Abstract: The disclosed technology is generally directed to device security in an IoT environment. For example, such technology is usable in IoT security. In one example of the technology, a set of security rules that is associated with an expected condition of at least one IoT device is stored. IoT data associated with the at least one IoT device is received. The IoT data may be aggregated data that includes at least two different types of data. A determination is made, based on the IoT data, as to whether the set of security rules has been violated. An alert is selectively sent based on the determination.

Abstract: The disclosed technology is generally directed to device security in an IoT environment. For example, such technology is usable in IoT security. In one example of the technology, a set of security rules that is associated with an expected condition of at least one IoT device is stored. IoT data associated with the at least one IoT device is received. The IoT data may be aggregated data that includes at least two different types of data. A determination is made, based on the IoT data, as to whether the set of security rules has been violated. An alert is selectively sent based on the determination.

Abstract: The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.

Abstract: Creating a certificate for a software module. A method includes obtaining a public key for a software module. The method includes obtaining a public key for a software module implemented on a hardware device. The method further includes creating a certificate using the public key by signing the public key using a hardware protected key and hardware protected compute elements. The hardware protected key is protected by a protected portion of the hardware device, and not accessible outside of the protected portion of the hardware device.

Abstract: Metadata associated with IoT devices is stored. The metadata may include categories associated with the IoT devices. At least a first category may be hierarchical such that the first category includes at least two hierarchical levels, with each hierarchical level including at least two categories, and such that each category in a hierarchical level that is below another hierarchical level is a subset of one of the categories in the hierarchical levels above that hierarchical level. User information associated with users is stored. A request associated with one of the users and further associated with access to at least one of the IoT devices is received. Responsive to the request, the access is selectively granted to the at least one of the IoT devices based upon the stored user information and the stored metadata.

Abstract: The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.

Abstract: The disclosed technology is generally directed to device authentication in an IoT environment. For example, such technology is usable in authenticating IoT devices to an IoT Hub. In one example of the technology, data field targets are received for an IoT device. The data field targets may include at least one device identity data field target and at least one telemetry data field target. Data field entries are received from the IoT device at a first time. The data field entries may include at least one device identity data field entry and at least one telemetry data field entry. A determination is made as to whether the data field entries match the corresponding data field targets for the IoT device. The IoT device is selectively allowed to connect to the IoT hub based on the determination.

Abstract: The disclosed technology is generally directed to device authentication in an IoT environment. For example, such technology is usable in authenticating IoT devices to an IoT Hub. In one example of the technology, data field targets are received for an IoT device. The data field targets may include at least one device identity data field target and at least one telemetry data field target. Data field entries are received from the IoT device at a first time. The data field entries may include at least one device identity data field entry and at least one telemetry data field entry. A determination is made as to whether the data field entries match the corresponding data field targets for the IoT device. The IoT device is selectively allowed to connect to the IoT hub based on the determination.

Abstract: The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.

Abstract: The disclosed technology is generally directed to device authentication in an IoT environment. For example, such technology is usable in authenticating IoT devices to an IoT Hub. In one example of the technology, data field targets are received for an IoT device. The data field targets may include at least one device identity data field target and at least one telemetry data field target. Data field entries are received from the IoT device at a first time. The data field entries may include at least one device identity data field entry and at least one telemetry data field entry. A determination is made as to whether the data field entries match the corresponding data field targets for the IoT device. The IoT device is selectively allowed to connect to the IoT hub based on the determination.

Abstract: The disclosed technology is generally directed to device provisioning in an IoT environment. For example, such technology is usable in provisioning IoT devices to an IoT Hub. In one example of the technology, an identification message that includes information associated with identification of a first IoT device is received. The validity of the first IoT device is then verified. After the first IoT device is verified, based at least in part on the identification message, an IoT hub is selected from a plurality of IoT hubs. The first IoT device is then caused to be registered with the selected IoT hub.

Abstract: The disclosed technology is generally directed to IoT communications. For example, such technology is usable in provisioning IoT devices in an automatic manner with no manual steps. In one example of the technology, upon initial boot, identification information is automatically sent to a provisioning service endpoint stored in the IoT device. The identification information includes an identification (ID) of the first IoT device. Cryptographic information is received from the provisioning service. The cryptographic information is associated with an IoT hub selected from a plurality of IoT hubs based, in part, on the ID of the first IoT device. A message is automatically sent to the IoT hub in response to receiving the cryptographic information. A new configuration file and a firmware update are received from the IoT hub without requiring a user association. The new configuration file and the firmware update are automatically installed.

Abstract: The disclosed technology is generally directed to device security in an IoT environment. For example, such technology is usable in IoT security. In one example of the technology, a set of security rules that is associated with an expected condition of at least one IoT device is stored. IoT data associated with the at least one IoT device is received. The IoT data may be aggregated data that includes at least two different types of data. A determination is made, based on the IoT data, as to whether the set of security rules has been violated. An alert is selectively sent based on the determination.

Abstract: The disclosed technology is generally directed to device provisioning in an IoT environment. For example, such technology is usable in provisioning IoT devices to an IoT Hub. In one example of the technology, an identification message that includes information associated with identification of a first IoT device is received. The validity of the first IoT device is then verified. After the first IoT device is verified, based at least in part on the identification message, an IoT hub is selected from a plurality of IoT hubs. The first IoT device is then caused to be registered with the selected IoT hub.

Abstract: Creating a certificate for a software module. A method includes obtaining a public key for a software module. The method includes obtaining a public key for a software module implemented on a hardware device. The method further includes creating a certificate using the public key by signing the public key using a hardware protected key and hardware protected compute elements. The hardware protected key is protected by a protected portion of the hardware device, and not accessible outside of the protected portion of the hardware device.

Abstract: The disclosed technology is generally directed to device security in an IoT environment. For example, such technology is usable in IoT security. In one example of the technology, a set of security rules that is associated with an expected condition of at least one IoT device is stored. IoT data associated with the at least one IoT device is received. The IoT data may be aggregated data that includes at least two different types of data. A determination is made, based on the IoT data, as to whether the set of security rules has been violated. An alert is selectively sent based on the determination.

Abstract: Metadata associated with IoT devices is stored. The metadata may include categories associated with the IoT devices. At least a first category may be hierarchical such that the first category includes at least two hierarchical levels, with each hierarchical level including at least two categories, and such that each category in a hierarchical level that is below another hierarchical level is a subset of one of the categories in the hierarchical levels above that hierarchical level. User information associated with users is stored. A request associated with one of the users and further associated with access to at least one of the IoT devices is received. Responsive to the request, the access is selectively granted to the at least one of the IoT devices based upon the stored user information and the stored metadata.

Abstract: The disclosed technology is generally directed to device provisioning in an IoT environment. For example, such technology is usable in provisioning IoT devices to an IoT Hub. In one example of the technology, an identification message that includes information associated with identification of a first IoT device is received. The validity of the first IoT device is then verified. After the first IoT device is verified, based at least in part on the identification message, an IoT hub is selected from a plurality of IoT hubs. The first IoT device is then caused to be registered with the selected IoT hub.

Abstract: Metadata associated with IoT devices is stored. The metadata may include categories associated with the IoT devices. At least a first category may be hierarchical such that the first category includes at least two hierarchical levels, with each hierarchical level including at least two categories, and such that each category in a hierarchical level that is below another hierarchical level is a subset of one of the categories in the hierarchical levels above that hierarchical level. User information associated with users is stored. A request associated with one of the users and further associated with access to at least one of the IoT devices is received. Responsive to the request, the access is selectively granted to the at least one of the IoT devices based upon the stored user information and the stored metadata.

Abstract: The disclosed technology is generally directed to IoT technology. In one example of the technology, the following actions are performed for each module of a plurality of modules on a first edge device. An identification message that includes information associated with identification of the module is received. The validity of the module is then verified. After the module is verified, based at least in part on the identification message, an IoT support service is selected from a plurality of IoT support services. The module is then caused to be registered with the selected IoT support service. The plurality of modules are compositable together into an application for the first edge device. The modules of the plurality of modules are capable of being used interoperably with other modules without altering the other modules.