Device authentication

Authentication methods

• Unique-certificate-per-device: Burn the ProductKey, DeviceName, and DeviceSecret onto each device. Then, adapt the corresponding Hardware Abstraction Layer (HAL) and call the function provided by the SDK to connect to IoT Platform. This method requires you to modify your production line tools to burn a unique DeviceName and DeviceSecret onto each device.

• One-Type-One-Secret: In this method, a fixed ProductKey and ProductSecret are flashed onto each device. Each device must also have a unique identifier that is uploaded to the Alibaba Cloud IoT Platform in advance. Then, you can call a function provided by the SDK to connect the device to the cloud.

Get Link SDK

To download different versions of Link SDK, see Get SDK.

Unique-certificate-per-device programming

• For Link SDK v3.0.1, implement the following HAL functions:
  • HAL_GetProductKey
  • HAL_GetDeviceName
  • HAL_GetDeviceSecret
• For Link SDK v3.1.0 and v3.2.0, set the authentication information using `IOT_Ioctl`:
  • IOT_Ioctl(IOTX_IOCTL_SET_PRODUCT_KEY, g_product_key)
  • IOT_Ioctl(IOTX_IOCTL_SET_DEVICE_NAME, g_device_name)
  • IOT_Ioctl(IOTX_IOCTL_SET_DEVICE_SECRET, g_device_secret)

int main(int argc, char *argv[])
{
    void                   *pclient = NULL;
    int                     res = 0;
    int                     loop_cnt = 0;
    iotx_mqtt_param_t       mqtt_params;

    memset(&mqtt_params, 0x0, sizeof(mqtt_params));
    mqtt_params.handle_event.h_fp = example_event_handle;

    pclient = IOT_MQTT_Construct(&mqtt_params);
    if (NULL == pclient) {
        EXAMPLE_TRACE("MQTT construct failed");
        return -1;
    }
    ...

} 

Unique-certificate-per-product programming

The following diagram shows the flow of the unique-certificate-per-product authentication method.

The following API operations are involved in the implementation flow:

• Steps 1 and 2 correspond to the IOT_Dynamic_Register() function.
• Step 3 corresponds to the IOT_Sign_MQTT() function.
• Step 4 corresponds to the IOT_MQTT_Construct() function.

Example

Take Link SDK v3.0.1 as an example. For a sample program for the unique-certificate-per-product feature, see the src/dynamic_register/examples/dynreg_example.c file.

The following sections explain the code segment by segment:

1. To use the unique-certificate-per-product feature, include its header file dynreg_api.h:

   #include <stdio.h>
   #include <string.h>
   #include "infra_types.h"
   #include "infra_defs.h"
   #include "dynreg_api.h"

2. Prepare the input parameter region and the input/output struct meta:

   iotx_http_region_types_t region = IOTX_HTTP_REGION_SHANGHAI;
   HAL_Printf("dynreg example\n");
   
   memset(&meta,0,sizeof(iotx_dev_meta_info_t));
   HAL_GetProductKey(meta.product_key);
   HAL_GetProductSecret(meta.product_secret);
   HAL_GetDeviceName(meta.device_name);

   Note

   • The input parameter region = IOTX_CLOUD_REGION_SHANGHAI indicates that the China (Shanghai) region is used as the connection site for this demo. Replace this value with your site as needed. For more information, see Regions and zones.
   • The input parameter meta represents the ProductKey, ProductSecret, and DeviceName obtained locally.
3. Call the IOT_Dynamic_Register() API operation to obtain the DeviceSecret. This is the only user-facing API operation for the unique-certificate-per-product feature. If the call is successful, the meta parameter is populated with the DeviceSecret obtained from IoT Platform.

   res = IOT_Dynamic_Register(region, &meta);
   if (res < 0) {
       HAL_Printf("IOT_Dynamic_Register failed\n");
       return -1;
   }
   
   HAL_Printf("\nDevice Secret: %s\n\n", meta.device_secret);

Feature API operations