user credentials providing
authentication verdict

27. Authorization - DCapBAC
▪ Distributed Capability-Based Access Control
▪ After granting the access (or being authorized) to a specific resource to a Client
▪ Client obtains a Capability Token which is signed by Capability Manager
▪ It is a proof-of-possesion
▪ Easy to validate by third parties
26
XACML
Service/Client
CAPABILITY
MANAGER
PAPPDP

28. 27
Authorization – DCapBAC - Capability Token
{
“id”: “eg3fq:fb5r23tra3”,
“ii”: 1485172121,
“is”: “issuer@odins.es”,
“su”: “zNwS5FetB4rwzSKsWwSBAxm5wDa=JgLjHU8zSnmeSFQgSG9HhdsJrE8=”,
“de”: “device:01”,
“si”: “SbUudG4zuXswFBxDeHB87N6t9hR=PBQqCN3gpu7nSkuPzDk7kaR3dq1=”,
“ar”: [
{
“ac”: “queryContext”,
“re”: “temperature”
}
],
“nb”: 1485172121,
“na”: 1485174121
}

29. 28
Authorization - DCapBAC
Capability Manager is accesed via POST API REST

30. Privacy: CP-ABE
▪ Encryption technique whose policy is based on combination of attributes
▪ It allows us to broadcast information to a group of subscribers
▪ Only the ones with the right credentials will be able to decrypt the information
29
Producer
Consumer1
Consumer2
Consumer3
Message
Company: OdinS
Role: admin
Floor: first
Company: OdinS
Role: admin
Floor: second
Company: Fiware
Role: admin
Floor: first
Encrypt with CP-ABE Policy
Role: admin and Floor: first
OK
FAIL
OK

31. 30
Privacy: CP-ABE Encryption integration
"contextElements": [
{
"type": "Test",
"isPattern": "false",
"id": "Test:1",
"attributes": [
{
"name": "cipheredAttribute",
"type": "cyphertext",
"value": "hello",
"metadatas": [{
"name": "cpabe-policy",
"type": "string",
"value": ”location: floor1 and role:admin"
}]
}
]
}
]
PEP_Proxy will use the information
of metadata and encrypt the
cipheredAttribute with the
corresponding CP-ABE policy
location:floor1 and role:admin

32. 31
CP-ABE Encryption application diagram

33. Thank you!
http://fiware.org
Follow @FIWARE on Twitter
Juan Antonio Martínez (jamartinez@odins.es)