AWS re:Invent 2022 - Building connected vehicle and mobility platforms with AWS (IOT311)
AWS re:Invent 2022 - Building connected vehicle and mobility platforms with AWS (IOT311)
By 2030, it’s projected that 100 percent of new vehicles sold will ship with connectivity platforms. In this session, learn about the services and solutions that AWS provides to help OEMs, Tier 1 suppliers, fleet telematics solution providers, and automotive ISVs build and deploy systems that securely connect vehicle fleets to the cloud. Learn more about AWS’s vision, newest capabilities, and best practices for connected vehicle platforms.
ABOUT AWS Amazon Web Services (AWS) hosts events, both online and in-person, bringing the cloud computing community together to connect, collaborate, and learn from AWS experts.
AWS is the world’s most comprehensive and broadly adopted cloud platform, offering over 200 fully featured services from data centers globally. Millions of customers—including the fastest-growing startups, largest enterprises, and leading government agencies—are using AWS to lower costs, become more agile, and innovate faster.
#reInvent2022 #AWSreInvent2022 #AWSEvents
Content
0.21 -> - So my name is Katja,
1.86 -> I'm IoT Specialist Solutions Architect.
4.17 -> have been with the company
since 2019, but IoT's so cool.
8.58 -> So I decided to switch over
to IoT beginning of this year.
12.75 -> I'm joined by two amazing people today,
16.41 -> first is Mike,
17.31 -> who is General Manager in
the automotive space at AWS.
22.2 -> And very exciting as well,
23.67 -> we have a company that
you might have heard of,
25.74 -> so Mercedes is joining us with
the Chief Architect, Kevin,
29.88 -> to tell you about the exciting story
32.07 -> to connect vehicles using AWS.
36.57 -> Before we dive into the topic
39.277 -> "How to build connected
vehicle platforms on AWS,"
44.79 -> I wanna take a step back
and talk to you about scale.
49.02 -> So in 2020, a level 1 vehicle model
54.3 -> might produce up to one
gigabytes of data per hour.
58.98 -> We're going a step further, 2022,
62.25 -> we're talking about already
level 2 plus vehicle models,
65.76 -> which generate more than one
terabytes of data per hour.
70.8 -> Looking at the whole market
72.33 -> of a hundred million vehicles per year,
75.18 -> that might be driving
around four hours per day,
78.3 -> 300 days a year,
80.1 -> we're going up to 120 zetabytes of data.
85.41 -> That's massive scale,
87.66 -> but we don't end in 2022,
89.7 -> so let's go further.
92.943 -> And in 2030, a level 3 plus vehicle model
97.14 -> will produce more than
10 terabytes of data
101.64 -> in a single hour.
103.71 -> Multiplying the 120 zetabytes
we had before with 10,
108.3 -> we end up with 1.2
yottabytes of data in total.
115.41 -> So there is no compression
algorithm for experience.
119.94 -> So AWS, since day one,
123.06 -> has built scalable platforms and services,
126.6 -> and we wanna talk to you today
129.3 -> about which of these you
can actually leverage
132.51 -> to focus on your benefits and
leave the heavy lifting to us.
140.07 -> Before we can actually dive
into how and what to build,
144.06 -> let's start with the
challenges and opportunities.
147.66 -> So first of all,
148.65 -> instrumenting the
physical world takes time.
152.64 -> So there is a need for organizations
155.04 -> to automate vehicle
onboarding and testing.
159.6 -> Second would be that
future vehicle models,
162.21 -> as we just heard,
163.95 -> will generate multiple
terabytes of data per hour.
169.08 -> So we need better tools to discover
172.2 -> and collect high-volume data.
176.07 -> Last but not least,
177.78 -> with massive scale comes
more responsibility.
181.86 -> So let's earn customer
trust with robustness,
185.58 -> which would be high availability,
188.46 -> security, as well as privacy.
194.13 -> Let's look at how this architecture
197.01 -> for connected vehicle
platform might look like.
200.19 -> We start at the very
bottom with a device layer,
203.19 -> which is about functions
for hardware abstraction,
207.21 -> the operating system,
208.74 -> as well as device
onboarding and management,
211.62 -> its very foundation.
213.57 -> On top, we have the connectivity layer,
216.81 -> which concerns itself with the connection,
219.33 -> the secure connection
between vehicle and cloud
223.29 -> using protocols like MQTT or HTTPS.
228.24 -> Between vehicle and cloud, we
have two abstraction layers,
231.66 -> which are software and data abstraction,
234.57 -> which should provide a unified view
237.09 -> of software and data afterwards.
240.33 -> In the cloud we have the operations there,
243.27 -> which is about monitoring,
performing customer support,
246.87 -> as well as managing deployments.
250.08 -> And then last but not least,
251.91 -> the one layer that
differentiates your product
254.55 -> and your business is
the applications layer.
259.35 -> And we at AWS recommend customers
261.78 -> to leave the undifferentiated
heavy lifting to AWS.
265.74 -> So everything from the vice
layer up to operations layer
269.91 -> is something that we can help you with
272.73 -> to focus on the level
275.61 -> or give you the opportunity
to focus on the level
278.04 -> that differentiates your business.
281.49 -> Because of the time we have today,
283.05 -> we are going to pick a few
of this area and dive deep
287.31 -> and show you how that can be done.
289.89 -> So we're talking about device
layer, connectivity layer,
293.34 -> as well as data obstruction.
298.05 -> In a little more detail,
299.7 -> that means that I'm going
to talk today or start
303.45 -> with connected vehicle device management.
306.48 -> So we are leveraging AWS cloud services
310.38 -> to issue and register certificates
313.68 -> for secure communication from vehicle over
317.1 -> or from their vehicle
gateway over to AWS IoT core.
322.38 -> Second is connected
vehicle device defender.
325.59 -> So we are leveraging a service
327.27 -> called AWS IoT Device Defender
330.36 -> to detect revoked certificates
333.33 -> as well as certificates
that are about to expire
336.48 -> and perform rotation of those certificates
341.43 -> in an automated way using
AWS IoT managed services.
346.95 -> Last but not least,
348.36 -> we launched MQTT 5 for AWS
IoT Core just a few days ago,
354.36 -> and this is so exciting news
that we want to share today
358.05 -> and dive into accelerating and optimizing
361.2 -> the communication
between vehicle and cloud
363.78 -> with you in this session today.
369.99 -> So as I said,
370.823 -> we're starting with
securing ECU communication.
374.37 -> This is the very foundation,
we saw that before.
377.79 -> We have the device layer,
379.5 -> builds the foundation for everything
382.08 -> when it comes to the
connected vehicle platform,
385.83 -> as well as us considering
that we have a market
389.58 -> of a hundred million vehicles per year,
392.82 -> so this is something that
actually has to happen at scale.
397.32 -> We're going to look at the
architecture for this now.
400.5 -> So you see, on the left,
we have the vehicle itself
405.12 -> with a vehicle gateway
406.8 -> which manages the communication
from vehicle to cloud.
411.78 -> We have a attestation,
413.01 -> so a long lift certificate on
the vehicle itself already,
417.33 -> and are using SDK, so AWS
IoT SDK or a third-party SDK,
423.81 -> for the communication over to cloud.
428.76 -> On premises, we have a
root, like a trust anchor,
432.75 -> that we wanna leverage
434.79 -> for issuing a subordinate
CA within the cloud
438.84 -> using the service AWS Private CA.
442.98 -> And we have AWS IoT Core,
445.65 -> where we need to import the certificate
448.95 -> of the subordinate CA for the later flow
452.91 -> for issuing and registering
the certificate.
456.6 -> This one is also going to include
459.66 -> the just in time registration flow
462.3 -> we have in AWS IoT core,
465.15 -> which is, when we talk to OEMs,
468.93 -> the flow we usually lend up with
471.66 -> when it comes to a best practice
for device provisioning.
480.48 -> So the next step we're going
to go is, first of all,
482.64 -> we want to have the
operational certificate we use
485.49 -> for the mutual TLS
communication on the vehicle.
488.85 -> Two options, we might
do or have the option
492.27 -> to send over a CRS,
494.55 -> so use client-generated private key
499.02 -> to issue the CRS,
500.31 -> send it over to an interface
we have on premises,
503.19 -> so a certificate broker,
505.05 -> which then communicates
with the subordinate CA
508.05 -> to issue the certificate and get it back
511.26 -> over a secure channel you have
to have established before
514.95 -> to the vehicle itself.
517.29 -> A more batch oriented approach
519.06 -> would be that serve a
generated private key,
522.09 -> so you can issue multiple certificates
524.07 -> using the same interface
with AWS Private CA
527.52 -> and communicate those back to vehicle
530.13 -> also over a channel that is secured.
533.67 -> When we store the operational certificate,
536.07 -> the vehicle gateway should
check for the authenticity
539.31 -> as well as the integrity
of the certificate before.
544.2 -> We're then going to use the certificate
546.12 -> to connect over to AWS IoT Core
549.84 -> and kick off this just in
time flow I mentioned before,
553.77 -> the best practice to
register the certificate,
558.21 -> because it has been signed
by subordinate CA before.
562.11 -> And then trigger lambda function,
564.27 -> which then does custom testing
566.91 -> if you want to check with the
database or something else
569.67 -> to make sure everything is valid
571.71 -> and then create the
resources of an IoT thing,
576.78 -> an IoT policy,
578.13 -> which is a fine granular
policy for your vehicle,
581.28 -> what it actually can do in AWS IoT,
584.64 -> and activate the certificate.
590.31 -> Once we have a certificate,
we are not done,
593.43 -> because in the automotive space,
596.97 -> it seldomly is the case that
the automotive car owner
601.71 -> actually owns the vehicle
from manufacturing time
606.12 -> till end of life.
608.01 -> Often, people own cars
for about six years.
611.52 -> So we actually need the
opportunity to rotate certificates
617.25 -> also for the end of life, of course,
620.43 -> if we wanna revoke
certificates after that.
623.91 -> So that's what we're going to look at.
626.91 -> We're going to use AWS
IoT Device Defender,
631.47 -> which gives us the option to
use automated audit checks,
636 -> which look, first of all,
637.95 -> one of those checks could be
looking for revoked certificate
642.69 -> or certificates that are about to expire
646.11 -> within the next 30 days or have expired.
651.33 -> Also with this AWS IoT Device Defender,
654.72 -> we offer mitigation
actions out of the box.
658.68 -> First of those would be
deactivating the certificate,
662.7 -> which would make sense if the CRL
665.61 -> actually had a positive result
667.71 -> for the certificate being on there.
671.04 -> And second would be
publishing the finding to SNS,
675.21 -> so our notification service,
677.49 -> invoking lambda function,
679.35 -> which then uses AWS IoT jobs,
682.89 -> which make it easy for you
685.14 -> to create and register a new certificate
689.07 -> and then deactivating the old one.
693.36 -> Also, there might be the case
696.18 -> that your operational certificate
698.64 -> was valid for a certain period of time,
701.1 -> but your vehicle actually
was switched off longer,
704.49 -> so you don't have a valid
operational certificate anymore.
708.57 -> In this case,
709.403 -> you still have the
attestation certificate here
712.5 -> that you can leverage
713.43 -> to go back to the first
floor we saw before
716.7 -> to restart the communication
with the certificate broker
720.09 -> and get a valid operational
certificate again,
723.18 -> just as a plan B.
727.89 -> As I said, we launched MQTT 5.
731.04 -> I think we have all been waiting for this.
732.93 -> So this is really, really exciting news.
735.78 -> And while it's suited for many markets,
738.3 -> the automotive industry
has embraced MQTT 5
743.61 -> as its new standard for
connected vehicle platforms.
748.2 -> The ease of implementation,
enhanced security,
752.13 -> as well as the ability to
deliver large amounts of data
756.72 -> with a simple published
and subscribe method
759.99 -> have enabled MQTT 5 to
support order technologies
764.85 -> like HTTP or SMS.
769.53 -> We're going to look at
three of the features.
772.29 -> So we're selective here again,
774.15 -> three of the features because of time,
776.16 -> we're looking at shared subscriptions,
779.31 -> we're looking at request response,
781.11 -> as well as the header fields
783.24 -> that add benefit to your
connected vehicle platform.
791.1 -> First of all, for shared subscriptions,
795.99 -> so that's what we're going to start with,
798.42 -> imagine, you might have one,
800.46 -> but if you don't,
801.57 -> imagine you have a huge
fleet of vehicles connected,
807.27 -> and those vehicle fleet
809.46 -> or that vehicle fleet
with a lot of vehicles,
813.06 -> they publish similar messages
requesting configuration
818.46 -> or publishing status updates.
822.9 -> Now, before we launched MQTT 5,
825.24 -> you could publish all of
these messages to one topic
829.47 -> and have one subscriber
831.3 -> that actually listens in
and works on those messages.
836.25 -> But we talked about scale before,
838.41 -> so now, you can actually publish those
841.44 -> to a shared subscription topic
845.28 -> which has multiple subscribers
848.28 -> to listening to the incoming messages.
853.08 -> This means we are going to load balance
855.24 -> the messages for you.
856.44 -> So only one of the receivers,
858.21 -> well, actually our subscribers,
859.65 -> will actually receive the message,
862.62 -> which also means that in
case something is wrong
866.1 -> with one of your backend services,
868.29 -> you can actually take that one offline.
870.48 -> You still have multiple alternatives
873.6 -> as receivers for the message,
875.64 -> and your vehicle isn't
influenced by a failing backend.
882.69 -> So that's shared subscriptions.
886.92 -> Second, we wanna look at request response.
892.05 -> So if we look at this
request response pattern,
896.52 -> today, there's no simple way
899.34 -> of getting positive acknowledgements
back from the vehicle
903.03 -> that you told that
something should happened
905.64 -> and it actually has happened.
908.13 -> So it received a command
and it executed it.
912.69 -> Now we have, with MQTT 5,
915.21 -> the option to specify a response topic.
917.55 -> So you send from, in this
case, a lambda function,
920.22 -> the message to a topic
921.3 -> and have the vehicle receive the message,
924.06 -> and then on completion of
the command that it receives,
927.84 -> it goes back to the response
topic with a success message.
932.88 -> Just a note here, in case you
want to have this combined
936.6 -> or want to have something
for your commands
938.97 -> that's more stateful,
940.47 -> look at the service called
AWS IoT Device Shadows.
947.52 -> Last topic I wanna cover with you today
950.25 -> is optimizing message routing.
952.89 -> So the rules engine and IoT
Out Of The Box supports JSON,
957.75 -> which allows you to make
full use of the rules engine
961.92 -> and specify when you wanna route a message
965.46 -> to which destination.
968.13 -> In case we have a message like this
970.11 -> which is protobuf encoded,
972.69 -> we actually can't make full
use of the rules engine
976.14 -> because protobuf is a natively supported.
978.84 -> Same problem if you send
a compressed message
981.39 -> where you can't inspect the
message in the rules engine.
985.32 -> Now with the header fields,
987.48 -> you can actually determine
989.07 -> in the information you get
additionally to the payload
993.03 -> where you want to store a message.
995.76 -> We're looking at two flows
here for a short example.
1000.35 -> First of all, you store
a message in a data lake,
1004.94 -> and second, you also
have a protobuf decoder,
1008.33 -> which would receive a
message if it's protobuf.
1011.36 -> And then we republished to a topic
1013.13 -> and also store it in a data lake.
1017.48 -> I'm giving you a example query here
1020.48 -> to show you the benefit now
1022.85 -> is that you can take from the header,
1025.91 -> content type in this case
as well as format indicator,
1030.08 -> which allow you to see
1031.46 -> that the message actually is protobuf,
1034.4 -> and it's the end of sending
it to the same destination,
1037.43 -> to the same backend,
1038.54 -> which then has to figure out
where to put the message to.
1042.92 -> You can use this very powerful
rules engine to send it now
1050.073 -> in this role to the protobuf decoder.
1055.64 -> This allows you to take
weight off your backend,
1059.24 -> make full use of the rules engine,
1061.52 -> and optimize your routing
1063.11 -> because the message goes
directly to the destination
1067.76 -> it's spilled for.
1071.75 -> So now we covered the device layer
1075.56 -> as well as the connectivity layer,
1078.17 -> and I'm handing over
to the data geek, Mike,
1081.86 -> who's going to talk to you about
the data abstraction layer.