Infrastructure
co⚡e: Sparkplug™ MQTT edge and host
home
(WikiPage)
@hermsen @i-campbell SparkplugB Infrastructure Definitions This Page MQTT-Server | EoN | Sparkplug | Device/Sensor | SCADA/IIoT Host Node | MQTT Application Node | Roles and functions General Sparkplug info Infrastructure | Security | Messages Information and guides Sparkplug™ information | Preview how-to | Setup a test system with Ignition Primary Host | Add SparkplugB to an existing CODESYS project MQTT-Server This is maybe the simplest part of the Sparkplug infrastructure. Once you have an MQTT V3.1.1 compliant server up and running on hardware sized to manage all the expected traffic, configure the appropriate access controls for the level of risk of your application, and that's it! MQTT communicates over a single (inbound to the server) TCP port. This means every other node in the network need only have outbound firewall rules, which on most systems are allow all by default. If required, many Open Source MQTT Server implementations are available which offer multiple server instances for redundancy, high availability, and scalability. Sparkplug is able to take advantage of these MQTT features with no extra effort. MQTT Edge of Network Node (Edge) An MQTT Edge of Network Node (EoN) is any V3.1.1 compliant MQTT Client application that manages an MQTT Session and provides the physical and/or logical gateway functions required to participate in the Topic Namespace and Payload definitions of Sparkplug over MQTT. In CODESYS context the EoN is instantiated once within a program on a PLC near the edge of the network. Usually a single EoN instance per outgoing connection is necessary. The EoN node is responsible for any local protocol interface to existing legacy devices like other PLCs, RTUs, Flow Computers, Sensors, etc. and/or any local discrete I/O or any logical internal variables. MQTT Enabled Device (a 'Sparkplug') This represents any device, sensor, or hardware that directly connects to MQTT infrastructure using a compliant MQTT 3.1.1 connection with the payload and topic notation as outlined in the Sparkplug specification. Note that it will be represented as an EoN node in the Sparkplug topic payload. Device/Sensor The Device/Sensor represents any physical or logical device connected to the MQTT EoN providing any data, process variables or metrics. This can be seen as any data from PLCs, RTUs, Flow Computers, Sensors, etc. and/or any local discrete I/O or any logical internal variables. SCADA/IIoT Host Node (Primary Node) The SCADA/IIoT Host Node is any MQTT Client application that subscribes to and publishes messages. In typical SCADA/IIoT infrastructure implementations, there will be only one Primary SCADA/IIoT Host Node responsible for the monitoring and control of a given group of MQTT EoN nodes. Sparkplug does support the notion of multiple critical Host applications. This does not preclude any number of additional MQTT SCADA/IIoT Nodes participating in the infrastructure that are in either a pure monitoring mode, or in the role of a hot standby should the Primary MQTT SCADA/IIoT Host go offline. MQTT Application Node An MQTT Application Node is any non-primary MQTT SCADA/IIoT Client application that consumes the real-time messages or any other data being published with proper permission and security.We Roles and functions Function MQTT Broker EoN Node Device/Sensor SCADA/IIot Host node Application Node Relay Messages x publish xDATA x publish xBIRTH x publish DDEATH x Last will NDEATH x Read xCMD x ? x Read xDATA x x publish xCMD x publish STATE x last will STATE x Read STATE x x x Read xBIRTH x x Read xDEATH x x
Last updated: 2021-05-15
Security
co⚡e: Sparkplug™ MQTT edge and host
home
(WikiPage)
@hermsen @i-campbell SparkplugB Security Definitions This Page Authentication | Authorization | Encryption General Sparkplug info Infrastructure | Security | Messages Information and guides Sparkplug™ information | Preview how-to | Setup a test system with Ignition Primary Host | Add SparkplugB to an existing CODESYS project Authentication There are several levels of security and access control configured within an MQTT infrastructure. From a pure MQTT client perspective, the client does need to provide a mandatory unique Client ID, optional Username and Password Authorization Although access control is not mandated in the MQTT specification for use in MQTT Server implementations, Access Control List (ACL) functionality is available for most MQTT Server implementations. The ACL of an MQTT Server implementation is used to specify which Topic Namespace any MQTT Client can subscribe to and publish on. For further information on this topic see your MQTT broker's documentation. Encryption The MQTT specification does not specify any TCP/IP security scheme as it was envisaged that TCP/IP security would (and did) change over time. In short, SparkplugB lifts upon MQTT, which lifts upon TCP/IP and it's ever evolving security, so SparkplugB is by design equipped with the latest security features. Allthough Sparkplug B will not specify any TCP/IP security schema it will provide examples on how to secure an MQTT infrastructure using TLS security.
Last updated: 2021-05-15