Create a cloud gateway (JT/T 808)

Add a cloud gateway

1. Log on to the IoT Platform console.

2. On the Instance Overview page, click the target Enterprise instance of the Exclusive Edition.

3. In the navigation pane on the left, choose Device Management > Cloud Gateway, and then click Add Cloud Gateway.

4. Configure the parameters and click Confirm.

   Parameter	Description
   Cloud gateway name	Enter a name for the cloud gateway. The name must be unique within the instance. The name can be 4 to 30 characters in length and can contain Chinese characters, Japanese characters, letters, digits, and underscores (_). A Chinese or Japanese character is counted as two characters.
   Protocol	Select JT/T 808.
   Custom port number	Integer from 1024 to 65535. Default: 7999.
   Authentication type	One-party authentication Import the Manufacturer ID, Terminal Model, and Terminal ID into IoT Platform for device authentication. Third-party authentication Alibaba Cloud Function Compute: Set the Device Authentication FC Service, Device Authentication FC Function, and Authorization parameters. Select an existing FC function or create one. You can specify a custom name for the authentication function. The request and response parameters must follow the specified format. Parameter details: Table 1. Device registration parameters for FC authentication, Table 2. Device authentication parameters for FC authentication, and Table 3. Device deregistration parameters for FC authentication. Click Create Service to create an FC service. Manage services. Click Create Function to create an FC function. Manage functions. If the AliyunIOTAccessingFCRole role does not exist, click Create RAM Role to create it in the RAM console. Create a RAM role.
   Transmission protocol	TCP For TCP connections, use a dedicated connection instead of the public internet for better security. Important If you select the TCP protocol, click Finish to create the cloud gateway. You do not need to configure certificates. TLS TLS supports server-side one-way authentication, device-side OCSP, and mutual authentication. Enable X.509 device authentication and configure Enable OCSP: Disabled OCSP Verification for Server Certificate OCSP Verification for Client Certificate OCSP Verification for Client and Server Certificates Disable X.509 device authentication and configure Enable OCSP: Disabled OCSP Verification for Server Certificate Note Online Certificate Status Protocol (OCSP) is an Internet protocol used to query a certificate authority (CA) about the revocation status of a certificate. OCSP verification for a client certificate is performed when the client sends a message. If the certificate is revoked, the server actively closes the connection. The default cache duration for the server-side OCSP Stapling feature is 5 to 60 minutes. After the cache expires, OCSP Stapling does not take effect for the first access request until the OCSP Stapling information is obtained again.

   Table 1. Device registration parameters for FC authentication

   Parameter type	Parameter name	Type	Description	Example
   Request parameters	manufacturer	String	The manufacturer ID of the device. Must be 4 to 11 characters long and contain only letters, digits, and hyphens (-).	{ "manufacturer":"mf0001", "deviceModel":"dm0001", "deviceId":"di0001", "licensePlateColour":"1", "licensePlateNumber":"ZheA****", "phone":"1**********", "protocol":"jt808", "action":"register" }
   	deviceModel	String	The device model. Must be 4 to 30 characters long and contain only letters, digits, and hyphens (-).
   	deviceId	String	The device ID. Must be 4 to 30 characters long and contain only letters, digits, and hyphens (-).
   	licensePlateColour	String	The color of the license plate. The value must comply with the JT/T 808 protocol. For more information, see the JT/T 808-2019 protocol specification.
   	licensePlateNumber	String	The license plate number.
   	phone	String	The mobile phone number.
   	protocol	String	The device connection protocol. Set to jt808.
   	action	String	Set to register to indicate device registration.
   Response parameters	result	String	Indicates whether registration succeeded. Valid values: true: The registration was successful. false: The registration failed.	Sample success response: { "result":"true", "message":"", "authCode":"****" } Sample failure response: { "result":"false", "message":"4" }
   	message	String	The error message if registration fails. Valid values: 1: The vehicle is already registered. 2: The vehicle does not exist. 3: The terminal is already registered. 4: The terminal does not exist.
   	authCode	String	The authentication code if registration succeeds.

   Table 2. Device authentication parameters for FC authentication

   Parameter type	Parameter name	Type	Description	Example
   Request parameters	phone	String	The mobile phone number.	{ "phone":"1**********", "authCode":"****", "protocol":"jt808", "action":"auth" }
   	authCode	String	The authentication code returned upon successful registration.
   	protocol	String	The device connection protocol. Set to jt808.
   	action	String	Set to auth to indicate device authentication.
   Response parameters	result	String	Indicates whether authentication succeeded. Valid values: true: The authentication was successful. false: The authentication failed.	{ "result":"true", "message":"", "manufacturer":"mf0001", "deviceModel":"dm0001", "deviceId":"di0001" }
   	message	String	The error message if authentication fails.
   	manufacturer	String	The manufacturer ID if authentication succeeds.
   	deviceModel	String	The device model if authentication succeeds.
   	deviceId	String	The device ID if authentication succeeds.

   Table 3. Device deregistration parameters for FC authentication

   Parameter type	Parameter name	Type	Description	Example
   Request parameters	manufacturer	String	The manufacturer ID of the device.	{ "phone":"1**********", "manufacturer":"mf0001", "deviceModel":"dm0001", "deviceId":"di0001", "protocol":"jt808", "action":"unregister" }
   	deviceModel	String	The device model.
   	deviceId	String	The device ID.
   	phone	String	The mobile phone number.
   	protocol	String	The device connection protocol. Set to jt808.
   	action	String	Set to unregister to indicate device deregistration.
   Response parameters	result	String	Indicates whether deregistration succeeded. Valid values: true: The deregistration was successful. false: The deregistration failed.	{ "result":"true", "message":"" }
   	message	String	The error message if deregistration fails.

5. Complete the Certificate Configuration and click OK.

   Important

   • IoT Platform supports private CAs that use RSA, ECC, and Chinese cryptographic algorithms (SM2, SM3, and SM4).

   • If you select TCP as the transmission protocol, you do not need to configure certificates.

   Use the Alibaba Cloud PCA service

   Important

   If you enabled OCSP in the previous step, you cannot use the PCA service and must enter the certificate details manually.

   Use an existing Private Certificate Authority (PCA) instance or create one. What is a PCA certificate?

   1. You must configure the Server Certificate and Server Certificate Private Key.

   2. If you enable X.509 certificate authentication, you must also configure the Device Certificate.

   3. If the OCSP authentication method is OCSP Verification for Server Certificate or OCSP Verification for Client and Server Certificates, the Trusted Certificate defaults to the server's root certificate.

   Manual certificate entry

   You can use a self-issued CA certificate. Issue a custom certificate.

   Important

   The certificates that you configure must be in the PEM format.

   1. Configure the Server Certificate and Server Certificate Private Key.

   2. If you enable X.509 certificate authentication, you must also configure the Device Root Certificate.

   3. If the OCSP authentication method is OCSP Verification for Server Certificate or OCSP Verification for Client and Server Certificates, the Trusted Certificate defaults to the server's root certificate.

6. In the list of cloud gateways, view your gateway's information, including its name, ID, gateway URL, status, and associated product.

   Important

   Save the gateway URL. Devices connect through this URL. Either replace the endpoint domain name with the gateway URL or configure a CNAME record to resolve it to the gateway URL.

   On the Cloud Gateway page, find and copy the gateway URL from the Gateway URL column.

Optional: Edit a cloud gateway

After you create a cloud gateway, find it in the cloud gateway list and click Edit in the Actions column to modify the gateway's name, certificate information, and FC authentication function.

Updating certificate information restarts the device connection layer service, which causes all online devices in the instance to disconnect and reconnect. Before clicking Confirm, verify this will not impact your business.