WO2021118471A1 - Système et procédé de traitement de données - Google Patents

Système et procédé de traitement de données Download PDF

Info

Publication number
WO2021118471A1
WO2021118471A1 PCT/SG2020/050742 SG2020050742W WO2021118471A1 WO 2021118471 A1 WO2021118471 A1 WO 2021118471A1 SG 2020050742 W SG2020050742 W SG 2020050742W WO 2021118471 A1 WO2021118471 A1 WO 2021118471A1
Authority
WO
WIPO (PCT)
Prior art keywords
sub
data
containerised
data management
application
Prior art date
Application number
PCT/SG2020/050742
Other languages
English (en)
Inventor
Kyung Wan Kim
Original Assignee
Skylab Networks Pte. Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Skylab Networks Pte. Ltd. filed Critical Skylab Networks Pte. Ltd.
Publication of WO2021118471A1 publication Critical patent/WO2021118471A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/52—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
    • G06F21/53—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow by executing in a restricted environment, e.g. sandbox or secure virtual machine
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/606—Protecting data by securing the transmission between two devices or processes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G06F21/12—Protecting executable software
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/16—Arrangements for providing special services to substations
    • H04L12/18—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast
    • H04L12/1895—Arrangements for providing special services to substations for broadcast or conference, e.g. multicast for short real-time information, e.g. alarms, notifications, alerts, updates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/22—Arrangements for preventing the taking of data from a data transmission channel without authorisation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/062—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key distribution, e.g. centrally by trusted party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0866—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0877—Generation of secret information including derivation or calculation of cryptographic keys or passwords using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0894—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
    • H04L9/0897—Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/30—Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
    • H04L9/3213—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority using tickets or tokens, e.g. Kerberos
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
    • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
    • H04W4/30—Services specially adapted for particular environments, situations or purposes
    • H04W4/38—Services specially adapted for particular environments, situations or purposes for collecting sensor information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/18—Self-organising networks, e.g. ad-hoc networks or sensor networks

Definitions

  • This disclosure relates to the field of Internet of Things, cloud computing, edge processing and telecommunications.
  • this disclosure relates to systems and methods for selectively processing data generated by sub-devices, by selectively providing the data to one or more multicast network channels that are accessible by containerised applications.
  • Sensors can be used to monitor a variety of parameters that range from, for example, temperature sensors for measuring a temperature of an environment to optical sensors that record images or video of a region.
  • a large number of sensors can be included in sensing systems and optimising how data provided by the sensors is processed is technically difficult.
  • modern surveillance systems e.g. security systems used by private security companies or security systems used by governments for local or national security
  • security systems can include a large number of surveillance cameras and other sensors.
  • the use of these surveillance systems also extends beyond local or national security, into domains such as smart city initiatives where public infrastructure may be controlled in response to data provided by the sensors.
  • public infrastructure may be controlled in response to data provided by the sensors.
  • street lights may be controlled in response to changes in environmental light conditions.
  • Sensing systems can therefore include both a large number of sensors and a large variety in the type of sensors used.
  • sensing systems can include sensors associated with the operation of machines or facilities, surveillance cameras (e.g. Closed Circuit Television (CCTV) cameras, vibration sensors, humidity sensors, gas detectors etc. Selectively processing data from such a number of sensors and such a variety of sensors provides significant safety, security, efficiency and scalability problems.
  • surveillance cameras e.g. Closed Circuit Television (CCTV) cameras
  • vibration sensors e.g. Closed Circuit Television (CCTV) cameras
  • humidity sensors e.g., humidity sensors
  • gas detectors e.g., gas detectors etc.
  • a computer-implemented method for selectively processing data may comprise: receiving, by a service device, a request for access from a sub-device, the request for access comprising sub-device information associated with the sub-device; receiving, by the service device, authorisation to enable access, the authorisation being based at least in part on the sub-device information; receiving, by the service device, sub-device data from the sub-device; broadcasting, by the service device, the sub-device data to a corresponding multicast network channel that is accessible by a plurality of containerised applications of the service device; receiving, by a containerised application of the plurality of containerised applications, the sub-device data from the multicast network channel; processing, by the containerised application, the sub-device data to generate processed data; and transmitting, by the service device and to a data management device, the processed data.
  • the computer implemented method further comprises: receiving, by a user interface of the data management device, authorisation credentials; generating, by the data management device, an authorisation token based at least in part on the authorisation credentials; and transmitting the authorisation token to the service device.
  • the computer-implemented method further comprises transmitting, by the service device, the request for access to the data management device.
  • receiving authorisation to enable access comprises receiving the authorisation token.
  • the computer- implemented method further comprises storing, by the data management device, the processed data.
  • the sub-device information comprises one or more of a sub-device serial number, a sub-device Media Access Control (MAC) address, a sub-device model number, a sub-device identifier and a random key.
  • MAC Media Access Control
  • the random key is stored in a Trusted Platform Module of the service device memory.
  • the sub-device comprises a sensor and the sub-device data comprises sensor data.
  • the multicast network channel is a multicast Internet Protocol (IP) address or an application-layer multicast channel.
  • IP Internet Protocol
  • processing the sub-device data comprises determining one or more sub-device data metrics based at least in part on the sub-device data.
  • the computer-implemented method further comprises: generating a private key; generating a public key that is associated with the private key; and associating, in a sub-device record, the public key with the sub-device.
  • the private key and the public key are generated by the service device.
  • the computer- implemented method further comprises one or more of: providing the private key to the data management device; providing the public key to the data management device; providing the private key to the at least one containerised application; providing the public key to the at least one containerised application; and/or providing the public key to the sub-device.
  • the private key and the public key are generated by the data management device.
  • the computer-implemented method further comprises one or more of: providing the private key to the service device; providing the public key to the service device; providing the private key to the at least one containerised application; providing the public key to the at least one containerised application; and/or providing the public key to the sub-device.
  • the computer- implemented method of further comprises encrypting, by the service device and using the public key, the received sub-device data prior to broadcasting the sub-device data to the multicast network channel, thereby generating encrypted sub-device data.
  • broadcasting the sub-device data to the multicast network channel comprises broadcasting the encrypted sub-device data to the multicast network channel.
  • receiving the sub-device data from the multicast network channel comprises receiving the encrypted sub-device data.
  • the computer-implemented method further comprises decrypting, by the containerised application and using the private key, the encrypted sub-device data received from the multicast network channel, prior to processing the sub device data.
  • the computer-implemented method further comprises encrypting, by the containerised application and using the public key, the processed data to generate encrypted processed data.
  • transmitting the processed data comprises transmitting the encrypted processed data.
  • storing the processed data comprises storing the encrypted processed data.
  • the computer-implemented method further comprises transmitting, by the service device and to the data management device, a request to initialise a new containerised application; retrieving, by the service device, the new containerised application; initialising, by the service device, the new containerised application; and transmitting, by the service device, an installation confirmation indicating a successful initialisation of the containerised application to the data management device.
  • the containerised application of the plurality of containerised applications is the new containerised application.
  • the computer- implemented method further comprises: receiving, by the data management device, the request to initialise the new containerised application; and transmitting, by the data management device, a license key to the service device, the license key being associated with the containerised application.
  • the data management system may comprise a service device.
  • the service device may comprise at least one service device processor; and service device memory.
  • the service device memory may store: a plurality of containerised applications executable by the at least one service device processor; and program instructions accessible by the at least one service device processor.
  • the program instructions may be configured to cause the at least one service device processor to: receive a request for access from a sub-device, the request for access comprising sub-device information associated with the sub-device; receive authorisation to enable access, the authorisation being based at least in part on the sub-device information; receive sub-device data from the sub-device; broadcast the sub-device data to a corresponding multicast network channel that is accessible by the plurality of containerised applications and execute a containerised application of the plurality of containerised applications.
  • the containerised application may be configured to: receive the sub-device data from the multicast network channel; and process the sub-device data to generate processed data.
  • the program instructions may be configured to cause the at least one service device processor to transmit the processed data to a data management device.
  • the data management system further comprises the data management device.
  • the data management device may comprise: at least one data management device processor; and data management device memory.
  • the data management device memory may store data management program instructions accessible by the at least one data management device processor.
  • the data management program instructions may be configured to cause the at least one data management device processor to receive the processed data.
  • the data management program instructions are further configured to cause the at least one data management device processor to: receive authorisation credentials; generate an authorisation token based at least in part on the authorisation credentials; and transmit the authorisation token to the service device, thereby providing authorisation to enable access.
  • the service device program instructions are further configured to cause the at least one service device processor to transmit the request for access to the data management device.
  • the service device program instructions are further configured to cause the at least one service device processor to receive the authorisation token, thereby receiving authorisation to enable access.
  • the data management program instructions are further configured to cause the at least one data management device processor to store the processed data.
  • the sub-device information comprises one or more of a sub-device serial number, a sub-device Media Access Control (MAC) address, a sub-device model number, a sub-device identifier and a random key.
  • MAC Media Access Control
  • the sub-device comprises a sensor and the sub-device data comprises sensor data.
  • the multicast network channel is a multicast Internet Protocol (IP) address or an application-layer multicast channel.
  • IP Internet Protocol
  • processing the sub-device data comprises determining one or more sub-device data metrics based at least in part on the sub-device data.
  • the service device program instructions are further configured to cause the at least one service device processor to: generate a private key based at least in part on the sub-device information; generate a public key that is associated with the private key; and associate, in a sub-device record, the public key with the sub-device.
  • the service device program instructions are further configured to cause the at least one service device processor to: provide the private key to the data management device; provide the public key to the data management device; provide the private key to the at least one containerised application; provide the public key to the at least one containerised application; and/or provide the public key to the sub-device.
  • the data management program instructions are further configured to cause the at least one data management device processor to: generate a private key based at least in part on the sub-device information; generate a public key that is associated with the private key; and associate, in a sub-device record, the public key with the sub-device.
  • the data management program instructions are further configured to cause the at least one data management device processor to: provide the private key to the service device; provide the public key to the service device; provide the private key to the at least one containerised application; provide the public key to the at least one containerised application; and/or provide the public key to the sub-device.
  • the service device program instructions are further configured to cause the at least one service device processor to encrypt the received sub-device data using the public key, prior to broadcasting the sub-device data to the multicast network channel, thereby generating encrypted sub-device data.
  • broadcasting the sub-device data to the multicast network channel comprises broadcasting the encrypted sub-device data to the multicast network channel.
  • receiving the sub-device data from the multicast network channel comprises receiving the encrypted sub-device data.
  • the program instructions are further configured to cause the at least one service device processor to execute the containerised application of the plurality of containerised applications.
  • the containerised application is configured to decrypt the encrypted sub-device data received from the multicast network channel using the private key, prior to processing the sub-device data.
  • the program instructions are further configured to cause the at least one service device processor to execute the containerised application of the plurality of containerised applications.
  • the containerised application is configured to encrypt the processed data to generate encrypted processed data.
  • transmitting the processed data comprises transmitting the encrypted processed data.
  • storing the processed data comprises storing the encrypted processed data.
  • the program instructions are further configured to cause the at least one service device processor to: transmit a request to initialise a new containerised application to the data management device; retrieve the new containerised application; initialise the new containerised application; and transmit an installation confirmation indicating successful initialisation of the containerised application to the data management device.
  • the containerised application of the plurality of containerised applications is the new containerised application.
  • the data management program instructions are further configured to cause the at least one data management device processor to: receive the request to initialise the new containerised application; and transmit a licence key to the service device, the license key being associated with the containerised application.
  • the data management program instructions are further configured to cause the at least one data management device processor to: receive the request to initialise the new containerised application; and transmit a licence key to the service device, the license key being associated with the containerised application.
  • the computer-implemented method may comprise: receiving, by a data management device, a request from a service device to initialise the containerised application; transmitting, by the data management device, a license key to the service device, the license key being associated with the containerised application; retrieving, by the service device, the containerised application; initialising, by the service device, the containerised application using the license key; transmitting, by the service device, an installation confirmation indicating a successful initialisation of the containerised application to the data management device.
  • the computer-implemented method further comprises executing, by the service device, the containerised application.
  • the computer-implemented method further comprises transmitting, by the service device, the request to initialise the containerised application to the data management device in response to the service device receiving a request for access from a sub-device that is associated with the containerised application.
  • the computer- implemented method further comprises: transmitting, by the service device, the license key to a license validation service; and receiving, by the service device, a license validation indicating that the license key is valid.
  • receiving the containerised application comprises: downloading the containerised application from a software repository, over a network; and installing the containerised application.
  • a data management system for securely initialising a containerised application.
  • the data management system may comprise a service device.
  • the service device may comprise: at least one service device processor; and service device memory.
  • the service device memory may store program instructions accessible by the at least one service device processor.
  • the program instructions may be configured to cause the at least one service device processor to: transmit a request to initialise a containerised application to a data management device; retrieve the containerised application; initialise the containerised application; and transmit an installation confirmation indicating a successful initialisation of the containerised application to the data management device.
  • the data management system may comprise the data management device.
  • the data management device may comprise: at least one data management device processor; and data management device memory.
  • the data management device memory may store data management program instructions accessible by the at least one data management device processor.
  • the data management program instructions may be configured to cause the at least one data management device processor to: receive the request to initialise the containerised application; and transmit a licence key to the service device, the license key being associated with the containerised application.
  • the program instructions are further configured to cause the at least one service device processor to execute the containerised application.
  • the program instructions are further configured to cause the at least one service device processor to transmit the request to initialise the containerised application to the data management device in response to the service device receiving a request for access from a sub-device that is associated with the containerised application.
  • the program instructions are further configured to cause the at least one service device processor to: transmit the license key to a license validation service; and receive a license validation indicating that the license key is valid.
  • receiving the containerised application comprises: downloading the containerised application from a software repository, over a network; and installing the containerised application.
  • a multicast network e.g. an IP multicast network
  • a plurality which may also be referred to as a multi-number
  • multicast network channels which may also be referred to as data channels
  • an access control mechanism allows only specific applications to receive the designated sensor data is a deployment consideration of the present disclosure that improves content privacy among dynamic multicast group memberships.
  • the disclosure manages access to sub-device data provided to multicast channels by selectively providing an access key to one or more authorised users and/or containerised applications.
  • a method for providing access to multicast communications based on assignment of a license key which advantageously is configured by a central management system.
  • a method of managing of access to multicast communications by enabling access interaction of incoming data with selected applications by remote access management.
  • a system for managing access to multicast communications comprises: a container of applications residing in a service device, wherein each application in the container is selectively encrypted and assigned a license key; a plurality of sub-devices connecting to a service device; and a supervisor residing in the service device configured to authenticate access to the multicast communication, wherein the supervisor is configured to perform the following: receiving, from the sub-device, an assigned public key that identifies the sub-device when the sub-device requests access to the containerised application; authenticating the identity of the sub-device by verifying the private key to identify the application; directing the request data to a multicast channel when identities of the sub-device and the application are verified; transmitting the encrypted data from the sub-device to the application for processing.
  • the application will check incoming data from the multicast channel, and only the data that is intended for the application will be received and descripted by a call-back function. The data for other applications will be ignored by the application.
  • a computer program product comprising a plurality of data processor executable instructions that, when executed by a data processor in a system, cause the system to perform the method as detailed above.
  • a gateway device for securing multicast communications.
  • the gateway device comprises an authenticating module; a reporting module; and a key generation module. Incoming data is verified by managing the access remotely.
  • Figure 1 is a block diagram of a system for selectively processing data, according to some embodiments.
  • Figure 2 is a block diagram of another system for selectively processing data, according to some embodiments.
  • Figure 3 is a block diagram of another system for selectively processing data, according to some embodiments.
  • Figure 4 is a block diagram of another system for selectively processing data, according to some embodiments.
  • Figure 5 illustrates a table for enabling selective processing of sub-device data, according to some embodiments
  • Figure 6 illustrates a computer-implemented method for securely initialising a containerised application, according to some embodiments
  • Figure 7 illustrates another computer- implemented method for securely initialising a containerised application, according to some embodiments
  • Figure 8 illustrates a computer-implemented method for selectively processing data, according to some embodiments.
  • Figure 9 illustrates a block diagram of another system for selectively processing data, according to some embodiments.
  • application refers generally to a unit of executable software that implements a certain functionality or theme.
  • network refers to any type of telecommunications or data network.
  • a commercial, residential and/or industrial facility for example, a manufacturing facility, energy production facility, resource extraction facility, agricultural facility, public facility (such as road networks or public parks), construction sites, etc. may rely on one of more systems that comprise a variety of devices, machines or equipment to execute complex processes and process operations. When executing these processes and process operations, the systems and the operators of the systems can be required to consider a variety of operational parameters. These operational parameters can influence the design, deployment and operation of the relevant systems.
  • a system may comprise a plurality of sub-devices that are each configured to generate data relating to one or more operating parameters that are associated with that system.
  • the sub-devices may be configured to generate data relating to a common operating parameter (e.g. temperature data associated with different locations of the system).
  • the sub-devices may be configured to generate data relating to different operating parameters (e.g. one sub-device may be configured to generate temperature data and another sub-device may be configured to generate pressure data) of a region of the system.
  • the sub-devices may be configured to generate data that is indicative of a state of an environment of the sub-device (e.g. video data).
  • the data generated by a particular sub-device may be used for a plurality of different purposes.
  • sensor data from a sensor in an elevator can be processed for the purposes of considering a maintenance schedule of the elevator, in addition to considering whether one or more operational parameters are within safety limits associated with the elevator.
  • the data generated by the particular sub-device may be processed by a plurality of processing applications.
  • Each processing application may be associated with a particular purpose. For example, in the case of the elevator, a first processing application may process the sensor data when considering the maintenance schedule of the elevator and a second processing application may process the sensor data when considering safety parameters of the elevator. The first processing application and the second processing application may process the same sensor data simultaneously.
  • the data generated by a particular sub-device may be used for a plurality of different purposes.
  • sensor data from a sensor in an elevator can be processed for the purposes of considering a maintenance schedule of the elevator, in addition to considering whether one or more operational parameters are within safety limits associated with the elevator.
  • the data generated by the particular sub-device may be processed by a plurality of processing applications.
  • Each processing application may be associated with a particular purpose. For example, in the case of the elevator, a first processing application may process the sensor data when considering the maintenance schedule of the elevator and a second processing application may process the sensor data when considering safety parameters of the elevator. The first processing application and the second processing application may process the same sensor data simultaneously.
  • Various virtualisation technologies and application container technologies enable computing devices to host a large number of applications without modification to the computing device, or with reduced modification requirements.
  • application containerisation is a virtualisation method used to deploy and run applications without launching an entire virtual machine for each application. Multiple isolated applications may run on a single host computing device and access the same operating system kernel.
  • Enabling processing applications to simultaneously process the same data provided by a sub-device for a plurality of different purposes may be technically difficult.
  • a common data path between the processing applications may be provided to enable the data to be provided and processed by each of the processing applications as it is received.
  • the present disclosure enables processing of the same incoming data by a plurality of processing applications.
  • the incoming data can therefore be simultaneously processed to provide different data outputs for a variety of purposes.
  • incoming data is selectively managed so that it is securely transmitted, and interacted with by a reduced number of processing applications.
  • Embodiments of the present disclosure provide a system for managing access to multicast communications and providing connectivity securely between communication devices wirelessly.
  • FIG. 1 is a block diagram illustrating a system 100 that is configured to selectively process data.
  • the system 100 may be referred to as a data management system or a system for processing data.
  • the system 100 may be considered a system for managing access to multicast communications.
  • the system 100 comprises a service device 102.
  • the system 100 comprises a data management device 118.
  • the system comprises a sub-device 107.
  • the sub-device 107 is configured to generate sub-device data, and to provide the sub-device data to the service device 102.
  • the service device 102 is configured to broadcast the sub-device data to a multicast network channel of a multicast network 116.
  • the multicast network channel is associated with that sub-device 107, so, where there are multiple sub-devices 107, the sub-device data from each sub-device 107 is broadcast to a respective multicast network channel that is associated with the respective sub-device 107.
  • a containerised application 112 of the service device 102 is configured to process the sub-device data to generate processed data.
  • the service device 102 is configured to transmit the processed data to the data management device 118.
  • the service device 102 comprises at least one service device processor 104 in communication with service device memory 106.
  • the at least one service device processor 104 is configured to execute service device program instructions stored in service device memory 106 to cause the service device 102 to function as described herein.
  • the service device program instructions are accessible by the at least one service device processor 104, and are configured to cause the at least one service device processor 104 to function as described herein.
  • the service device program instructions are in the form of program code.
  • the at least one service device processor 104 comprises one or more microprocessors, central processing units (CPUs), application specific instruction set processors (ASIPs), application specific integrated circuits (ASICs) or other processors capable of reading and executing program code.
  • the service device program instructions comprise a supervisor module 108 as is described in more detail herein.
  • the service device program instructions also comprise a sub-device data module 110 as is described in more detail herein.
  • Service device memory 106 may comprise one or more volatile or non-volatile memory types.
  • service device memory 106 may comprise one or more of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM) or flash memory.
  • Service device memory 106 is configured to store program code accessible by the at least one service device processor 104.
  • the program code may comprise executable program code modules.
  • service device memory 106 is configured to store executable code modules configured to be executable by the at least one service device processor 104.
  • the executable code modules when executed by the at least one service device processor 104 cause the at least one service device 102 to perform certain functionality, as described herein.
  • the supervisor module 108 and the sub-device data module 110 are in the form of program code stored in the service device memory 106.
  • At least one containerised application 112 is stored in service device memory 106.
  • a plurality of containerised applications 113 are stored service device memory 106.
  • the plurality of containerised applications 113 may comprise a first containerised application 112, a second containerised application 112 etc.
  • One or more containerised application 112 may be stored in a container 114.
  • the plurality of containerised applications 113 is stored in the container 114.
  • the system 100 comprises the data management device 118.
  • the service device 102 is configured to communicate with the data management device 118 using a communications network 120.
  • the system 100 comprises a sub-device 107.
  • the system 100 comprises a plurality of sub-devices 109.
  • the service device 102 is configured to communicate with each sub-device 107 of the plurality of sub-devices 109 using the communications network 120.
  • a sub-device may also be referred to as data collection device.
  • the service device 102 comprises a service device network interface (not shown).
  • the service device network interface is configured to enable the service device 102 to communicate with other computing devices using one or more communications networks (e.g. the communications network 120).
  • the service device network interface is configured to enable the service device 102 to communicate with the data management device 118 and/or each sub-device 107 of the plurality of sub-devices 109.
  • the service device network interface may comprise a combination of network interface hardware and network interface software suitable for establishing, maintaining and facilitating communication over a relevant communication channel.
  • Examples of a suitable communications network include a cloud server network, wired or wireless internet connection, BluetoothTM or other near field radio communication, and/or physical media such as a Universal Serial Bus (USB) connection.
  • a cloud server network wired or wireless internet connection
  • BluetoothTM or other near field radio communication BluetoothTM or other near field radio communication
  • physical media such as a Universal Serial Bus (USB) connection.
  • USB Universal Serial Bus
  • the service device 102 comprises a service device user interface (not shown), whereby one or more user(s) can submit requests to the service device 102, and whereby the service device 102 can provide outputs to the user(s).
  • the service device user interface may comprise one or more user interface components, such as one or more of a display device, a touch screen display, a keyboard, a mouse, a camera, a microphone, buttons, switches and lights.
  • the user(s) may connect to, and control the service device 102 remotely using the service device user interface.
  • the service device user interface may be in the form of a portal accessible over a network (e.g. the communications network 120) from another computing device.
  • the service device 102 comprises a multicast network 116.
  • the multicast network 116 comprises a plurality of multicast network channels.
  • the multicast network 116 may also be referred to as a multicast bus.
  • the service device 102 is configured to provide sub-device data that is received from a sub-device 107 to a multicast network channel.
  • each sub-device 107 of the plurality of sub-devices 109 is associated with its own multicast network channel. That is, the sub-device data provided by a first sub-device 107 of the plurality of sub-devices 109 may be provided to a first multicast network channel.
  • the sub-device data provided by a second sub-device 107 of the plurality of sub-devices 109 may be provided to a second multicast network channel.
  • the multicast network 116 may comprise the same number of multicast network channels as there are sub-devices 107 that are in communication with the service device 102.
  • Each sub-device 107 of the plurality of sub-devices 109 may be associated with its own multicast network channel to which its sub-device data is provided.
  • Providing sub-device data to a multicast network channel may comprise streaming the sub-device data to the network channel.
  • Each containerised application 112 when executed by the at least one service device processor 104, is configured to receive data from the multicast network 116.
  • each containerised application 112 is configured to receive data from one or more of the multicast network channels.
  • the at least one service device processor 104 is configured to provide data to one or more the containerised applications 112 of the plurality of containerised applications 113 using the multicast network 116.
  • the service device 102 manages the access each sub-device 107 of the plurality of sub-devices 109 has to each containerised application 112 of the plurality of containerised applications 113.
  • the service device 102 may control or provide access to authorised sub-devices 107 and applications 112 installed on the service device 102. Access control may be provided when users (i.e. an operator of the service device 102 and/or the data management device 118) permit access of their service device 102 and the installed application 112 on each service device 102. Where there are multiple different applications 112 installed on each service device 102 under different users, access control may be provided by the specific owner of the service device 102 and the application 112. Taken as a whole, there is provided a method of efficient management of access to allow selective interaction of containerised applications 112 with incoming data from the sub-devices.
  • the service device 102 (also known as an IGX) connects to one or more of the plurality of sub-devices 109, and is configured to facilitate access by propagating sub-device data from the plurality of sub-devices 109 to a multiple number of containerised applications (which may also be referred to as virtual appliances).
  • the service device 102 comprises a supervisor unit 108 configured to manage the access or rights to a group or identity.
  • the supervisor unit 108 may also be referred to as supervisor module.
  • the supervisor unit 108 further provides a secure medium for information exchange. As such, the supervisor unit 108 performs various actions associated with security control. These can include managing the receipt, storage, sending and interpretation of entitlements.
  • the service device 102 also comprises the multicast network 116, which is configured to enable segregating logically the containerised applications 112 by interacting with the sub-device data from authorised sub-devices 107.
  • the multicast network 116 is configured to enable segregating logically the containerised applications 112 by interacting with the sub-device data from authorised sub-devices 107.
  • Embodiments of the present disclosure provide a method for managing the access to multicast communications for providing connectivity securely between communication devices wirelessly.
  • the data management device 118 comprises at least one data management device processor 122 in communication with data management device memory 124.
  • the at least one data management device processor 122 is configured to execute data management device program instructions stored in data management device memory 124 to cause the data management device 118 to function as described herein.
  • the data management device program instructions are accessible by the at least one data management device processor 122, and are configured to cause the at least one data management device processor 122 to function as described herein.
  • the data management device program instructions are in the form of program code.
  • the at least one data management device processor 122 comprises one or more microprocessors, central processing units (CPUs), application specific instruction set processors (ASIPs), application specific integrated circuits (ASICs) or other processors capable of reading and executing program code.
  • At least one available containerised application 126 is stored in data management device memory 124.
  • a plurality of available containerised applications 127 are stored in data management device memory 124.
  • the available containerised applications 127 comprises containerised applications 126 that are available for the service device 102 to retrieve, when the service device 102 has the correct authorisation.
  • the plurality of available containerised applications 127 may be made available within a marketplace 128.
  • the marketplace 128 is hosted by the data management device 118.
  • the data management device 118 is configured to communicate with the service device 102 using the communications network 120.
  • the data management device 118 is configured to communicate with the plurality of sub-devices 109 using the communications network 120.
  • the data management device 118 comprises a data management device network interface (not shown).
  • the data management device network interface is configured to enable the data management device 118 to communicate with other computing devices using one or more communications networks (e.g. the communications network 120).
  • the data management device network interface is configured to enable the data management device 118 to communicate with the service device 102 and/or each sub-device 107 of the plurality of sub-devices 109.
  • the data management device network interface may comprise a combination of network interface hardware and network interface software suitable for establishing, maintaining and facilitating communication over a relevant communication channel.
  • the data management device 118 comprises a data management service (or software).
  • the data management device 118 may also be referred to in this disclosure as a DLC.
  • the data management device 118 is configured to connect to the service device 102 via a communication means.
  • the communication means may be the communications network 120.
  • the service device 102 may also be referred to as an IGX.
  • the data management device 118 is configured to receive processed sub-device data from the service device 102.
  • the data management device 118 is configured to manage the processed sub-device data centrally.
  • the data management device 118 is configured to receive processed sub-device data from a plurality of services devices 102. In these cases, the data management device 118 is configured to integrate data from one or more service device 102.
  • the data management device 118 comprises a data management device user interface (not shown), whereby one or more user(s) can submit requests to the data management device 118, and whereby the data management device 118 can provide outputs to the user(s).
  • the data management device user interface may comprise one or more user interface components, such as one or more of a display device, a touch screen display, a keyboard, a mouse, a camera, a microphone, buttons, switches and lights.
  • the user(s) may connect to, and control the data management device 118 remotely using the data management device user interface.
  • the data management device user interface may be in the form of a portal accessible over a network from another computing device.
  • the data management device 118 hosts the marketplace 128 of available containerised applications 127.
  • the marketplace 128 may provide a source of software applications and services, including native cloud applications.
  • the marketplace 118 of applications may provide a number of marketplace functions and services for the various types of data processing applications, for multiple purposes.
  • An example of such marketplace is a cloud marketplace.
  • the data management device 118 manages access control and may be configured to enable access to user, the service device 102, sub-devices 107, multicast channels, containerised applications 112 and licenses and subscription of applications.
  • the data management device 118 manages the configured access mechanisms for remote resource services and secure connections to remote networks.
  • the data management device 118 also comprises an application deployment module (not shown), in which the hosted applications of the marketplace 128 may be provided.
  • the deployment module manages the deployment of the available containerised applications 126 and applications in the virtual machine (the service device 102), such as downloading, installation or the removal of the containerised applications 112 and virtual appliances.
  • the data management device 118 may be configured to communicate with the service device 102 to enable selective deployment of available containerised applications 127 and control accessibility of the containerised applications 112 with respect to the multicast network channels.
  • the system 100 comprises a plurality of sub-devices 109.
  • Each sub-device 107 of the plurality of sub-devices 109 comprises at least one sub-device processor 130 in communication with sub-device memory 132.
  • the at least one sub-device processor 130 is configured to execute sub-device program instructions stored in sub-device memory 132 to cause the sub-device 107 to function as described herein.
  • the sub-device program instructions are accessible by the at least one sub-device processor 130, and are configured to cause the at least one sub-device processor 130 to function as described herein.
  • the sub-device program instructions are in the form of program code.
  • the at least one sub-device processor 130 comprises one or more microprocessors, central processing units (CPUs), application specific instruction set processors (ASIPs), application specific integrated circuits (ASICs) or other processors capable of reading and executing program code.
  • Sub-device memory 132 may comprise one or more volatile or non-volatile memory types.
  • sub-device memory 132 may comprise one or more of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM) or flash memory.
  • Sub-device memory 132 is configured to store program code accessible by the at least one sub-device processor 130.
  • the program code may comprise executable program code modules.
  • sub-device memory 132 is configured to store executable code modules configured to be executable by the at least one sub-device processor 130.
  • the executable code modules when executed by the at least one sub-device processor 130 cause the sub-device 107 to perform certain functionality, as described herein.
  • Sub-device information is stored in sub-device memory 132.
  • the sub-device information is related to the particular sub-device 107.
  • the sub-device information may comprise one or more of a sub-device serial number, a sub-device Media Access Control (MAC) address and a sub-device model number, a sub-device identifier and a random key.
  • MAC Media Access Control
  • the sub-device information is stored in one or more memory blocks of the sub-device memory 132 of the relevant sub-device 107.
  • the one or more memory blocks may be predetermined. That is, the one or more memory blocks may be known and specifically designated to store the sub-device information.
  • the sub-device information may be stored in service device memory 106.
  • the random key may be stored in a Trusted Platform Module (TPM) of service device memory 106.
  • TPM Trusted Platform Module
  • the sub-device 107 may retrieve the random key from the TPM of the service device.
  • the service device 102 Upon an initial boot, the service device 102 checks for the presence of a TPM module in service device memory 106. If a TPM module is visible to the at least one service device processor 104, the at least one service device processor 104 creates a random key. The at least one service device processor 104 stores the random key in service device memory 106. The random key may be stored in a database. The random key may be 16 bytes. The at least one service device processor 104 creates a hardware signature. The at least one service device processor 104 creates the hardware signature based on a Media Access Control (MAC) address of a Local Area Network (LAN) port of the service device 102. The hardware signature may be generated using a SHA256 checksum generator.
  • MAC Media Access Control
  • LAN Local Area Network
  • the hardware signature may be generated by running the MAC address through the SHA256 checksum generator.
  • the at least one service device processor 104 stores the hardware signature in service device memory 106.
  • the at least one service device processor 104 combines the hardware signature with the random key to form a combined key.
  • the combined key may be 32 bytes.
  • the at least one service device processor 104 stores the combined key in service device memory 106.
  • the at least one service device processor 104 may appropriately format and mount a partition of the service device memory 106 that is associated with the random key.
  • the at least one service device processor 104 may then execute a software module (e.g. the supervisor unit 108) to perform functionality described herein.
  • a software module e.g. the supervisor unit 108
  • Each sub-device 107 of the plurality of sub-devices 109 is configured to generate sub-device data.
  • the sub-device data is indicative of one or more sub-device parameters.
  • a sub-device 107 may comprise a sub-device sensor 134 that is configured to respond to a sensor parameter.
  • the one or more sub-device parameters of that sub-device 107 comprises the sensor parameter.
  • a sensor characteristic associated with the sub-device sensor 134 may change in response to a change in the sensor parameter.
  • the sub-device 107 is configured to measure the sensor characteristic to determine a value that is indicative of the sensor characteristic.
  • the sub-device 107 is configured to store the value that is indicative of the sensor characteristic.
  • the sub-device 107 may store the value in sub-device memory 132.
  • the sub-device 107 is configured to store a time-series of values of the sensor characteristic.
  • the sub-device 107 may store the time-series in sub-device memory 132.
  • the sub-device data comprises the value that is indicative of the sensor characteristic, or the time-series of values of the sensor characteristic.
  • the sub-device sensor 134 may be in the form of a temperature sensor.
  • a resistance of the temperature sensor may change in response to a change in temperature of the temperature sensor.
  • the sensor characteristic may be the resistance of the temperature sensor.
  • the value that is indicative of the sensor characteristic may be the value of the resistance of the temperature sensor at a given time, which can be correlated to a temperature of the temperature sensor.
  • one or more of the sub-devices 107 may comprise one or more of a temperature sensor, a pressure sensor, an acceleration sensor, a vibration sensor, a position sensor (e.g. a Global Positioning System module configured to determine a position estimate of the sub-device), a chemical sensor, an acoustic sensor, a flow sensor, a light sensor (e.g. an optical camera), a humidity sensor, a motion sensor, a force sensor, a magnetic sensor, an antenna and a Near Field Communication sensor.
  • one or more of the sub-device sensors 134 may comprise, or be in the form of at least one of the aforementioned sensors.
  • the system 100 may be considered an “Internet of Things” (IoT) system. Therefore, the service device 102 may be considered an IoT gateway device. Furthermore, each of the sub-devices 102 may be referred to as an IoT device.
  • IoT Internet of Things
  • Each sub-device 107 is configured to communicate with the service device 102 using the communications network 120. In some embodiments, one or more of the sub-devices 107 are configured to communicate with the data management device 118 using the communications network 120.
  • each sub-device 107 of the plurality of sub-devices 109 comprise a respective sub-device network interface (not shown).
  • the sub-device network interface is configured to enable the respective sub-device 107 to communicate with other computing devices using one or more communications networks (e.g. the communications network 120).
  • the sub-device network interface is configured to enable the sub-device 107 to communicate with the service device 102, another sub-device 107 and/or the data management device 118.
  • the sub-device network interface may comprise a combination of network interface hardware and network interface software suitable for establishing, maintaining and facilitating communication over a relevant communication channel.
  • each sub-device 107 comprises a respective sub-device user interface (not shown), whereby one or more user(s) can submit requests to the respective sub-device 107, and whereby the sub-device 107 can provide outputs to the user(s).
  • the sub-device user interface may comprise one or more user interface components, such as one or more of a display device, a touch screen display, a keyboard, a mouse, a camera, a microphone, buttons, switches and lights.
  • the user(s) may connect to, and control the sub-device 107 remotely using the sub-device user interface.
  • the sub-device device user interface may be in the form of a portal accessible over a network from another computing device.
  • the service device 102 is configured to connect to one or more of the plurality of sub-devices 109 via the communication means.
  • the data management device 118, the service device 102 and the plurality of sub-devices 109 are configured to connect for the communication of data from one device to another device.
  • the communications network 120 can comprise a plurality of communications networks.
  • the service device 102 may be configured to communicate with the data management device 118 using a first communications network.
  • the service device 102 may be configured to communicate with one or more of the sub-devices 107 using another communications network.
  • the communications network 120 may be said to comprise a first communications network and a second communications network.
  • the service device 102 is configured to communicate with each sub-device 107 using a different communications network.
  • the service device 102 may be configured to communicate with the data management device 118 using a data management device communications network.
  • the service device 102 may be configured to communicate with each sub-device 107 using a respective sub-device communications network.
  • the communications network 120 may be said to comprise the data management device communications network (a first communications network) and the plurality of sub-device communications networks (second, third etc. communications networks).
  • FIG. 2 is a block diagram illustrating another embodiment of the system 100.
  • the service device 102 is configured to communicate with the data management device 118 using a first communications network 120A.
  • the system 100 comprises Q sub-devices 107.
  • Each sub-device 107 is configured to communicate with the service device 102 using a respective sub-device communications network 120B(A-Q).
  • the previously described communications network 120 can be said to comprise the first communications network 120A and each of the sub-device communications networks 120V(A-Q).
  • the service device network interface and the respective sub-device network interfaces may facilitate this communication.
  • Examples of a suitable first communications network 120A include a cloud server network, wired or wireless internet connection, BluetoothTM or other near field radio communication, and/or physical media such as a Universal Serial Bus (USB) connection.
  • Examples of suitable sub-device communications networks 120B(A-Q) include cloud server networks, wired or wireless internet connections, BluetoothTM or other near field radio communications, and/or physical media such as a Universal Serial Bus (USB) connections.
  • FIG. 3 is a block diagram illustrating another embodiment of the system 100.
  • the service device 102 is configured to communicate with the data management device 118 using the first communications network 120A.
  • Each sub-device 107 is configured to communicate with the service device 102 using a respective sub-device communications network 120B(A-Q).
  • the previously described multicast network 116 is in the form of a multicast bus 116A.
  • Each sub-device 107 of the plurality of sub-devices 109 is configured to communicate with the multicast bus 116A.
  • the sub-device data that each sub-device 107 provides to the service device 102 is provided to the multicast bus 116A.
  • the at least one service device processor 104 may be configured to provide the sub-device data to the multicast bus 116A as is described herein (e.g. with reference to the multicast network 116).
  • one or more of the containerised applications 112 is configured to receive data from the multicast bus 116A.
  • sub-device data provided by the sub-devices 107 is provided directly to the multicast bus 116A as illustrated in Figure 3.
  • the at least one service device processor 104 receives sub-device data provided by the sub-devices 107 (e.g. via the sub-device network interface) and provides the sub-device data to the multicast bus 116A as is described herein.
  • Figure 4 is a block diagram illustrating another embodiment of the system 100.
  • one or more of the sub-devices 107 is configured to generate a respective data stream 142A-Q.
  • the data stream 142A-Q may be a data stream of sub-device data.
  • Each sub-device 107 is configured to provide the data stream 142A-Q to a forwarder 138 via a machine-to-machine communication system 136.
  • the machine-to-machine communication system 136 and the forwarder 138 may be the at least one service device processor 104.
  • the machine-to-machine communication system 136 may comprise the service device network interface and/or the sub-device network interfaces.
  • the machine-to-machine communication system 136 is configured to aggregate the data streams 142A-Q provided by each of the sub-devices 107 into an aggregated data stream 144.
  • the machine-to-machine communication system 136 is configured to provide the aggregated data stream 144 to the forwarder 138.
  • the forwarder 138 is configured to provide (or forward) the aggregated data stream 144 to the multicast bus 116A of the service device 102.
  • the multicast bus 116A is configured to provide one data stream of the plurality of data streams 142A-Q to each multicast network channel of the multicast bus 116A.
  • the system 100 illustrated in Figure 4 comprises a plurality of containers 114A-Q.
  • Container A 114A may be considered a first container.
  • Container B may be considered a second container.
  • Container Q may be considered a Qth container.
  • Each of the containerised applications 112 are configured to operate within a respective container of the plurality of containers 114A-Q.
  • the system 100 comprises a plurality of Software Development Kits (SDKs) 140A-Q.
  • SDKs Software Development Kits
  • Each containerised application 112 is associated with a respective SDK 140A-Q.
  • each containerised application 112 comprises a respective SDK 140A-Q.
  • Each SDK 140A-Q checks for sub-device data on a multicast network channel.
  • the SDK 140A-Q receives sub-device data intended for the corresponding containerised application 112 for processing.
  • the sub-device data from other sources i.e. the sub-device data of other multicast network channels
  • SDK A 140A which may be referred to as a first SDK, receives sub-device data from the data stream 142 A of a first sub-device 107 and the data stream 142B of a second sub-device 107 and provides these data streams to a first containerised application 112.
  • SDK B 140B which may be referred to as a second SDK, receives sub-device data from each of the data streams 140A-Q and provides these data streams to a second containerised application 112.
  • the SDKs enable selective provision of data streams to the containerised applications 112.
  • SDKs 140A-Q enables secure communications between the containerised applications 112 and the plurality of sub-devices 109.
  • the SDKs 140A-Q enable authentication, authorisation and encryption/decryption of data packets, and are thereby employed to enable secure communication.
  • system 100 of Figure 4 comprises the plurality of containers 114A-Q, it will be understood that each of the containerised applications 112 may operate within one container 114 (i.e. a common container).
  • FIG. 9 is a block diagram illustrating another embodiment of the system 100.
  • one or more containerised applications 112 are configured to be in communication with the forwarder 138.
  • the forwarder 138 may be as previously described.
  • the one or more containerised applications 112 are configured to be in communication with the forwarder over a UDP data communication network 139.
  • the forwarder 138 is also configured to be in communication with other devices via a Machine-to-Machine MODBUS module 141.
  • the forwarder 138 is also configured to be in communication with other devices via a Machine-to-Machine EIP module 143.
  • the forwarder 138 is also configured to be in communication with other devices via a Machine-to-Machine MQQT module 147.
  • the forwarder 138 is configured to communicate with the data management device 118 using the Machine-to-Machine MQQT module 147.
  • the forwarder 138 may also be configured to communicate with the service device memory 106 via the Machine-to-Machine MQQT module 147.
  • the forwarder 138 is configured to communicate with other devices via a Machine-to-Cloud DDS module 149.
  • the forwarder 138 may be configured to communicate with the containerised applications 112 via the UDP data communication network 139.
  • the forwarder 138 may be configured to communicate with another device using the Machine-to-Machine MODBUS module 141, the Machine-to-Machine EIP module 143, the Machine-to-Machine MQQT module 147, the data management device 118, the device memory 106 and the Machine-to- Cloud DDS module 149 via the UDP data communication network 139.
  • the system 100 of Figure 9 comprises a supervisor 108.
  • the supervisor 108 may be in the form of the supervisor module 108 described herein.
  • the supervisor 108 is configured to communicate with other devices via one or more of the Machine-to-Machine MODBUS module 141, Machine-to-Machine EIP module 143, Machine-to-Machine MQQT module 147 and Machine-to-Cloud DDS module 149 and a TCP/IP communication network 151.
  • the supervisor 118 may be configured to communicate with the containerised applications 112 via a UDP control communication network 153.
  • the service device 102 comprises one or more of the containerised applications 112, forwarder 138, supervisor 108, the Machine-to-Machine MODBUS module 141, the Machine-to-Machine EIP module 143, the Machine-to-Machine MQQT module 147 and the Machine-to- Cloud DDS module 149.
  • Figure 5 illustrates a table 145 for enabling selective processing of sub-device data by specific containerised applications 114.
  • the mapping table 145 identifies which containerised applications 112 are authorised to process sub-device data provided by a particular sub-device 107.
  • the mapping table 145 defines the mapping of a sub-device 107, a deployed containerised application 112, as well as the destination of the processed sub-device data.
  • the mapping table 145, or a portion thereof may be stored in the service device memory 106.
  • the mapping table 145, or a portion thereof, may also be stored in the data management device memory 124.
  • the mapping table 145, or a portion thereof, may be stored in the sub-device memory 132.
  • the identities are known for both the sub-device 107, from which sub-device data is received and the containerised application 112, to which the sub-device data is to be transmitted or provided for processing.
  • Both the sub-device 107 and the containerised application 112 are authenticated, by verifying an identity of the sub-device 107, to ensure authenticity prior to deploying the containerised application 112.
  • the sub-device 107 and the containerised application 112 are authenticated as is described herein.
  • supervisor application which may also be referred to as a supervisor module 108.
  • the method comprises the following steps:
  • Step 1 Installing a containerised application 112. a) Initiating request to install an application selected from the marketplace 128 of the data management device 118. b) Obtaining a license key that corresponds to the selected application. c) Installing the selected application.
  • Step 2 Initiating and running the selected application by providing the license key corresponding to the application.
  • Step 3 Limiting access to the selected application. a) Assigning private keys to sub-devices to identify authorised users. b) Authenticating, by requesting the private key, when a sub-device sends request data to request access to the selected application. c) Directing the request data to a multicast channel if the sub-device is authorised, and rejecting any unauthorised requests.
  • Step 4 Selectively manage the interaction of data flow by transmitting the multicast data to the selected application for processing. All other data from other sources is not processed.
  • the service device 102 is configured to selectively process data by way of data control.
  • This data control may be defined by selecting the source data to be processed.
  • the source data can be in the form of sensor data, or sub-device data.
  • Data control may also be defined by selecting the containerised applications 112 to process the source data.
  • Containerised applications 112 may be selected to be deployed to permit processing the data from the source.
  • Data control may be further configured to selectively process the source data by transmitting the data to an allowed destination. This is advantageous to control the interaction of incoming data with selected containerised applications 112, by giving access to particular data feed to a particular containerised application 112, thereby providing a secure environment.
  • Figure 6 illustrates a computer- implemented method 200 as performed by the system 100 for securely initialising a containerised application 152.
  • Figure 6 is to be understood as a blueprint for a software program and may be implemented step-by-step, such that each step in Figure 6 is represented by a function in a programming language, such as C++ or Java.
  • the resulting source code is then compiled and stored as computer executable instructions on one or more of service device memory 106 and data management device memory 124, or implemented in a different computer environment.
  • the containerised application 152 is one of the plurality of available containerised applications 127 described previously.
  • the service device 102 transmits a request to install a containerised application 152 to the data management device 118.
  • the at least one service device processor 104 generates the request and transmits the request to the data management device 118.
  • the containerised application 152 may be a new containerised application 152. That is, the containerised application 152 may not be installed on the service device 102 at the time the request is transmitted.
  • the at least one service device processor 104 may transmit the request to the data management device using the service device network interface and the communications network 120 (or the first communications network described previously, where applicable).
  • the request comprises a containerised application identifier that identifies the containerise application 152.
  • the containerised application 152 may be one of a plurality of available containerised applications 127 that are available on the marketplace 128.
  • the service device 102 may transmit the request to initialise the containerised application 152 to the data management device 118 in response to the service device 102 receiving a request for access from a sub-device 107 that is associated with the containerised application 152.
  • a particular sub-device 107 may be configured to generate sub-device data for processing by the containerised application 152.
  • a user of the system 100 may attempt to connect this sub-device 107 to the service device 102 and/or the data management device 118.
  • the service device 102 may transmit the request to initialise the containerised application 152 to the data management device 118.
  • the data management device 118 receives the request to initialise the containerised application 152 from the service device 102.
  • the at least one data management device processor 122 receives the request to initialise the containerised application 152 from the service device 102.
  • the at least one data management device processor 122 may receive the request using the data management device network interface and the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the data management device 118 transmits a license key that is associated with the containerised application 152 to the service device 102.
  • the at least one data management device processor 122 transmits the license key that is associated with the containerised application 152 to the service device 102.
  • the license key may be stored in data management device memory 124.
  • the at least one data management device processor 122 may transmit the license key using the data management device network interface and the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the service device 102 receives the license key from the data management device 118.
  • the at least one service device processor 104 receives the license key from the data management device 118.
  • the at least one service device processor 104 may receive the license key using the service device network interface and the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the service device 102 transmits the license key to a license validation service 146.
  • the at least one service device processor 104 transmits the license key to a license validation service 146.
  • the at least one service device processor 104 may transmit the license key using the service device network interface and the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the license validation service 146 may be a third party that is authorised to validate license keys associated with containerised applications 112 of the plurality of available containerised applications 127.
  • the owner and/or operator of the data management device 118 and/or service device 102 may also be an owner and/or operator of the license validation service 146.
  • the license validation service 146 receives the license key from the service device 102.
  • the license validation service 146 may receive the license key using the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the license validation service 146 validates the license key.
  • the license validation service 146 may validate the license key by comparing the license key to a pre-existing license key register. Alternatively, the license validation service 146 may validate the license key by using the license key as an input to a license key validation algorithm, and validating the output of the license key validation algorithm.
  • the license validation service 146 transmits a license validation to the service device 102.
  • the license validation is indicative of the validity of the license key.
  • the license validation may indicate that the license key is valid where this has been determined by the license validation service 146.
  • the license validation may indicate that the license key is not valid where this has been determined by the license validation service 146.
  • the license validation service 146 may transmit the license validation using the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the service device 102 receives the license validation.
  • the at least one service device processor 104 receives the license validation from the license validation service 146.
  • the license validation may indicate that the license key is valid.
  • the license validation may indicate that the license key is invalid.
  • the service device 102 may receive the license validation using the service device network interface and/or the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the service device 102 retrieves the containerised application 152.
  • the at least one service device processor 104 retrieves the containerised application 152 and stores the containerised application 152 in service device memory 106.
  • retrieving the containerised application 152 comprises downloading the containerised application 152 from a software repository.
  • retrieving the containerised application 152 comprises downloading the containerised application 152 from the data management device 118.
  • retrieving the containerised application 152 comprises downloading the containerised application 152 from the marketplace 128.
  • the service device 102 may retrieve the containerised application 152 using the service device network interface and/or the communications network 120 (or the first communications network 120A described previously, where applicable).
  • Retrieving the containerised application 152 may also comprise installing the containerised application 152 on the service device 102.
  • the service device 102 initialises the containerised application 152.
  • the service device 102 may initialise the containerised application 152 using the license key.
  • the at least one service device processor 104 initialises the containerised application 152.
  • the at least one service device processor 104 may initialise the containerised application 152 by executing the containerised application 152.
  • the at least one service device processor 104 is configured to execute the containerised application 152 to process sub-device data.
  • the service device 102 transmits an installation confirmation to the data management device 118.
  • the at least one service device processor 104 transmits the installation confirmation to the data management device 118.
  • the installation confirmation may indicate a successful installation of the containerised application 152.
  • the containerised application 152 fails to install, or fails to initiate correctly, the installation confirmation may indicate an unsuccessful installation.
  • Transmitting an installation confirmation to the data management device 118 may comprise generating the installation confirmation.
  • the service device 102 may transmit the installation confirmation using the service device network interface and/or the communications network 120 (or the first communications network 120A described previously, where applicable).
  • Figure 7 illustrates an alternative computer- implemented method 300 as performed by the system 100 for securely initialising the containerised application 152.
  • Figure 7 is to be understood as a blueprint for a software program and may be implemented step-by-step, such that each step in Figure 7 is represented by a function in a programming language, such as C++ or Java.
  • the resulting source code is then compiled and stored as computer executable instructions on one or more of service device memory 106 and data management device memory 124, or implemented in a different computer environment.
  • the containerised application 152 is one of the plurality of available containerised applications 127 described previously.
  • the license key is validated after initialisation of the containerised application 152. That is, steps 202, 204, 206, 208 and 220 described with reference to the method 200 are applicable to the method 300. In some embodiments, steps 202, 204, 206,
  • the service device 102 initialises the containerised application 152.
  • the at least one service device processor 104 initialises the containerised application 152.
  • the at least one service device processor 104 may initialise the containerised application 152 by executing the containerised application 152.
  • the service device 102 by executing the containerised application 152, generates a license key validation request.
  • at least one service device processor 104 by executing the containerised application 152, generates the license key validation request.
  • the license key validation request may comprise the licence key.
  • the service device 102 transmits the license key validation request to the license validation service 146.
  • the at least one service device processor 104 transmits the license key validation request to the license validation service 146.
  • the at least one service device processor 104 may transmit the license key validation request using the service device network interface and/or the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the license validation service 146 receives the license key from the service device 102.
  • the license validation service 146 may receive the license key using the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the license validation service 146 validates the license key.
  • the license validation service 146 may validate the license key by comparing the license key to a pre-existing license key register. Alternatively, the license validation service 146 may validate the license key by using the license key as an input to a license key validation algorithm, and validating the output of the license key validation algorithm.
  • the license validation service 146 transmits a license validation to the service device 102.
  • the license validation is indicative of the validity of the license key.
  • the license validation may indicate that the license key is valid where this has been determined by the license validation service 146.
  • the license validation may indicate that the license key is not valid where this has been determined by the license validation service 146.
  • the license validation service 146 may transmit the license validation using the communications network 120 (or the first communications network 120A described previously, where applicable).
  • the service device 102 provides the license validation to the containerised application 152 being executed by the service device 102.
  • the service device 102 also provides a private key to the containerised application 152.
  • the private key enables the containerised application to decrypt encrypted sub-device data that is received from the multicast network 116 as is described herein.
  • the at least one service device processor 104 is configured to execute the containerised application 152 to process sub-device data.
  • Figure 8 illustrates a computer-implemented method 400 as performed by the system 100 for selectively processing data.
  • Figure 8 is to be understood as a blueprint for a software program and may be implemented step-by-step, such that each step in Figure 8 is represented by a function in a programming language, such as C++ or Java.
  • the resulting source code is then compiled and stored as computer executable instructions on one or more of service device memory 106, data management device memory 124 and sub-device memory 132, or implemented in a different computer environment.
  • the data management device 118 transmits commands and configuration data (such as license key, application ID and mapping table) to the service device 102.
  • the service device 102 checks and verifies the configuration data.
  • the configuration data will be stored in a database if the data is correct and correctly formatted.
  • the service device 102 receives a request for access from a sub-device 107.
  • the at least one service device processor 104 receives the request for access from the sub-device 107.
  • the service device 102 may receive the request for access using the service device network interface, via the communications network 120 or the relevant sub-device communications network 120B(A-Q).
  • the request for access may be associated with one or more containerised applications 112 of the plurality of containerised applications 113. That is, the sub-device 107 may, with the request for access, request access to one or more containerised applications 112 of the plurality of containerised applications 113.
  • the relevant containerised applications 112 may be configured to process sub-device data generated by the sub-device 107.
  • the request for access comprises sub-device information that is associated with the sub-device 107.
  • the sub-device information may comprise one or more of a sub-device serial number, a sub-device Media Access Control (MAC) address, a sub-device model number, a sub-device identifier and a random key.
  • the random key may be as previously described.
  • the request for access is authorised based at least in part on the sub-device information.
  • the service device 102 receives authorisation to enable access.
  • the at least one service device processor 104 receives authorisation the request for access.
  • the at least one service device processor 104 may authorise the request for access by comparing the sub-device information to a pre-existing database of authorised sub-devices. By this comparison, the at least one service device processor 104 may confirm that the sub-device 107 that is associated with the received request for access is authorised to communicate with the service device 102 and/or one or more containerised application 112 of the plurality of containerised applications 113.
  • the at least one service device processor 104 may be considered receiving authorisation to enable access.
  • the at least one service device processor 104 may generate an authorisation token in response to confirming that the sub-device 107 that is associated with the received request for access is authorised to communicate with the service device 102 and/or one or more containerised application 112 of the plurality of containerised applications 113.
  • the authorisation token may be provided to another component or software module of the service device 102, which may also be considered receiving authorisation to enable access.
  • the at least one service device processor 104 executes the supervisor module 108 to authorise the request for access.
  • the service device 102 may be configured to receive authorisation credentials, receipt of which comprises authorisation of the sub-device 107.
  • the service device 102 may, for example, receive authorisation credentials via the service device user interface (i.e. login details of the user).
  • the service device 102 may receive the authorisation credentials from another computing device such as the data management device 118 or the sub-device 107.
  • the authorisation credentials may be associated with the sub device information, for example, in a database. Receipt of authorisation credentials may be considered receiving authorisation to enable access.
  • the service device 102 transmits the request for access or the sub-device information to another computing device which authorises the request for access.
  • at least one service device processor 104 may transmit the request for access or the sub-device information to the data management device 118.
  • the data management device 118 may then authorise the request for access.
  • the data management device 118 may authorise the request for access by comparing the sub-device information to a pre-existing database of authorised sub-devices to confirm that the sub-device 107 that is associated with the received request for access is authorised to communicate with the service device 102. This may be executed, for example, by the at least one data management device processor 122.
  • the data management device 118 and in particular, the at least one data management device processor 122 may be configured to receive authorisation credentials.
  • authorising the request for access may therefore comprise receiving the authorisation credentials.
  • the at least one data management device processor 122 may, for example, receive the authorisation credentials via the data management device user interface (i.e. login details of the user).
  • the data management device 118, or an associated computing device may comprise a camera.
  • the user may present one or more machine -readable indicia (such as a barcode, a QR code etc.), a representation of which may be captured by the camera.
  • the sub-device 107 may comprise the machine-readable indicia (e.g. displayed on a display of the sub-device 107, engraved on a body of the sub-device 107, attached as a sticker etc.).
  • the machine-readable indicia may comprise the authorisation credentials.
  • the at least one data management device processor 122 may receive the authorisation credentials from another computing device.
  • the at least one data management device processor 122 generates an authorisation token based at least in part on the authorisation credentials. For example, the at least one data management device processor 122 may generate the authorisation token when the authorisation credentials are valid. The at least one data management device processor 122 may transmit the authorisation token to the service device 102. The service device 102 may be configured to authorise the sub-device 107 upon receipt of the authorisation token. In other words, by receiving the authorisation token, the service device 102 may be said to receive authorisation to enable access.
  • the at least one data management device processor 122 may receive the authorisation credentials using the data management device network interface, via the communications network 120 (or the first communications network 120A, where relevant). The at least one data management device processor 122 may transmit the authorisation token to the service device 102 using the data management device network interface, via the communications network 120 (or the first communications network 120A, where relevant).
  • a private key and a corresponding public key are generated. The private key and/or the public key may be generated based at least in part on the sub-device information.
  • a private/public key pair is generated based at least in part on the sub-device information.
  • the private key and/or the public key may be generated using another method.
  • the private key may be generated using a random number generator or a pseudo-random number generator.
  • the at least one service device processor 104 generates the private key.
  • the at least one service device processor 104 may generate the private key based at least in part on the sub-device information.
  • the at least one service device processor 104 also generates the public key that is associated with the private key.
  • the at least one service device processor 104 executes the supervisor module 108 to generate the private key and/or the public key.
  • the at least one service device processor 104 stores the private key and the public key in service device memory 106.
  • the at least one data management device processor 122 generates the private key.
  • the at least one data management device processor 122 may generate the private key based at least in part on the sub-device information.
  • the at least one data management device processor 122 also generates the public key that is associated with the private key.
  • the at least one data management device processor 122 stores the private key and the public key in data management device memory 124.
  • the public key is associated with the sub-device 107 in a sub-device record.
  • the at least one service device processor 104 associates the public key with the sub-device 107 in the sub-device record.
  • the sub-device record may be stored in service device memory 106.
  • the at least one data management device processor 122 associates the public key with the sub-device 107 in the sub-device record.
  • the sub-device record may be stored in data management device memory 124.
  • the at least one service device processor 104 executes the supervisor module 108 to associate the public key with the sub-device 107.
  • the public key and the private key are distributed between a number of the devices of the system 100.
  • the at least one service device processor 104 may generate the private key and the public key.
  • the at least one service device processor 104 transmits the public key to the relevant sub-device 107.
  • the at least one service device processor 104 transmits the public key to the sub-device 107 that is associated with that public key (in the sub-device record).
  • Each sub-device 107 is associated with its own respective public/private key pair.
  • the at least one service device processor 104 executes the supervisor module 108 to transmit the public key to the sub-device 107 that is associated with that public key.
  • the at least one service device processor 104 also transmits the public key to the data management device 118. Furthermore, the at least one service device processor 104 may transmit the private key to the data management device 118. Thus, the public key and the private key may be stored in the data management device memory 124. The at least one service device processor 104 may transmit the public key and/or the private key using the communications network 120, the first communications network and/or the relevant sub-device communications network 130B. In some embodiments, the at least one service device processor 104 executes the supervisor module 108 to transmit the public key and/or the private key.
  • the service device 102 may provide the private key to a containerised application 112 of the plurality of containerised applications 113.
  • the at least one service device processor 104 may provide the private key to the containerised application 112.
  • at least one service device processor 104 provides the private key to containerised applications 112 of the plurality of containerised applications 113 that are authorised to process the sub-device data provided by the sub-device 107 that is associated with that private key.
  • the at least one service device processor 104 executes the supervisor module 108 to provide the private key to the containerised application 112.
  • This may comprise, for example, making the private key, which may be stored in service device memory 106, available to the containerised application 112.
  • the at least one service device processor 104 selectively provides the private key to the containerised application 112.
  • the at least one service device processor 104 may provide the private key only to containerised applications 112 of the plurality of containerised application 113 that are configured to process sub-device data provided by the sub-device 107 that is associated with that private key.
  • the sub-device data comprises temperature data
  • the at least one service device processor 104 may provide the private key associated with the relevant sub-device 107 only to containerised applications 112 that are configured to process temperature data.
  • the service device 102 may provide the public key to a containerised application 112 of the plurality of containerised applications 113.
  • the at least one service device processor 104 may provide the public key to the containerised application 112.
  • at least one service device processor 104 provides the public key to containerised applications 112 of the plurality of containerised applications 113 that are authorised to process the sub-device data provided by the sub-device 107 that is associated with that public key.
  • the at least one service device processor 104 executes the supervisor module 108 to provide the public key to the containerised application 112.
  • This may comprise, for example, making the public key, which may be stored in service device memory 106, available to the containerised application 112.
  • the at least one service device processor 104 selectively provides the public key to the containerised application 112.
  • the at least one service device processor 104 may provide the public key only to containerised applications 112 of the plurality of containerised applications 113 that are configured to process sub-device data provided by the sub-device that is associated with that public key.
  • the sub-device data comprises temperature data
  • the at least one service device processor 104 may provide the public key associated with the relevant sub-device 107 only to containerised applications 112 that are configured to process temperature data.
  • the private key may be provided to the data management device 118
  • the public key may be provided to the data management device 118
  • the private key may be provided to a containerised application 112
  • the public key may be provided to a containerised application 112 and/or the public key may be provided to the relevant sub-device 107 of the plurality of sub-devices 109.
  • the at least one data management device processor 122 may generate the private key and the public key. In these embodiments, the at least one data management device processor 122 transmits the public key to the service device 102. Furthermore, the at least one data management device processor 122 may transmit the private key to the service device 102. Thus, the public key and the private key may be stored in the service device memory 106. In these embodiments, at 410, the at least one data management device processor 122 transmits the public key to the relevant sub-device 107 via the service device 102. In other words, the at least one data management device processor 122 transmits the public key to the sub-device 107 that is associated with that public key (in the sub-device record) via the service device 102. The at least one data management device processor 122 may transmit the public key and/or the private key using the communications network 120 or the first communications network 120A.
  • the private key may be provided to the service device 102
  • the public key may be provided to the service device 102
  • the private key may be provided to a containerised application 112 as described previously (via the service device 102)
  • the public key may be provided a containerised application 112 as describe previously (via the service device 102) and/or the public key may be provided to the relevant sub-device 107 of the plurality of sub-devices 109 as described previously (via the service device 102).
  • the at least one service device processor 104 may execute the sub-device data module 110 to perform one or more of steps 402, 404, 406, 408 and 410.
  • each sub-device 107 is configured to generate sub-device data and to provide the sub-device data to the service device 102.
  • the service device 102 receives sub-device data from a sub-device 107 of the plurality of sub-devices 109.
  • the at least one service device processor 104 receives the sub-device data from the sub-device 107.
  • the sub-device 107 may provide the sub-device data to the service device 102 using the communications network 120 or the relevant sub-device communications network 120B.
  • each sub-device 107 of the plurality of sub-devices 109 may comprise a sensor.
  • the sub-device data may comprise sensor data.
  • the service device 102 encrypts the sub-device data, thereby generating encrypted sub-device data. That is, after receiving the sub-device data from the sub device 107, the service device 102 encrypts the sub-device data.
  • the at least one sub-device processor 104 encrypts the sub-device data using the public key. The private key may be used to decrypt the encrypted sub-device data.
  • the at least one service device processor 104 executes the supervisor module 108 to encrypt the sub-device data.
  • the sub-device 107 is configured to encrypt the sub-device data before providing (i.e. transmitting) the sub-device data to the service device 102.
  • the sub-device 107 may encrypt the sub-device data using the public key. Again, the private key may be used to decrypt the encrypted sub-device data.
  • the service device 102 may not encrypt the sub-device data after receiving it, as it is already encrypted.
  • the service device 102 broadcasts the sub-device data to a multicast network channel of the multicast network 116 (or multicast bus 116A).
  • the at least one service device processor 104 broadcasts the sub-device data to the multicast network channel. Broadcasting the sub-device data to the multicast network channel may comprise broadcasts the encrypted sub-device data. Broadcasting the sub-device data to the multicast network channel may comprise making the sub-device data (or the encrypted sub-device data) available on the network channel.
  • broadcasting the sub-device data to the multicast network channel may be referred to as providing the sub-device data to the multicast network channel. In some embodiments, broadcasting the sub-device data to the multicast network channel may be referred to as transmitting the sub-device data to the multicast network channel. In some embodiments, broadcasting the sub-device data to the multicast network channel may be referred to as streaming the sub-device data to the multicast network channel. In some embodiments, broadcasting the sub-device data to the multicast network channel may be referred to as making the sub-device data available on the multicast network channel.
  • the multicast network channel is associated with the sub-device 107 that provided the sub-device data. In other words, the multicast channel may be considered to correspond to the sub-device 107 that provided the sub-device data.
  • the multicast network channel is accessible by each containerised application 112 of the plurality of containerised applications 113.
  • the multicast network channel is a multicast Internet Protocol (IP) address or an application-layer multicast channel.
  • IP Internet Protocol
  • the at least one service device processor 104 executes the supervisor module 108 to provide the sub-device data to the multicast network channel.
  • data may be obtained from any sub-device 107.
  • the service device 102 loops through all installed containerised applications 112 to verify the sub-device data to determine if the sub-device data may be sent to an appropriate multicast channel. For a containerised application 112 with rights to receive the sub-device data, the sub-device data will be sent to the multicast channel corresponding to that containerised application 113.
  • the private key may be used to decrypt the encrypted sub-device data.
  • the private key is only provided to the containerised applications 112 that are configured, or authorised to process the sub-device data provided by the sub-device 107 that is associated with the private key, only these containerised applications 112 can decrypt, and therefore process the sub-device data. In this way, the system 100 provides for improved security of the sub-device data before processing.
  • a containerised application 112 of the plurality of containerised applications 113 receives the sub-device data from the multicast network channel.
  • multiple containerised applications 112 of the plurality of containerised applications receive the sub-device data from the multicast network channel.
  • Receiving the sub-device data from the multicast network channel comprises receiving the encrypted sub-device data from the multicast network channel.
  • the at least one service device processor 104 executes the relevant containerised application(s) 112 to receive the sub-device data from the multicast network channel.
  • the at least one service device processor 104 executes the sub-device data module 110 to receive the sub-device data from the multicast network channel.
  • the containerised application(s) 112 that receive the sub-device data from the multicast network channel and that have been provided the private key, decrypt the sub device data.
  • the at least one service device processor 104 executes the relevant containerised application(s) 112 to decrypt the encrypted sub-device data using the private key.
  • the at least one service device processor 104 executes the relevant containerised application(s) 112 to decrypt the encrypted sub-device data prior to processing the sub-device data.
  • the at least one service device processor 104 executes the sub-device data module 110 to decrypt the sub-device data.
  • the containerised application(s) 112 process the sub-device data.
  • the at least one service device processor 104 executes the relevant containerised application(s) 112 to process the sub-device data.
  • each of the containerised application(s) 112 that are associated with the sub-device 107 can process the sub-device data for different purposes simultaneously.
  • the at least one service device processor 104 By executing the relevant containerised application(s) 112 to process the sub-device data, the at least one service device processor 104 generates processed data. Processing the sub-device data may comprise determining one or more sub-device data metrics based at least in part on the sub-device data.
  • processing the sub-device data may comprise determining one or more of a maximum temperature, a minimum temperature or an average temperature over a time window of the time- series.
  • the maximum temperature, minimum temperature and/or average temperature may be considered sub-device data metrics, for example.
  • the at least one service device processor 104 executes the sub-device data module 110 to process the sub-device data.
  • a particular containerised application 112 of the plurality of the containerised applications 113 may be configured to receive sub-device data from a plurality of the multicast network channels simultaneously.
  • the at least one service device processor 104 executes the relevant containerised application(s) 112 to process the sub-device data.
  • the at least one service device processor 104 executes the relevant containerised application(s) 112 to process sub-device data that has been provided by a plurality of sub-devices 107.
  • the at least one service device processor 104 is configured to store the sub-device data or the encrypted sub-device data in service device memory 106. In some embodiments, the at least one service device processor 104 is configured to store the processed data in service device memory 106. In some embodiments, the at least one service device processor 104 is configured to store the one or more sub-device data metrics in service device memory 106. In some embodiments, the at least one service device processor 104 executes the sub-device data module 110 to store the sub-device data, the encrypted sub device data and/or the one or more sub-device data metrics in service device memory 106.
  • the at least one service device processor 104 encrypts the processed data.
  • e at least one service device processor 104 encrypts the processed data using a public key, thereby generating encrypted processed data.
  • the public key may be the previously described public key. Alternatively, the public key may be another public key.
  • the at least one service device processor 104 may execute the relevant containerised application 112 to encrypt the processed data.
  • the service device 102 transmits the processed data to the data management device 118. This may comprise transmitting the one or more sub-device data metrics to the data management device 118.
  • the at least one service device processor 104 transmits the processed data to the data management device 118.
  • the at least one service device processor 104 may transmit the processed data to the data management device 118 using the service device network interface and/or the communications network 120 (or first communications network 120A, where applicable).
  • the at least one service device processor 104 executes the sub-device data module 110 to transmit the processed data to the data management device 118. Transmitting the processed data may comprise transmitting encrypted processed data.
  • the at least one service device processor 104 may execute the supervisor module 108 to perform one or more of steps 412, 414, 416, 418, 420, 422, 424 and 426.
  • the data management device 118 receives the processed data and stores the processed data.
  • the at least one data management processor 122 stores the processed data in data management memory 124.
  • the processed data may be encrypted before being transmitted by the service device 102, storing the processed data may comprise storing the encrypted processed data.
  • the at least one data management processor 122 may decrypt the encrypted processed data.
  • the at least one data management processor 122 may decrypt the encrypted processed data using a private key.
  • the private key may be the previously described private key. Alternatively, the private key may be another public key.
  • the at least one data management processor 122 may then store the decrypted processed data in data management memory 124.
  • the present disclosure provides an application marketplace for containerised applications which enables selective upload, purchase and deployment of applications, enabling selected applications to be processed and interact with received data.
  • the present disclosure provides a central access management control system, which enables selective exchange of data between a containerised data centre and multiple sub-devices. This provides control over the access for data to be processed by user devices, thereby enabling the selective processing of data to be processed over secure communications.
  • the present disclosure provides secure and reliable transmission for multicasting services, which advantageously enhances information security in Internet of Things (IoT) systems when multiple physical sub-devices (e.g. sensors, machines, facilities, etc.) are employed and synchronised.
  • IoT Internet of Things
  • the system 100 provides for central management of access to containerised applications provided by an operator of the system by selectively providing an access key (e.g. the private key) to one or more authorised users.
  • an access key e.g. the private key

Abstract

L'invention concerne un système de gestion de données (100) de traitement sélectif de données. Le système de gestion de données (100) comprend un dispositif de service (102). Le dispositif de service (102) comprend au moins un processeur (104) de dispositif de service et une mémoire (106) de dispositif de service. La mémoire (106) de dispositif de service stocke une pluralité d'applications conteneurisées (113) pouvant être exécutées par ledit processeur (104) de dispositif de service ; et des instructions de programme pouvant faire l'objet d'un accès par ledit processeur (104) de dispositif de service. Les instructions de programme sont configurées pour amener ledit processeur (104) de dispositif de service à recevoir une demande d'accès en provenance d'un dispositif secondaire (107), la demande d'accès comprenant des informations de dispositif secondaire associées au dispositif secondaire (107), à recevoir une autorisation pour permettre l'accès, l'autorisation étant basée au moins en partie sur les informations de dispositif secondaire, à recevoir des données de dispositif secondaire en provenance du dispositif secondaire (107), à diffuser les données de dispositif secondaire dans un canal de réseau de multidiffusion correspondant qui peut faire l'objet d'un accès par les applications de la pluralité d'applications conteneurisées (113), à exécuter une application conteneurisée (112) de la pluralité d'applications conteneurisées (113), l'application conteneurisée (112) étant configurée pour recevoir les données de dispositif secondaire en provenance du canal de réseau de multidiffusion ; et à traiter les données de dispositif secondaire pour générer des données traitées. Les instructions de programme sont configurées pour amener ledit processeur (104) de dispositif de service à transmettre les données traitées à un dispositif de gestion de données.
PCT/SG2020/050742 2019-12-11 2020-12-11 Système et procédé de traitement de données WO2021118471A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
SG10201912004Q 2019-12-11
SG10201912004Q 2019-12-11

Publications (1)

Publication Number Publication Date
WO2021118471A1 true WO2021118471A1 (fr) 2021-06-17

Family

ID=76330784

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/SG2020/050742 WO2021118471A1 (fr) 2019-12-11 2020-12-11 Système et procédé de traitement de données

Country Status (1)

Country Link
WO (1) WO2021118471A1 (fr)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060242294A1 (en) * 2005-04-04 2006-10-26 Damick Jeffrey J Router-host logging
US20080165952A1 (en) * 2007-01-07 2008-07-10 Michael Smith Secure Booting A Computing Device
US20160110123A1 (en) * 2014-10-16 2016-04-21 Microsoft Corporation Data object observation among domain-restricted containers
WO2019070230A1 (fr) * 2017-10-03 2019-04-11 Google Llc Coordination d'assistant numérique multiple dans des environnements véhiculaires

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060242294A1 (en) * 2005-04-04 2006-10-26 Damick Jeffrey J Router-host logging
US20080165952A1 (en) * 2007-01-07 2008-07-10 Michael Smith Secure Booting A Computing Device
US20160110123A1 (en) * 2014-10-16 2016-04-21 Microsoft Corporation Data object observation among domain-restricted containers
WO2019070230A1 (fr) * 2017-10-03 2019-04-11 Google Llc Coordination d'assistant numérique multiple dans des environnements véhiculaires

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
BULLA, R. ET AL.: "Towards an Open, Secure, Decentralized and Coordinated Fog-to-Cloud Management Ecosystem", D3.6 MF2C AGENT CONTROLLER BLOCK INTEGRATION, 30 September 2019 (2019-09-30), pages 1 - 37 *

Similar Documents

Publication Publication Date Title
US11586709B2 (en) Secure provisioning and management of devices
US11240222B2 (en) Registry apparatus, agent device, application providing apparatus and corresponding methods
US10642969B2 (en) Automating internet of things security provisioning
US10951630B2 (en) Registry apparatus, agent device, application providing apparatus and corresponding methods
CN106537871B (zh) 用于在网络中提供设备的登记的系统、方法和装置
US9860235B2 (en) Method of establishing a trusted identity for an agent device
US20190349346A1 (en) Registry apparatus, agent device, application providing apparatus and corresponding methods
WO2015056009A1 (fr) Procédé d'établissement d'une identité de confiance pour un dispositif auxiliaire
US11245523B2 (en) Method for implementing client side credential control to authorize access to a protected device
CN113261253A (zh) 用于控制资源的释放的方法和系统
US20190349348A1 (en) Registry apparatus, agent device, application providing apparatus and corresponding methods
WO2021118471A1 (fr) Système et procédé de traitement de données
KR20210022852A (ko) 암호모듈을 이용한 블록체인 기반의 사물인터넷 관리 시스템
WO2019102239A1 (fr) Procédé permettant d'assurer des communications sécurisées et autorisées entre un premier dispositif et un second dispositif

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20898552

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20898552

Country of ref document: EP

Kind code of ref document: A1