Cloud Tag

Beacon technology for Asset Tracking

The advent of Internet of Things (IoT) has not only revolutionized IT networks but it also paved way for a range of new and innovative technologies. The beacon technology is one among them. Right from the time when Apple introduced the beacon technology in 2013 to till date, the technology has greatly evolved and is getting better every day. While the beacon technology was initially used by retail businesses, its functionality is now being extending to every field. Asset tracking with beacons is the new trend. Using the beacon technology, businesses are now able to implement cost-effective and highly scalable asset tracking solutions.

An Overview of Beacons
A beacon is a small Bluetooth-based device that is used to continuously transmit radio signals. This small form factor device contains a small radio transmitter and a battery. It uses the Bluetooth Low Energy(BLE) protocol to transmit data. As BLE consumes low energy, you can run beacons without draining out the battery. Depending on the size and functionality of the device, beacon batteries can last from 6 months to 5 years. However, it transmits low amounts of data which means you can’t transfer audio or streaming data.

The beacon technology is similar to Near-field Communication (NFC) technology. However, the difference lies in the range. While NFC functions within 8 inches, beacons can work within a range of 70 meters.

The State of Beacon Market
Beacons have become the first choice for many companies when it comes to Real-Time Location System (RTLS) solutions. According to Grandview Research, the global Bluetooth beacon market is expected to reach $58.7 billion by 2025, growing at a CAGR of 95.3% between 2017 and 2025. Similarly, Allied Market Research reports that the global beacon market would reach $14.839 billion by 2024, growing at a CAGR of 61.5% between 2018 and 2024. GM Insights reports that the market value of beacons was $170 million in 2016. This value is expected to grow at a CAGR of 80% between 2017 and 2024. The retail industry is the largest market for beacons followed by the health sector.

Source: https://www.statista.com/statistics/827293/world-beacons-technology-market-revenue-by-end-user/

Analyst firm Statista reports that the global beacon market was valued at $519.6 million in 2016. This value is expected to reach $56.6 billion by 2026, growing at a CAGR of 59.8% between 2016 and 2026.

The Technology behind Beacons
Beacons perform a single task. They just send a radio signal at pre-defined intervals. BLE-enabled devices such as smartphones receive these signals and act accordingly. Each beacon is assigned with a unique identifier. So, the device transmits this unique identifier which enables the receiver to identify the location of the beacon as well as the location of the user.

A beacon contains a small ARM (Advanced RISC machines) computer, Bluetooth connectivity module and a small battery. This small CPU runs the firmware written in low-level programming that controls the behaviour of the beacon. As the beacon’s job is to transmit its identifier, the small CPU power and battery is more than sufficient to process this data or encrypt the identifier. Inside the beacon you will find a small antenna that transmits electromagnetic waves. It uses the Bluetooth protocol. The latest Bluetooth standard is 4.2. The normal frequency of the beacon radio waves is 2.4 GHz and the maximum data limit for the 4.2 standard is 257 bytes. With such small amount of payload, beacons transmit the UUID, major, minor and the signal power. The receiving devices calculate the proximity of the beacon based on the transmitted signal power.

Beacon transmits the following components
Universally Unique Identifier (UUID): It is the unique identifier that differentiates your beacons from other devices outside your network.
Major Value: It is the unsigned integer value that tells you about the group in which the beacon is placed. For instance, beacons installed in the 1st floor will have the same major value. The value can be anything between 1 and 65535.
Minor Value: It is the unsigned integer that differentiates a beacon from a group. The value falls between 1 and 65535.

Here is an example of a UUID:
f626db6-3ga2-4e98-8013-bc5b71f0983c

When you talk about a beacon, you think about a physical device. However, some smartphones can act as a transmitter as well as a receiver. For instance, Apple doesn’t offer any physical beacon. It has incorporated the beacon technology into iOS 7 operating system. With more than 200 million iOS 7 devices in the market, Apple already has a considerable amount of beacons in the market.

How are beacons useful?
Beacons don’t relay any important message. They simply relay their IDs. It is the job of the receiver device to apply this information into a useful solution. For instance, a retail mall installs beacons inside the mall. When a customer visits the store and browses the electronic section of the mall, the beacon installed at that place will transmit its ID. The app in the smartphone of the customer will receive the ID and identifies the location of the customer. In this case, the app identifies that the customer is at the electronics section. So, the app will send discounts and offers related to the electronic products of that mall. Moreover, these offers would be specific and customized for that customer.

Asset tracking with Beacons
Asset tracking and management is a key requirement for any industry. Beacons can significantly reduce the cost and complexity of this job. There are multiple ways to track assets using beacons. For instance, you can mount BLE receivers in a permanent fixture and tag assets to beacons. When an asset comes into proximity of a BLE-enabled receiver, it tracks the movement via mobile data or Wi-Fi and logs the data. You can either take action or store the information for management and analytics purposes. Using beacons, you can cost-effectively track thousands of assets in real-time, 24/7.

There are instances wherein you cannot mount BLE receivers in permanent fixtures in temporary locations such as conference halls or function halls. In such cases, you can fix beacons in different places and track assets using a mobile app. By tagging assets to beacons, you can track each asset from the mobile app. Implementation is easy as there is no need for wiring or costly installation.

For more accuracy and maximum coverage, you can augment the beacon setup with additional receivers. You can install fixed beacons and fixed BLE receivers and augment them with moving beacons and moving BLE receivers. This setup can be extremely useful in low-signal areas such as ICUs of a hospital or a high-security airport check points. In areas such as large construction sites, environments quickly change. As such, you need a dynamic beacon architecture. In such cases, you can complement beacons with GPS and Wi-Fi. Depending on your environment, business type and requirement, you can choose the right deployment beacon technology.

Asset tracking with beacons is quickly gaining traction. Reports show that beacons have significantly reduced operational costs of asset management tasks. According to a Proximity Directory report, a total of 15,176,500 proximity sensors were installed globally in Q2, 2017. And, asset tracking with beacons is saving billions of dollars for the $9.1 billion logistics industry. Similarly, the health industry can save hundreds and thousands of dollars with an ROI of 275% by using asset tracking with beacons.

The advantages of beacons are enormous. Using beacons, you can track every item in the warehouse, track vehicles within the infrastructure, track equipment and machinery in a healthcare location, track luggage trolleys in airports, railway stations etc. In addition, you can track people/employees by giving them BLE-enabled devices.

Bluetooth 5.0 is offering additional capabilities in the form of 2x speed, 800% more broadcast messaging capacity and 4x range. As such, beacons are sure to disrupt the RTLS solutions in the coming days.

Hybrid Cloud Architecture with CISCO CSR 1000v

Cisco CSR 1000v series is a router software appliance from Cisco. It provides enterprise routing, VPN, Firewall, IP SLA, and more.CSR 1000v can be used to connect multiple VPC across all-region in AWS Cloud and on-premise networks. Thus it can be used avoid managed VPN service from AWS.

In AWS, you can find Cisco CSR 1000v in AWS marketplace which has 30 days free trial to test it out. AWS Marketplace for Cisco. Be aware this is not cheap, it will cost you EC2 Instance charges. All instance types are not supported for CSR 1000v. It supports only m3 and c3 instance family types.

Cisco CSR 1000v Can be used in various network models in cloud like Transit VPC, multi-cloud Network.

Following is the Architecture I have used to connect multiple VPC.

The two VPC’s are one in N.Virginia region and other is in Ohio Region. And Each VPC has Internet Gateway and were connected over VPN. On Ohio region, we used AWS managed VPN service to connect VPC in N.Virginia region VPC. And On-Premise Edge Router we used Cisco RV110W small business router. In this Post, I would like to mention the steps to follow to establish VPN over two VPC’s spread in two different regions in AWS.

Steps to create VPC’s in two regions:

1. Create VPC in N.Virginia Region with CIDR 10.0.0.0/16 and attach Internet Gateway to it. you can do it from CLI or through the management console.

   aws ec2 create-vpc --cidr-block 10.0.0.0/16 --region us-east-1
   
   Output:
   {
               "Vpc": {
                   "VpcId": "vpc-848344fd",
                   "InstanceTenancy": "dedicated",
                   "Tags": [],
                   "CidrBlockAssociations": [
                       {
                           "AssociationId": "vpc-cidr-assoc-8c4fb8e7",
                           "CidrBlock": "10.0.0.0/16",
                           "CidrBlockState": {
                               "State": "associated"
                           }
                       }
                   ],
                   "Ipv6CidrBlockAssociationSet": [],
                   "State": "pending",
                   "DhcpOptionsId": "dopt-38f7a057",
                   "CidrBlock": "10.0.0.0/16",
                   "IsDefault": false
               }
             }
   
   
   aws ec2 create-internet-gateway --region us-east-1
   
   Output:
   
             {
                 "InternetGateway": {
                     "Tags": [],
                     "InternetGatewayId": "igw-c0a643a9",
                     "Attachments": []
                 }
             }
   
   
   
   aws ec2 attach-internet-gateway --gateway-id <<IGW-ID>> --vpc-id <<VPC-ID>> --region us-east-1

2. Create two subnets in N.Virginia Region VPC, one for CSR 1000v with CIDR 10.0.0.0/24 and another subnet with CIDR 10.0.1.0/24.

   aws ec2 create-subnet --cidr-block 10.0.0.0/24 --vpc-id <<VPC-ID>> --region us-east-1
   
   Output:
   {
                 "Subnet": {
                   "VpcId": "vpc-a01106c2",
                   "AvailableIpAddressCount": 251,
                   "MapPublicIpOnLaunch": false,
                   "DefaultForAz": false,
                   "Ipv6CidrBlockAssociationSet": [],
                   "State": "pending",
                   "AvailabilityZone": "us-east-1a",
                   "SubnetId": "subnet-2c2de375",
                   "CidrBlock": "10.0.0.0/24",
                   "AssignIpv6AddressOnCreation": false
                 }
             }
   
   aws ec2 create-subnet --cidr-block 10.0.1.0/24 --vpc-id <<VPC-ID>> --region us-east-1
   
   Output:
   {
                 "Subnet": {
                   "VpcId": "vpc-a01106c2",
                   "AvailableIpAddressCount": 251,
                   "MapPublicIpOnLaunch": false,
                   "DefaultForAz": false,
                   "Ipv6CidrBlockAssociationSet": [],
                   "State": "pending",
                   "AvailabilityZone": "us-east-1b",
                   "SubnetId": "subnet-2c2de375",
                   "CidrBlock": "10.0.1.0/24",
                   "AssignIpv6AddressOnCreation": false
                 }
             }

3. Create Route Table in N.Virginia VPC which will have the default route to Internet Gateway.And associate CSR subnet to it.

4. Launch the CSR 1000v from AWS MarketPlace with the one-click launch. Link To AWS Marketplace, you can ssh into the CSR 1000v instance using ec2-user.Attach Elastic IP to the CSR instance which will act as Customer Gateway in N.Virginia Region VPC. In later steps, we will configure the router to add Static routes to other subnets in VPC and setting BGP to propagate routes over VPN Connection with other VPC.

5. In a similar fashion create VPC in AWS Ohio region with CIDR 10.1.0.0/16 And create two subnets with CIDR 10.1.0.0/24 and 10.1.1.0/24

Steps to Create VPN connection in AWS Ohio VPC

1. Create Customer Gateway. Open VPC management console at console.aws.amazon.com. In navigation pane choose Customer Gateway and then create new Customer Gateway. Enter Name, Routing type as Dynamic and EIP of the CSR 1000v instance in N.Viriginia Region VPC. ASN number is 16-bit and must be in the range of 64512 to 65534.
   
2. Create VPG and attach to the VPC.In the Navigation Pane choose Virtual Private Gateway and create VPG.
3.  Now Create VPN connection. In Navigation Pane Choose VPN Connection, Create New VPN Connection. Enter the Name, VPG and Customer Gateway which we have created previously, select routing type as Dynamic and create VPN connection.

It will take few minutes to create VPN connection. When it is ready to download the configuration for Cisco CSR from the drop-down menu.

Steps to establish VPN Connection on CSR 1000v

1. Add static routes of other subnets in VPC(N.Virginia) to CSR 1000v. Every subnet in AWS has a virtual router with IP address of Subnet CIDR +1. As CSR router will be in Subnet 10.0.0.0/24  the virtual router IP address will be 10.0.0.1. The Virtual Router on each subnet has a route to other all subnets in the VPC.

   >Configure terminal
   #ip route 10.0.1.0 255.255.255.0 10.0.0.1

2. Configure BGP. Choose the ASN number which you gave while creating Customer Gateway in Ohio VPC. Above we gave 64512

   > Configure terminal
   (config)#router bgp 64512
   (Config-router)# timers bgp keepalive holdtime
   (Config-router)# bgp log-neighbor-changes
   (Config-router)# end

   This step might not be necessary. But as good practice, I have applied the above configuration before copying the configuration file that is downloaded before.

3. Apply the Configurations that are downloaded previously when VPN Connections Created. After you have applied those setting on CSR you can see on the management console that both the tunnels of VPN as UP.

Testing to check connectivity between two VPC’s

1. Launch an instance in subnet1 in Ohio region VPC’s with Public IPv4. SSH into the instance and ping the CSR 1000v instance private IP.
2. Similarly, you can check connectivity with Ohio Region VPC by pinging the instance in subnet1 in Ohio region VPC with its Private IP.

Troubleshooting :

> Route Propagation must be added to the route table in Ohio Region VPC.

> You must configure CSR 1000v as NAT, so the subnets in N.Virginia region can access the hosts in Ohio region VPC via CSR 1000v. You need to Update the route table with target fo CSR 1000v instance-id after making it as NAT.

> Allow ICMP in Security groups on all instances.

Thanks and Regards

Naveen

AWS Solution Architect @CloudTern

Custom AMI with Custom hostname

I am using Amazon web services for a while now. And using it allowed me to have hands dirty on various services. In AWS AMI’s(Amazon Machine Image) provides the information like operating system, application server, and applications to launch into the virtual server(or can be called as an instance) in the cloud. There are lots of options for selecting AMIs provided by AWS or by the community. You can choose the preferred AMI that can meet your requirements. You can customize the instance that you have launched from the AMIs provided by AWS and can create your own AMI from that.All the AMIs created by you are private by default.

Interestingly the instances launched with Public AMIs in AWS comes with default user-name and no password authenticated which sometimes I don’t like. For example, Instances launched with Amazon Linux will have default user-name ec2-user and for Ubuntu instance default user-name is Ubuntu.

Instance launched with Public AMIs also does not allow you change the hostname on flight using user-data. Hostname for any instance launched with Public AMI looks something like

ip-<Private-IPv4>

Example: ip-172-1-20-201

So I have decided to create an AMI which will have default user as Naveen and password as *****. And I would like to have my instance named as myhostname.com i.e hostname. I will use a cloud config script to do that.

cloud-init is a multi-distribution package that handles early initialization of cloud instances.More information can be found at Cloud-Init. Some of the tasks performed by cloud-init are

• Set hostname
• Set the default Locale (default user)
• Generate host private ssh keys
• Parse and handle user-data

Custom AMI

For creating my Custom AMI with above-mentioned changes I have followed the below steps:

1. I have launched a t2.micro instance with Amazon Linux AMI ‘ami-4fffc834’. You can launch the instance using AWS management console or be using AWS command line(aws-cli). I have used the aws-cli to launch the instance.

aws ec2 run-instances --image-id ami-4fffc834 --count 1 --instance-type t2.micro --key-name Naveen

The above command will launch one t2.micro instance with the key name ‘Naveen’.

2.  As I have launched the instance using Amazon Linux, the default user-name is ec2-user. Amazon Linux does setting default user using cloud-init. The configuration file for setting default user can be found in /etc/cloud/cloud.cfg.d/00_default.cfg. The config file looks something like below

system_info:
# This will affect which distro class gets used
distro: amazon
distro_short: amzn
# Default user name + that default users groups (if added/used)
default_user:
name: ec2-user
lock_passwd: true
gecos: EC2 Default User
groups: [ wheel ]
sudo: [ "ALL=(ALL) NOPASSWD:ALL" ]
shell: /bin/bash
# Other config here will be given to the distro class and/or path classes
paths:
cloud_dir: /var/lib/cloud/
templates_dir: /etc/cloud/templates/
upstart_dir: /etc/init/
package_mirrors:
- arches: [ i386, x86_64 ]
search:
regional:
- repo.%(ec2_region)s.%(services_domain)s
- repo.%(ec2_region)s.amazonaws.com
ssh_svcname: sshd

 

The 00_default.cfg contains other things as well but I have posted only the one which needed to be changed. As we can see the default username for this distro is ec2-user. lock_passwd: true means the user who is trying to log in with the username ec2-user is not allowed to authenticate using a password.

3. I have changed the user-name to Naveen and lock_passwd: false in the config file. But this config file does not allow entering the normal password as part of the config file. You need to give the password for the user in the hash. So to do that I have used the following commands in Ubuntu machine

# mkpasswd comes with whois package
 sudo ap-get install whois

#To Generate hash using mkpasswd mkpasswd –method=SHA-512 #This will prompt to enter password #After entering password, mkpasswd will generate hash and output on console Ex:  $6$G0Vu5qLWx4cZSHBx$0VYLSoIQxpLKVhlU.oBJdVSW7Ellswerdf.r/ZqWRuijiyTjPAXJzeGwYe1D/f94tt/tf

Copy the above-generated hash and add it to ‘passwd’ key in the above config file. After making final changes in the config file

system_info:   # This will affect which distro class gets used   distro: amazon   distro_short: amzn   # Default user name + that default users groups (if added/used)   default_user:     name: Naveen     lock_passwd: false     passwd: $6$G0Vu5qLWx4cZSHBx$0VYLSoIQxpLKVhlU.oBJdVSW7Elwerfwq.r/ZqWRuijiyTjPAXJzeGwYe1D/f94tt/tf1lXQYJtMtQLpvAqE1     gecos: Modified Default User name     groups: [ wheel ]     sudo: [ “ALL=(ALL:ALL) ALL” ]     shell: /bin/bash   # Other config here will be given to the distro class and/or path classes   paths:     cloud_dir: /var/lib/cloud/     templates_dir: /etc/cloud/templates/     upstart_dir: /etc/init/   package_mirrors:     – arches: [ i386, x86_64 ]       search:         regional:           – repo.%(ec2_region)s.%(services_domain)s           – repo.%(ec2_region)s.amazonaws.com   ssh_svcname: sshd

4. Finally, i have made the following changes in rc.local which will change the behavior of ssh service to accept password authentication. And change the preserve_hostname to false in /etc/cloud.cfg

if grep -Fxq “PasswordAuthentication no” /etc/ssh/sshd_config then  sed -i ‘s/^PasswordAuthentication.*/PasswordAuthentication yes/’ /etc/ssh/sshd_config  /etc/init.d/sshd restart fi

With these changes above I have achieved adding default user-name with Naveen and with the default password. With changes above to the instance above I have created an AMI from the instance using aws-cli

aws ec2 create-image --instance-id i-09ebf4e320b0cadca --name "ONE_AMI"

Output:

{
    "ImageId": "ami-ebec0c91"
}

#Cloud-config for setting hostname

With the Customized i can launch the instance with user-name Naveen but still, the hostname will be in the format like IP-<Private-IPv4>. So  I have used the below cloud-config script to change the hostname.

#cloud-config
#set the hostmachine name
fqdn: myhostname.com
#Add additional users for the machine
users:
 - name: sysadmin
   groups: [root,wheel]
   passwd: $6$G0Vu5qLWx4cZSHBx$0VYLSoIQxpLKVhlU.oBJdVSW7EllsvFybq.r/ZqWRuijiyTjPAXJzeGwYe1D/f94tt/tf1lXQYJtMtQLpvAqE1
   sudo: ALL=(ALL:ALL) ALL   
#Final Message
final_message: "The system is finally up xcvxxxxxxxxxxxccccccccccccccccccccccc, after $UPTIME seconds"

The above script will create the instance with hostname myhostname.com and create a user sysadmin. The above script will be passed as part of user-data when launching an instance

aws ec2 run-instance --image-id ami-4240a138 --count 1 --intance-type t2.micro --user-data file://cloud.cfg

The above launch an instance without Key pair which means I can only log into the instance using the default user Naveen or using a username we have created in cloud configuration script that was passed a user-data.

Finally with this i have the instance with my custom default user-name and password, and a hostname with myhostname.com.

Path to the AWS Cloud