Today it is possible to apply the Edge to Cloud pattern in the industrial world. Microsoft is putting the idea of intelligent edge into practice by providing not only IoT Edge,but a series of field transpositions of important cloud services, including: Functions, Storage, SQL Edge, SQL Lite, Event Grid, Redis, Stream Analytics, Cognitive Services. In addition to these, contact points are also emerging towards the old industrial world, for example with OPC-UA. The session deals with the IoT Edge service in a focused way, compared to the concept of connected factory.

1. #GLOBALAZURE2020

2. 2
#GLOBALAZURE2020
AGENDA

3. How to Enter?
Answer a simple question on the form below and select Turin Meetup
Group – Two winners will be selected and notified before May 28th
https://europeancloudconference.com/win-a-free-ticket-to-the-european-
cloud-conference-in-nice-france-gab/
#GLOBALAZURE2020

4. 4
#GLOBALAZURE2020
IoT EDGE
fundamentals

5. 5#GLOBALAZURE2020
Hi. I’m IoT EDGE.
What???
No, I’m not LINUX. I’m IoT EDGE.
Why???
Have you ever seen me Flying?

6. IOT IN THE CLOUD AND ON THE EDGE
6#GLOBALAZURE2020

7. EDGE COMPUTING SCENARIO
7#GLOBALAZURE2020
Infrastructure close to the data
Real uses cases
Why you should use it

8. WHO ARE YOU, IOT EDGE?
8#GLOBALAZURE2020
Are you IoT EDGE?
Yes I am. Yes I am. Yes we are. Yes I am.
IoT Edge is an Idea. Not a device.

9. HEAVY EDGE VS LIGHT EDGE
9#GLOBALAZURE2020

10. KEY CONCEPTS
10#GLOBALAZURE2020
Azure IoT Edge
Runtime
Azure IoT Edge
Modules

11. KEY CONCEPTS
11#GLOBALAZURE2020
Cloud
Offloading
Configuration
and Monitoring

12. DESIGN PRINCIPLES
 Secure
 Provides a secure connection to the Azure IoT Edge, update software/firmware/configuration
remotely, collect state and telemetry and monitor security of the device
 Cloud managed
 Enables rich management of Azure IoT Edge from Azure provide a complete solution instead of just
an SDK
 Cross-platform
 Enables Azure IoT Edge to target the most popular edge operating systems, such as Windows and
Linux
 Portable
 Enables Dev/Test of edge workloads in the cloud with later deployment to the edge as part of a
continuous integration / continuous deployment pipeline
 Extensible
 Enables seamless deployment of advanced capabilities such as AI from Microsoft, and any third
party, today and tomorrow

13. SOME FAMOUS IMAGE
13#GLOBALAZURE2020

14. SOME FAMOUS IMAGE
14#GLOBALAZURE2020

15. SOME FAMOUS IMAGE
15#GLOBALAZURE2020

16. SOME FAMOUS IMAGE
16#GLOBALAZURE2020

17. SOME FAMOUS IMAGE
17#GLOBALAZURE2020

18. EDGE CONTEXT
18#GLOBALAZURE2020

19. NEW PERSONAS & NEW JOBS
Developer Operator
Stage and test
Stage and deploy at
scale
Manage large fleets
Operational workflows
with alerts
Develop and test
Continuously iterate
Familiar tools like Visual
Studio
Cloud development skills

20. 20#GLOBALAZURE2020
IoT EDGE
Prime Architecture

21. EDGE RUNTIME
21#GLOBALAZURE2020

22. MODULES
22#GLOBALAZURE2020

23. ROUTING
23#GLOBALAZURE2020

24. DEPLOYMENT.JSON
24#GLOBALAZURE2020
The Azure IoT Edge runtime enables custom
and cloud logic on IoT Edge devices
The Azure IoT Edge agent enables deployment
and module monitor ing

25. ROUTING IN EDGE
25#GLOBALAZURE2020
How about multiplexing like a boss?

26. PORT BINDINGS .. AND THE FUCKING PROXY
26#GLOBALAZURE2020
Edge hub is the KEY!

27. DEVICE TWIN
27#GLOBALAZURE2020

28. IOT EDGE IN ACTION
28#GLOBALAZURE2020

29. 29#GLOBALAZURE2020

30. TRANSPARENT COMMUNICATION
30#GLOBALAZURE2020

31. PROTOCL TRANSLATION
31#GLOBALAZURE2020

32. INDENTITY TRANSLATION
32#GLOBALAZURE2020

33. ALSO VISION IS IOT EDGE, BUT
33#GLOBALAZURE2020

34. IOT EDGE FEATURES
34#GLOBALAZURE2020

35. ONGOING UPDATES
35#GLOBALAZURE2020

36. LEVEL 1: SUPPORTED BY MICROSOFT
36#GLOBALAZURE2020

37. LEVEL 1: COMPATIBLE BUT .. NOT SUPPORTED BY MICROSOFT
37#GLOBALAZURE2020

38. HITS TO DEVELOP QUICKLY
38#GLOBALAZURE2020
Container engine
The only supported container engine for IoT Edge
devices in production is Moby. Please use Moby.
First VM based Edge Device:
Go to Marketplace and type IoT EDGE
IoT EdgeHub dev tool
provides a local development and debug
experience
Helm is a must
If you want to approach THE BIG EDGE!
Another BIG Thing..
VSC FIRST, this time.

39. DEV OPS & IOT EDGE
39#GLOBALAZURE2020

40. THE BIG EDGE
40#GLOBALAZURE2020

41. 41
#GLOBALAZURE2020
Industrial IoT
fundamentals

42. A BRIEF LIFECYCLE
42#GLOBALAZURE2020
1. Analyze Topology and Environment
2.Make an affordable Variable Worksheet
3.Focus on Data Temperature
4.Focus on Retention Time
5.Focus on GOALS, not Technology

43. ANALYZE NETWORK
43www.wpc2019.it
Server All-in-one Gateway connected to PLC
(Backend).
Frontend Gateway +
Backend GAteway
Data Logging Box (SQL Bridge or Tag
History,
& Status Cache)
Edge Gateway: (Action to PLC
capability, Data generation by
Algorithm - Edge ML - )
Hub&Spoke: Local buffers + Data
Hub

44. ANALYZE THE «ENVIRONMENT»
44www.wpc2019.it
BUZZWORDS:
 ModbusTCP, Profinet,
Ethercat, CoAP, MQTT,
Ethernet IP, Zigbee,
Powerlink, SERCOS III,
Fieldbus, Profibus
4
CONCEPTS:
What do you mean with REALTIME … this
time?
Am I in a greenfield or in a brownfield?

45. 45#GLOBALAZURE2020

46. SOME USE CASE
46www.wpc2019.it
ASSET MANAGEMENT
 All’interno di un impianto un operaio sta utilizzando una macchina al di sopra dei parametri di soglia per
recuperare un ritardo sul piano produttivo prestabilito.
 Questo porta ad una rottura della macchina e il Manufacturer chiede perciò al Machine Builder un
intervento di assistenza in garanzia.
 Quest’ultimo non può dimostrare che la macchina si è rotta a causa di un cattivo utilizzo e non per un
difetto della stessa dovendo quindi farsi carico ingiustamente dei costi.
PERFORMANCE MONITORING
 In un impianto, viene rilevato un calo di produzione a causa di un maggior numero di scarti proveniente da
un reparto in cui lavorano macchine tutte uguali.
 Il Responsabile di Produzione non è in grado però di capire in modo preciso quale delle macchine
performa meno bene e soprattutto il motivo per il quale questo avviene.

47. THIS IS THE MICROSOFT RECIPE
47#GLOBALAZURE2020

48. THIS IS MY RECIPE
48www.wpc2019.it
Cosa è richiesto?
A) RISOLVERE UN PROBLEMA?
B) AVVIARE UNA PARTE NUOVA?
C) SOSTITUIRE UNA PARTE?
Se il problema è migliorare l'impianto, si resta in impianto
Se il problema è migliorare i propri clienti, i propri fornitori o i «colleghi» della catena del valore, si va fuori
VIETATO:
1. Parlare esplicitamente di CLOUD
2. Dire che Internet è indispensabile
3. Non conoscere la concorrenza interna
4. Parlare di concorrenti «sconosciuti»
5. Parlare di massimi sistemi
6. Parlare con Acronimi IT
7. Porsi come «Sappiamo già»
8. Porsi come gli evangelizzatori in mondo di scimmie
9. Parlare del processo produttivo del cliente stesso
10. Parlare di cose troppo distanti (AI, ML, Blockchain, AR, ecc) dalla realtà di MERCATO del cliente

49. TYPICAL 6 VERTICALS IN INDUSTRY
49www.wpc2019.it
1. Asset management
2. Production Monitoring
3. Quality Management
4. Change management
5. Maintenance Management
6. Energy Efficiency management
4
The 99% of time, YOU MUST improve one of THEM.

50. KEY QUESTIONS
50www.wpc2019.it
Dove normalizzare.
Stream di Byte, o stream di json ? Dipende da frequenza, network, RT
Mimica da utilizzare
Realtime, batch. Organizziamo tutto secondo lo scopo
Simulatore presente o no
Un simulatore verosimile è l’unica cosa dove investire tempo
Materializzazione o Modello?
Derivare delle basi dati SEMPLICI con solo i dati che direttamente vengono plottati (memorizzare i
sum).. Oppure pensare ad un Modello Dati su DB?
Sicurezza for dummies?
L’importante è NON FAR ENTRARE PORTE, e far uscire SOLO dati aggregati da un DB di frontiera
«senza segreti».

51. PLC MARKET SHARE FIRST
51#GLOBALAZURE2020

52. ..AND «MS WANNA BE» ROLE… :D :D :D
52#GLOBALAZURE2020

53. MS FIRST TENTATIVE
53#GLOBALAZURE2020

54. A MAN SILHOUETTE
What is EDGE ?
What is IOT EDGE ?
What is «TRADITIONAL EDGE» ?

55. OBIETTIVI E NUOVI OBIETTIVI
Monitoring
Analysis
Management
1. Asset
2. Production
3. Energy
3. Edge analytics (!= analytics)
=> Time series
=> correlation analysis
4. Energy
5. Quality
6. Maintenance
Il monitoring industriale, nell'era post covid, si fonda su un
aspetto: disaccoppiare uomo e macchina.
digitally-savvy workers
nuovi strumenti per i nervi industriali
Poi parliamo di management (sistemi tradizionali), no IoT Edge,
sicuramente disaccoppiato dalla fabbrica

56. PRACTICE WITH EDGE ARCHITECTURE
Asset
=> time series + regole + actor
Production
=> buffer + sql + redis
Analytics
=> analytics configurabili a partire da un grid eventi
Energy
=> time series + ML + actor
Quality
=> time series + ML

57. 57
#GLOBALAZURE2020
IoT Edge
Modules &
Services

58. AZURE, IOT EDGE AND IOT DEVICES

59. 59#GLOBALAZURE2020

60. 60#GLOBALAZURE2020

61. BROWNFIELD & CONSISTENT CLOUD DATA MODEL
61#GLOBALAZURE2020

62. 62#GLOBALAZURE2020
First Module:
OPC-UA

63. OPC UA AND AZURE
63#GLOBALAZURE2020

64. EDGE CONNECTIVITY RECAP
64#GLOBALAZURE2020

65. OPC MODULE
65#GLOBALAZURE2020

66. SECURITY ON THE EDGE
66#GLOBALAZURE2020

67. 67#GLOBALAZURE2020
Next Module:
Event Grid Edge

68. WHAT IS EVENT GRID?
 Suitable for Event driven computing
 EG focus on events that say «Something is
happened»
 It enables NRT delivery, but not in order
 Based on Publish Subscribe pattern
 Language Agnostic
Backbone of event-driven computing
 DEFINITION of INTERNET BACKBONE: An Internet
backbone refers to one of the principal data routes
between large, strategically interconnected networks and
core routers on the Internet.
 DEFINITION OF EG BACKBONE: An EventGrid backbone
refers to one of the principal data routes between large,
strategically interconnected FLOWS and core routers on
the Grid.
 How I can program within a backbone?

69. EVENT GRID ON EDGE
69#GLOBALAZURE2020

70. WHAT IS THE GOAL OF EVENT GRID?
1. Handling Webhooks events

71. WHAT IS THE GOAL OF EVENT GRID?
2. Managing Events in one place

72. FEATURES & CAVEATS
72#GLOBALAZURE2020
• Events are sent as arrays
• Every event has common information like: source of the
event, time the event took place, and unique identifier
• When using a custom topic, events must always be
published in an array.
• Batches can be up to 1 MB.
Preferred format: CNCF Cloud event
To publish to an Edge Hub module, set
the endpointType to edgeHub and provide:

73. FEATURES & CAVEATS
73#GLOBALAZURE2020
CERTIFICATES:
IoT Edge environment generates self-signed
certificates. Recommendation is to generate
certificates issued by authorized CAs for
production workloads and
set allowUnknownCA property on both inbound
and outbound to false.
SECURITY:
Event Grid module security and
authentication leverage's the existing
infrastructure available on IoT Edge. The
assumption is that IoT Edge sub system is
secure.

74. 74#GLOBALAZURE2020
SUBSCRIPTION SETTINGS BATCHBROKER REDELIVERY
The following example sets up
a Web hook subscription with
maxNumberOfAttempts = 3
and Event TTL of 30 minutes

75. 75#GLOBALAZURE2020
Persistence via volume mount
The Event Grid module runs as a low-privileged user with UID 2000 and
name eventgriduser. In LINUx
Persist events
PERSISTENCE:
There is no persistence support for event data. This
means redeploying or restart of the Event Grid module
will cause you to lose any events that aren't yet
delivered.

76. FEATURES & CAVEATS
76#GLOBALAZURE2020
Advanced filtering

77. FEATURES & CAVEATS
77#GLOBALAZURE2020
Enable HTTP and HTTPS to other IoT modules and non-IoT workloads

78. 78#GLOBALAZURE2020
Next Module:
Event Grid Edge

79. STREAM ANALYTICS: ON THE EDGE ALSO?
79#GLOBALAZURE2020

80. EXAMPLE: TRAFFIC CAMERA SCENARIO
80#GLOBALAZURE2020

81. EXAMPLE: TRAFFIC CAMERA SCENARIO
81#GLOBALAZURE2020

82. EXAMPLE: TRAFFIC CAMERA SCENARIO
82#GLOBALAZURE2020

83. EXAMPLE: TRAFFIC CAMERA SCENARIO
83#GLOBALAZURE2020

84. 84#GLOBALAZURE2020

85. FEATURES & CAVEATS
85#GLOBALAZURE2020
Current limitations for IoT Edge jobs compared to cloud jobs
Even if the goal is to have parity between IoT Edge jobs and cloud jobs…
…. the following features are not yet supported for edge jobs:
• User-defined functions (UDF) in JavaScript.
• UDF are available in C# for IoT Edge jobs (preview).
• User-defined aggregates (UDA).
• Azure ML functions.
• Using more than 14 aggregates in a single step.
• AVRO format for input/output. Only CSV and JSON are supported.
• The following SQL operators:
• PARTITION BY
• GetMetadataPropertyValue
• Late arrival policy

86. 86#GLOBALAZURE2020
Next Module:
SQL Database Edge

87. SQL EDGE.. IS NOT «SQL ONLY»
87#GLOBALAZURE2020

88. IT’S THE SAME ..BUT IT’S NEW
88#GLOBALAZURE2020
IS THE SAME:
• GUI: Azure Data Studio and SSMS
• SYNCRONIZATION: Synchronization with Azure services
• SECURITY: encryption of data at rest and in motion, role- or attribute-based
access controls, and data masking
BUT IS NEW:
• ANALYTICS: Delivers analytics and AI built-
in, with the capability to score all types of
data through in-database ML and Apache
Spark
• STREAMING: Built-in streaming engine
(TRILL) that allows transformation,
windowed aggregation, simple anomaly
detection, and classification of the
incoming stream of data.
• TSDB: The time-series storage engine will
allow storage of time-indexed data, which
can later be aggregated in the cloud for
future analysis.

89. SQL EDGE VERSIONS & CAPABILITIES
89#GLOBALAZURE2020
SQL DB EDGE
PREMIUM
64 GB of memory processing
SQL DB EDGE
DEVELOPER
Fully equipped, development
only
STANDARD VS PREMIUM: only processing power different
SQL DB EDGE
STANDARD
4 GB of memory processing
Minimum Requirements:
CPU AMD63 / ARM64
2GB RAM
16GB MMC /SSD
Linux Ubuntu 16.04 or Windows Server

90. TRILL AND SQL EDGE
90#GLOBALAZURE2020
DACPAC = Db SCHEMA ASA job azure, backed into SQL

91. AND WHAT ABOUT SQL VS ML ?
91#GLOBALAZURE2020
KEEP attention to ONNX, PYTHON, and the «R» Rebirth

92. SQL EDGE - SCENARIO
92#GLOBALAZURE2020

93. USE CASES
93#GLOBALAZURE2020
Connected Vehicle MES ( !!! )

94. 94#GLOBALAZURE2020
Next Module:
SQL Lite

95. FEATURES & CAVEATS
95#GLOBALAZURE2020
The SQLite module is an Azure IoT Edge module, capable of executing sql
queries sent from other modules, and return result to the senders or to the Azure
IoT Hub via the Edge framework.
Detailed configuration is required, because you can trigger QUERY through
the EdgeHub
SQL LITE Module is simple; it offers two endpoints:
• "sqliteOutput": This is an output endpoint for the result of sql queries.
• "input1": This is an input endpoint for sql queries.
{
"HostConfig": {
"Binds": [
"/app/db:/app/db"
]
}
}
CONFIG

96. SEND SQL QUERIES TO SQLITE
96#GLOBALAZURE2020
Route from other (filter) modules
{ "routes": { "filterToSQLite":"FROM
/messages/modules/filtermodule/outputs/output1 INTO
BrokeredEndpoint("/modules/sqlite/inputs/input1")" } }

97. RECEIVE RESULT FROM SQLITE
97#GLOBALAZURE2020
{ "routes": { "sqliteToIoTHub":"FROM
/messages/modules/sqlite/outputs/sqliteOutput INTO
$upstream" } }
{ "routes": { "sqliteToFilter":"FROM
/messages/modules/sqlite/outputs/sqliteOutput INTO
BrokeredEndpoint("/modules/filtermodule/inputs/input1")"
} }

98. 98#GLOBALAZURE2020
Next Module:
Blob Edge

99. BLOB STORAGE EDGE
99#GLOBALAZURE2020
Azure Blob Storage on IoT Edge provides a block
blob and append blob storage solution at the
edge.
It doesn’t support Page blobs.
Two important options:
deviceToCloudUpload
deviceAutoDelete
It makes a SYNC with a Storage Account. Very
Useful.
For modules that are deployed on the same device as where the Azure Blob Storage on IoT Edge module is running, the blob endpoint
is: http://<module name>:11002/<account name>.
For modules or applications running on a different device, you have to choose the right endpoint for your network. The blob endpoint for this
scenario is one of:
http://<device IP >:11002/<account name>
http://<IoT Edge device hostname>:11002/<account name>
http://<fully qualified domain name>:11002/<account name>

100. 100#GLOBALAZURE2020

101. 101#GLOBALAZURE2020
Next Module:
Redis Edge

102. WHAT IS REDIS EDGE?
102#GLOBALAZURE2020
RedisEdge, a Lean Multi-
Model Database for any
Edge Application
1. Applications require multiple data models (e.g. time-
series, graph)
2. Support video streaming analytics, image recognition, and
other complex computing requirements.
3. Redis Streams is enabled at the edge

103. REDIS AS THE REAL IMDG
103#GLOBALAZURE2020
Applications require multiple data models (e.g. time-
series, graph)
Support video streaming analytics, image recognition, and
other complex computing requirements.
Redis Streams

104. REDIS EDGE – 10 DATA STRUCTURES
104#GLOBALAZURE2020

105. SPECIAL DATA STRUCTURES
105#GLOBALAZURE2020
TimeSeries Twins
Geo Indexes Streams

106. REDIS AS THE REAL IMDG
106#GLOBALAZURE2020
In Memory Processes In Memory Sync Rapresentation
Lean Multi-Model Database for any Edge Application

107. 107
#GLOBALAZURE2020
DPS
First steps

108. PLAN
REGISTER
CONFIGURE
MONITOR
RETIRE
Group devices and control access
according to your organization's
needs
Securely authenticate devices,
on-board for management
and provision for service
Provide updates, configuration & applications
to assign the purpose of each device
Monitor device inventory,
health & security while
providing proactive
remediation of issues
Replace or decommission
devices after failure, upgrade
cycle or service lifetime
IOT DEVICE LIFECYCLE

109. PLAN
REGISTER
CONFIGURE
MONITOR
RETIRE
Group devices and control access
according to your organization's
needs
Securely authenticate devices,
on-board for management
and provision for service
Provide updates, configuration & applications
to assign the purpose of each device
Monitor device inventory,
health & security while
providing proactive
remediation of issues
Replace or decommission
devices after failure, upgrade
cycle or service lifetime
IOT DEVICE LIFECYCLE

110. QUICK ORIENTATION
Devices
Back end
systems and
processes
Event Hub
Storage blobs DocumentDB
Web/
Mobile App
Stream
Analytics
Logic AppsIoT Hub Web Jobs
* Azure ML
Power BI
Provisioning
happens here

111. WHAT IS PROVISIONING?
Registration Configuration Provisioning

112. WHY PROVISIONING IS HARD TODAY

113. LET’S TALK SUPPLY CHAIN
Example: cars

114. AZURE IOT HUB DEVICE PROVISIONING SERVICE
Simplify with zero touch provisioning
Supports multiple locations
Easiest way to mass-provision devices
URL stability
Enhanced security through HSM
For any device compatible with IoT Hub
Remove human error
Minimize manual connection requirements
Multitenancy support
DPS knows exactly which IoT Hub to connect and provision
IoT Hub US IoT Hub Japan
IoT Hub India
DPS

115. GOALS FOR DEVICE PROVISIONING WITH AZURE IOT

116. A SELECTION OF SCENARIOS

117. AN IOT DEVICE’S RELATIONSHIP TO DPS

118. ENROLLMENT LIST

119. LINKED IOT HUBS

120. ALLOCATION POLICIES

121. IoT Hub
IoT Hub
IoT Hub
IoT Hub
PROVISIONING WITH DPS: IT’S LIKE CHUTES AND LADDERS
IoT Hub
Device
Device Provisioning
Service
Business logic
“where’s my home?”Identity attestation
Device enrollment info
Register new device,
populate initial configRegistered device info
Registered device info
Establish connection
Initial configuration
Device telemetry
Insights
Device telemetry
…etc

122. IoT Hub 1
IoT Hub 2
Device A
Device B
IoT Hub Device
Provisioning Service
Device A Information
Device B Information
USING A GLOBAL DEVICE ENDPOINT

123. USING A GLOBAL DEVICE ENDPOINT
device1
Global.azure-devices-
provisioning.net
ID scope: xyz
RegistrationID: rai212
Secret: <X.509 cert>
DPS
DPS
ID scope: xyz
Name: contosoDPS
DPS
ID scope: abc
Name: relecloudDPS
Mapping DB
 DPS name
ID scope
+
RegIDID scope: xyz
RegistrationID: rai212
DPS name: contosoDPS
device2
ID scope: abc
RegistrationID: fkb674
Secret: <X.509 cert>
ID scope: abc
RegistrationID: fkb674
DPS name: relecloudDPS

124. VERIFYING A DEVICE’S IDENTITY

125. PROVISIONING PROCESS

126. Device DPS DPS ID lookup
Factory
Provisioning
Factory
Harvest TPM for
RegistrationId + EKPublic
Call DPS to enroll device with RegId + EK
Push enrollment to storage
TPM
RegistrationId + EKPublic
Get EKPublic
MANUFACTURE FLOW FOR TPM

127. Device Device Registration Service
Device opens TLS connection to DPS (device trust to server
using standard SSL cert trust)
Request sends RegId and EK + StorageRootKey (SRKPublic)
IoT hub
Send 401 with session key (encrypted with EK + SRK)Device Authenticates
with DPS
DPS ID lookup
Register device in IoT hub
Remake request with SAS auth Validate SAS
Respond with hub info (device ID + hub URL + encrypted key)
Hub registration
Factory
Sign SAS token
using key in slot 0
Push initial twin state
Connect to IoT hub using SAS token
Twin desired properties
Device to IoT hub
(day to day comms)
Telemetry
Decrypt to
TPM
Create SAS token by
signing key in TPM
Respond with operationId for long running registration
operation
Poll with operationId until registration completion
TPM
Decrypt and store
key to slot 0
Generate SAS token
using key in Slot 1
Decrypt and store
key to slot 1
Get EKPublic +
SRKPublic
Validate device in
enrollment list
REGISTRATION FLOW FOR TPM

128. Device DPS IoT hubDPS ID lookup
Factory
provisioning
Factory
Push enrollment
group to storage
Secure Module
Sign device cert
with factory
signing certificate
Create device cert
Call DPS to create enrollment group
with factory signed certificate
Send factory signing cert public key
Nonce for validation
Sign signing certificate with nonce
and send to validate
Validate
Signing
Certificate
DPS validates
factory signing
certificate
Enrollment group
creation for factory
MANUFACTURE FLOW FOR X.509

129. Device DPS
Request sends factory signed leaf cert
IoT hub
Device authenticates
with DPS
DPS ID lookup
Register device in IoT hub
Respond with hub info (device ID + hub URL)
Hub registration
Factory
Push initial twin state
Connect to IoT hub using X.509 certificate
Receive twin desired propertiesDevice to IoT hub
(day to day comms)
Send device telemetry
Respond with operationId for long running operation
Poll with operationId until registration completion
Get enrollment group
of the signing cert
Validate device cert
with enrollment
group
REGISTRATION FLOW FOR X.509

130. DEVICE IDENTIFIER COMPOSITION ENGINE – DICE
 Secure By Design
• Use silicon gates to create hardware-based
device identities
• Security built into the DNA of the device
• Scalable security framework with minimal
hardware requirements for device identification
and attestation
• Trust anchor upon which various security
solutions for authentication, secure boot, remote
attestation, and more can be built
aka.ms/iotdice

131. 131
#GLOBALAZURE2020
Security hints
To survive in a
plant

132. END TO END SECURITY
132#GLOBALAZURE2020

133. SEVEN PROPERTIES OF HIGHLY SECURED DEVICES
133#GLOBALAZURE2020

134. STRONG DEVICE SECURITY
134#GLOBALAZURE2020

135. IOT HUB SECURITY CONTROLS
135#GLOBALAZURE2020

136. DEVICE MANAGEMENT
136#GLOBALAZURE2020

137. SECURTY THREATS AT THE EDGE
137#GLOBALAZURE2020

138. EXAMPLE: ATTACK VECTORS ON FACTORY LINE
138#GLOBALAZURE2020

139. PROTECTING THE SCADA/HMI SYSTEM
139#GLOBALAZURE2020

140. PROTECTING FACTORY LINE AUTOMATION
140#GLOBALAZURE2020

141. CLOUD SERVICES
141#GLOBALAZURE2020

142. How to Enter?
Answer a simple question on the form below and select Turin Meetup
Group – Two winners will be selected and notified before May 28th
https://europeancloudconference.com/win-a-free-ticket-to-the-european-
cloud-conference-in-nice-france-gab/
N.B. Il link verrà inviato ai partecipanti via e-mail
#GLOBALAZURE2020

143. 143
Continue your Azure Journey at
https://docs.microsoft.com/learn/
Thank you for coming!
See you next October 2020 for
Global Azure 2020
#GLOBALAZURE2020