Knowledge Nugget
Ditto:
Things, Policies and Messages
13.07.2023 @ beyonnex.io
by Thomas Jäckle (@thjaeckle)
Digital Twins
- digital representation of physical devices
- can also represent other concepts (like rooms)
- twin as broker for communicating with assets
- in Ditto, a twin is simply called thing
Eclipse Ditto in context
Ditto as
IoT
and/or
Digital Twin
"middleware"
turn device data into APIs
{
"thingId": "io.beyonnex.srt:my-srt",
"policyId": "io.beyonnex.room:my-room",
"attributes": {
"serial": "4711-0815",
"location": {
"buildingId": "nice-building"
}
},
"features": {
"temp": {
"properties": {
"value": 23.42
}
}
}
}JSON repr. of a Thing
GET/PUT/PATCH/DELETE /things/io.beyonnex.srt:my-srt
/things/io.beyonnex.srt:my-srt/thingId
/things/io.beyonnex.srt:my-srt/policyId
/things/io.beyonnex.srt:my-srt/attributes
/things/io.beyonnex.srt:my-srt/attributes/serial
/things/io.beyonnex.srt:my-srt/attributes/location
/things/io.beyonnex.srt:my-srt/attributes/location/buildingId
/things/io.beyonnex.srt:my-srt/features
/things/io.beyonnex.srt:my-srt/features/temp
/things/io.beyonnex.srt:my-srt/features/temp/properties
/things/io.beyonnex.srt:my-srt/features/temp/properties/value
HTTP API of the Thing
→ docsauthorization via Policies
- Ditto contains a built-in authorization mechanism (Policies)
- every API call is authorized
- auth who (subjects) on what (resources) with which (grant/revoke) effects
{
"policyId": "io.beyonnex.room-group:my-room-group",
"imports": {
"io.beyonnex:connect-go": {},
"io.beyonnex.building:my-building": {}
},
"entries": {
"resident-user": {
"subjects": {
"cognito:{some-user-sub}": {
"type": "Extracted {sub} claim of JWT"
}
},
"resources": {
"thing:/": {
"grant": ["READ","WRITE"],
"revoke": []
},
"thing:/features/firmware": {
"grant": [],
"revoke": ["WRITE"]
},
"policy:/": {
"grant": ["READ","WRITE"],
"revoke": []
},
"message:/": {
"grant": ["WRITE"],
"revoke": []
}
},
"importable": "implicit"
}
}
}sending/receiving messages
- Ditto as router of messages
- TO device: "actions"
FROM device: "events" - access control via Policies
- correlation of command/response (e.g. for sync. HTTP API)
- payload agnostic (e.g. send XML or binary)
messages: examples
- enhance a location-aware Twin with the current weather
- enhance a Twin with an API for its known spare parts
Demo
- Postman