RTI DDS Intro with DDS Secure

© 2014 Real-Time Innovations, Inc.
Real Time Innovations, Inc.
The Communications Platform for the Industrial Internet of Things™

© 2014 Real-Time Innovations, Inc.3
Agenda
• Introduction to RTI
• Introduction to Data Distribution Service (DDS)
• DDS Secure
• Connext DDS Professional
• Real-World Use Cases
• RTI Professional Services
• Questions

Introduction to RTI

RTI Company Snapshot
• World leader in fast, scalable communications software for
real-time operational systems
• Strong leadership in Aerospace and Defense; broadening
adoption in Energy, Industrial Control, Automotive,
Healthcare, Smart Cars, and more
• Over 350,000 deployed licenses in over 800 unique projects
• Privately held
• Based in Silicon Valley
• Worldwide offices
• IIC Steering Committee

RTI Excels at Operational Systems

RTI Named Most Influential IIoT Company

Critical Systems Trust RTI
• World’s largest Wind Power company
• World’s largest Underground Mining Equipment company
• World’s largest Navy (all surface ships)
• World’s largest Automotive company
• World’s largest Emergency Medical System company
• World’s largest Medical Imaging provider
• World’s 2nd largest Patient Monitoring manufacturer
• World’s 2nd largest Air Traffic control system
• World’s largest Broadcast Video Equipment manufacturer
• World’s largest Launch Control System
• World’s largest Telescope (under construction)
• World’s 5th-largest Oil & Gas company
• World’s 6th-largest power plant (largest in US)
• All of world’s top ten defense companies
RTI designed into
over $1 trillion

Introduction to DDS

Data Distribution Service: Key Concepts
• Data Centric Publish-Subscribe
• Real-Time Quality of Service
• Massively scalable
• Secure

Data-Centric Publish-Subscribe

Message-Centric vs Data-Centric
Message-Centric
• A: Can you visit on 1/23?
• J: Yes (updates calendar)
• A: 23rd is booked, how about
2/20?
• J: OK (updates calendar)
• A: March 6th is better…
• J: OK (updates calendar)
• A: Can you stay longer?
• J: No; start ½ hour earlier?
• A: OK, confirmed!
Data-Centric Pub-Sub
• Add: 1/23 @ 11:30A
• Change: 2/20 @ 11:30A
• Change: 3/6 @ 11:30A
• Change: Add dial-in info
• Change: 3/6 @ 11:00A
J:
2/20
A:
3/6
3/6
11:00
A J

What’s the difference? State
• Things have attributes and
characteristics
– Meeting is from 11am - 1pm
on 3/6 in Fairfax
– Car is blue and travelling
north from Sunnyvale at 65
MPH
• … whether they exist in the
real-world, the computer, or
both
• … whether or not we
observe or acknowledge
them
“State” (“data”) is a snapshot
of those attributes &
characteristics
Best practice:
Operate on state directly, not
on dialogs about state

Data-Centric Publish Subscribe
Global Data Space
DDS DataBus
Sensor
Source ** string
Speed float
Altitude float
Actuator
Id ** string
Command float
Status float
Reliable
100 Hz
Altitude <
5000 ft
Reliable
25 Hz
Best effort
2 Hz

Data-Centric Model
“Global Data Space” generalizes Subject-Based Addressing
• Data objects addressed by Domain ID, Topic and Key
• Domains provide a level of isolation
• Topic groups homogeneous subjects (same data-type & meaning)
• Key is a generalization of subject
Data Writer
Data Writer
Data Writer
Data Reader
Data Reader
Data Reader
Sensor Value Units Location
TT201 72 Fahrenheit Bldg. 405
TT305 64 Fahrenheit Bldg., 201
IT105 467 Amps Substation 10
Data Writer
Airline Flight Destination Time
SWA 023 PDX 14:05
UA 119 LAX 14:40
Domain
Instance
Key (subject)
TypeTopic

Migrating to Data-Centric Design
struct MyType {
long sensorID; //@Key
long plantID; // @Key
float sensorVal0;
float sensorVal1;
float sensorVal2;
float sensorVal3;
float sensorVal4;
Version version;
Time currentTime;
}
struct Version {
string firmwareVersion;
string hardwareVersion;
string modelNumber;
string serialNumber;
}
Strongly Typed
struct MyType {
long sensorID; //@Key
long plantID; // @Key
string data;
string version;
}
Where data =
<SENSOR>
<Value0>21.0546</Value0>
</SENSOR>
version =
<VERSION>
<firmware>1.24b</firmware>
<hardware>2.39</hardware>
<model>M56A743</model>
<serial>1429709<serial>
</VERSION>
Mixed Type
struct MyType {
string data;
}
Where data =
<SENSOR>
<SensorID>438</SensorID>
<PlantID>192</PlantID>
<firmware>1.24b</firmware>
<hardware>2.39</hardware>
<model>M56A743</model>
<serial>1429709<serial>
</SENSOR>
Loosely Typed

Data-Centric
• Database for data in flight
• Middleware handles
– Endianess
– Serialization/deserialization
• Content-based filtering for traffic and data
• Architecture based on data model that is:
– Appropriately documented
– Formally defined
– Discoverable at runtime

Real-Time Quality of Service

QoS Policy QoS Policy
DURABILITY USER DATA
HISTORY TOPIC DATA
READER DATA LIFECYCLE GROUP DATA
WRITER DATA LIFECYCLE PARTITION
LIFESPAN PRESENTATION
ENTITY FACTORY DESTINATION ORDER
RESOURCE LIMITS OWNERSHIP
RELIABILITY OWNERSHIP STRENGTH
TIME BASED FILTER LIVELINESS
DEADLINE LATENCY BUDGET
CONTENT FILTERS TRANSPORT PRIORITY
QoS: Quality of Service
20
VolatilityDeliveryInfrastructure
UserQoSPresentationRedundancyTransport

DDS Quality of Service
21
Deadline
Reliability
HistoryLiveliness
Time Based
Filter
Content
Filtering
Durability
Ownership
Partition
Presentation
Lifespan
Destination
Order
Resource
Limits
Latency
Budget
Flow Control
User,
Group,
Topic Data
Batching
Transports
Multi-
Channel
Async
Publisher

Use Case: Streaming Data
22
Deadline
Reliability
(optional)
HistoryLiveliness
Time Based
Filter
Content
Filtering
Durability
Ownership
Partition
Presentation
Lifespan
Destination
Order
Resource
Limits
Latency
Budget
Flow Control
User,
Group,
Topic Data
Batching
(optional)
Transports
Multi-
Channel
Async
Publisher

Use Case: Alarms / Events
23
Deadline
Reliability
HistoryLiveliness
Time Based
Filter
Content
Filtering
Durability
Ownership
Partition
Presentation
Lifespan
Destination
Order
Resource
Limits
Latency
Budget
Flow Control
User,
Group,
Topic Data
Batching
Transports
Multi-
Channel
Async
Publisher

Use Case: Last Value Cache
24
Deadline
Reliability
HistoryLiveliness
Time Based
Filter
Content
Filtering
Durability
Ownership
Partition
Presentation
Lifespan
Destination
Order
Resource
Limits
Latency
Budget
Flow Control
User,
Group,
Topic Data
Batching
Transports
Multi-
Channel
Async
Publisher

Use Case: Large Data
25
Deadline
Reliability
History
Liveliness
Time Based
Filter
Content
Filtering
Durability
Ownership
Partition
Presentation
Lifespan
Destination
Order
Resource
Limits
Latency
Budget
Flow Control
User,
Group,
Topic Data
Batching
Transports
Multi-
Channel
Async
Publisher

Building Scalable Systems

Distributed Application

A Different Approach

Monitoring
RTI Approach
RTI Data Bus
RTI Data Bus

Connext Foundation: RTI DataBus™
• Data centric
– Structured, accessible data
– Like a database for moving data
– Integration Freedom
• Independent modules
– Supports SOA
– Design Freedom
• Plug and play flexibility
– Like a hardware bus
– Deployment Freedom
• Peer-to-peer performance
– Like streaming protocols
– Scalability Freedom
• Standards-based interoperability
– Like TCP/IP
– No Vendor Lock-In
Data-Centric Messaging Bus

OMG Compliant DDS
• OMG defines
– API for portability
– Wire protocol for interoperability
• Multiple language bindings
– C, C++, Java, .NET, Ada
• Multi platform support
– Windows, Linux, Unix, embedded
OS
Real-Time
Publish-Subscribe
Wire Protocol (RTPS)
Middleware
DDS API
Cross-vendor portability
Cross-vendor interoperability

Reduced Application Development
Message Centric Data Centric (RTI)
Message Centric
Middleware
Application
Application Logic
Message Parsing
and Filtering
Message Caching
Send/Receive
Packets
Addressing,
Marshaling
Data Centric
Middleware (RTI)
Send/Receive
Packets
Discovery, Presence
Marshaling, 32/64
Message Caching &
State Management
Message Parsing
and Filtering
Application
Application Logic
Savings

US Army Asset Tracking System
Next-Gen Capability:
• 50K lines of code
• 1 yr to develop
• 1 laptop
• Achieved: 250K+ tracked
updates/sec, no single
point of failure
Legacy Capability:
• 500K lines of code
• 8 yrs to develop
• 21 servers
• Achieved: 20K tracked
updates/sec, reliability
and uptime challenges
“This would not have been possible with any other known technology.”
—Network Ops Center Technical Lead
34

DDS Secure

Threats
Alice: Allowed to publish topic T
Bob: Allowed to subscribe to topic T
Eve: Non-authorized eavesdropper
Trudy: Intruder
Trent: Trusted infrastructure service
Mallory: Malicious insider
1. Unauthorized subscription
2. Unauthorized publication
3. Tampering and replay
4. Unauthorized access to data
by infrastructure services

Practical Security Needs Many Layers
• System edge
• Host
– Machine/OS/Applications/Files
• Network transport
– Media access (layer 2)
– Network (layer 3)
– Session/Endpoint (layer 4/5)
• Dataflow
– Control application interaction
Secure systems need all four

DDS Secure
• OMG Security DDS standard
• Requires trivial or no change to
existing DDS apps and adapters
• Plugin architecture
– Built-in defaults
– Customizable via standard API
• Runs over any transport
– Including low bandwidth, unreliable
– Does not require TCP or IP
– Multicast for scalability, low latency
• Completely decentralized
– High performance and scalability
– No single point of failure
Secure DDS
library
Authentication
Access Control
Encryption
Data Tagging
Logging
Application
Any Transport
(e.g., TCP, UDP, multicast,
shared memory, )

DDS: Data-Centric, Fine-Grained Security
• Per-Data-Topic
Security
– Control r,w access for each
function
– Ensures proper dataflow
• Complete protection
– Discovery authentication
– Data-centric access control
– Cryptography
– Tagging and logging
– Secure multicast
– 100% standards compliant
Operator
SetPoint
Data Topic Security model:
• PMU: State(w)
• CBM: State(r); Alarms(w)
• Control: State(r), SetPoint(w)
• Operator: *(r), Setpoint(w)
Data Topics
Applications
Control
CBM
Analysis
PMU
State Alarms

Transport & Broker Security vs DDS Security
Server
or
Broker
App App
App
App
App App
App
App
DDS Secure Multicast
Server based system

Standard Capabilities
Authentication  X.509 Public Key Infrastructure (PKI – RSA or EC) with a
pre-configured shared Certificate Authority (CA)
 Digital Signature Algorithm (DSA) with Diffie-Hellman for
authentication and key exchange
Access Control  Specified via permissions file signed by shared CA
 Control over ability to join systems, read or write data
topics
Cryptography  Automatic protected key distribution
 AES128/192/256-GCM for encryption
 HMAC-SHA1 and HMAC-SHA256 for
 AES128/192/256-GMAC for MAC
 Transparent secure multicast
Data Tagging  Tags specify security metadata, such as classification level
 Can be used to determine access privileges (via plugin)
Logging  Log security events to a file or distribute securely over
Connext DDS

Configuring and Deploying DDS Secure
Shared By All Participants
Domain
Governance
Document
Identity CA
Certificate
Permissions
CA
Certificate
P2 Identity
Certificate
P2 Private
Key
P2
P2 Permissions
File
P1 Identity
Certificate
P1 Private
Key
P1
P1 Permissions
File

Files needed for DDS Secure
File Description Signing info
Identity CA certificate Common public identity CA
identity cert
Signed by Identity CA.
May be chained.
Private key Must be kept private Could be stored in TPM
Public identity cert Provides valid ID to others Contains public key for this
app. Signed by Identity CA.
Permissions CA certificate Common public permissions
identity CA cert
Signed by Permissions CA
May be chained
Permissions file Topic read/write permissions
for this app
Signed by permissions CA.
Shared during discovery.
Domain governance Common domain-wide access
permissions and protection
rules
Signed by permissions CA.
Certificate Revocations List
(optional)
List of identities whose access
has been revoked
Standard CRL format

Specification Reviewers Include:
• GE
• Intel
• Siemens
• Technicolor
• NSWC
• General Dynamics
• THALES
• SAAB
• Cassidian
• QinetiQ & UK MOD
• Lockheed
• Raytheon
• None found any show stoppers
• Several contacted OMG to urge adoption

RTI Connext DDS Professional

Connext DDS Professional
Connext DDS Professional
Connext DDS Core
Messaging/RPC
DDS Pub/Sub
Pluggable
Transports
APIs: C C++ C#
Java Ada
Security**
DDS XTYPES
RTPS
Windows, Linux,
Unix, OS X, RTOS
Connext Tools
Admin Console
Monitoring
LabVIEW
Excel plug-in
Wireshark
Lua prototyper
DDS Ping
DDS Spy
Connext Services
Routing
Recording &
replay
Database
integration**
Persistence
Logging
Queuing**
REST/http

DDS Micro & DDS Cert

RTI Connext Micro
• Scalable subset of standard DDS API
• For resource-constrained systems
– Stringent SWaP requirements
– Limited memory (32 MB flash & 8 MB RAM)
– Embedded low-power single-core CPU
– Lack of operating system
• Wire protocol RTPS compatible
• C/C++ API
• Sensor to cloud connectivity
49

RTI Connext Cert
• Scalable subset of standard DDS API
• Wire protocol RTPS compatible
• C/C++ API
• Static discovery
• Library + certification evidence
• Targeting DO-178 Level A
50

RTI Connext DDS Infrastructure
Professional Micro
DDS
Subset
Small Footprint
Apps
Cert
DDS Subset
DO-178C Certifiable
High Assurance
Apps
Database
Integration
Existing Apps and Devices
Routing
Service
Adapter
Remote
Apps
Full DDS
Libraries
Real-Time C++
linux apps
Full DDS
Libraries
Real-Time C#
Windows apps
Full DDS
Libraries
General Purpose
Java App
JMS API
Admin Console
Monitoring
Microsoft Excel
Recording
Replay
Wireshark
Persistence
Logging
Prototyper
Secure
Security
Plugins
DDS-RTPS Wire Interoperability Protocol

When Should I Use DDS? 3 Questions
• Is reliability critical?
– Downtime > 5 minutes = loss of life or property
• Is your system high performance?
– Response time measured in ms or us?
– Hundreds to thousands of apps
– Thousands to tens of thousands of data points
• Is your system lifespan > 3-5 years?

Use Cases
Reliability, Performance, Lifespan

Reliable Operation
• Raytheon’s LPD-17 Ship-
Wide Area Network
(SWAN) runs machinery,
damage control, steering,
magnetic signature,
mission control,
navigation,
communication
• DDS middleware supports
redundant networks, data
& sensors without servers
for non-stop reliability

Real-Time Performance
• The Ship Self Defense
System is the “last line
of defense”
• SSDS coordinates high-
speed radars, targets
defensive missiles, and
directs 1000+
rounds/sec at incoming
cruise missiles
• SSDS is at sea now
• DDS delivers messages
in real time

Massive Application Scalability
• Raytheon uses RTI middleware to control the
new Zumwalt DDG 1000 destroyer
• RTI DDS coordinates and manages complex,
diverse onboard hardware and software
systems
• RTI connects hundreds of computers,
thousands of applications, and more than
10 million publish-subscribe pairs
• RTI middleware extends real-time scalability

Interoperable Open Architecture
• Next-generation of
– Lockheed Aegis
– Raytheon DDG 1000
– Raytheon SSDS
– LCS (Lockheed and GD-AIS)
– Raytheon LPD-17
– Many more, US and allies
• Highly distributed systems
include radar, weapons,
displays, controls
• Standards-based, high-
performance middleware
breaks vendor lock-in, drives
interoperability ,and future-
proofs the architectural
design

RTI Professional Services

RTI Professional Services
Usage Guidance
Advanced Training
Architecture
Study
Investigation
Requirements
Feasibility
Safety or Security
Assessment
Consulting
Services
Consulting
Solution
Architect
Design / Integration
Support
Implementation
Platform & Transport
Support
Feature Acceleration
Adapter /Component
Development
Industry Leaders
Domain Experts
Project Partners
Proven Success
Global Reach
RTI
Professional
Services

RTI Connext DDS Services

Services
• Routing
• Recording & Replay
• Database Interface
• Persistence
• Logging
• Queueing
• REST/http (Web DDS)

RTI Routing Service
• Bridge data across multiple domains
• Selective, real-time data forwarding and
transformation
• Change topic names and topic schema & QoS
DDS
Domain 1
DDS
Domain 2
Routing Service
Topic 1 Topic 2

Routing Service Adapter SDK
• Saves time and cost developing custom
integration between The RTI Data Bus and
other technologies and standards
• Uses Routing Service to quickly build and
deploy bridges
• Transformation between data types
• Pluggable Adapters, such as
– Socket
– File
– JMS
– OPC
– Stanag 4586
RTI Data Bus
Socket
Plug-in
Adapters

Routing Service in Wide Area Networks
• Bridge data across multiple sites
• Use TCP with TLS (SSL) encryption
• Selective, real-time data forwarding and transformation
• Can change topic name and topic schema
Databus
Databus
WAN
(RTPS over TCP)

Persistence Service
• RTI Persistence Service
– Stores publications and provides them to the network when needed
– Configured to store in-memory or using a database
• Fault Tolerance Benefits
– Ensure reliable data availability, even if publisher fails
– Reduce load on, and memory required by, data writers
– Update new subscribers efficiently without loading data writers
Publisher
Subscriber
Subscriber
Persistence
Service
Domain

Database Integration
SQL
Database
Table.Passengers
Flt Name Addrs
----------------------
C129 A. Johnson …
C054 J. Smith ….
…
…
Table.Tracks
Flt Lat. Long.
----------------------
C129 34.5 102.3
C054 27.7 46.8
…
…
RTI Real-Time Connect
Real-time
application
Real-time
application
Real-time
application
Communications Storage
Real-time
messages
Enterprise
infrastructure
Database
changes

Recording
• Applications:
– Future analysis and debugging
– Regulatory compliance
– Replay for testing and simulation
purposes
• Record high-rate data arriving in
real-time
• >15,000 messages/updates per
second per disk
• Non-intrusive
Recorder
Status
Topic
Control
Topic
File DB
Domain
Publisher
Publisher
Subscriber
Subscriber

Playback
• Real-time playback of data
– Captured by RTI Recorder
– From any number of topics
• Applications:
– Debugging – replay what happened
– Live post-mission analysis, e.g., UAV
– Replay for simulation and training
• Non-intrusive
– Just another publisher
– Transparent to subscribers
Data
Log
Playback
RTI Data Bus

Web Integration
HTTP
• Web-enabled interface to RTI Data Bus
– Web Services (WSDL) / SOAP
– REST
• Access DDS from any application, platform or
language that can invoke a Web Service
– Web applications, e.g., Google Maps
– JavaScript, Flash, Perl, PHP, Python, CGI
scripts
– ESBs
• Lightweight interface to RTI Data Bus
– Clients do not need to link or load special
libraries
RTI Data Bus

RTI Connext DDS Tools

Tools
• Admin console
• Monitoring
• LabVIEW
• Excel plug-in
• Lua prototyper
• Wireshark
• Ping/Spy

Admin Console
• Centralized console for infrastructure
• Dashboard summary of all running services
• Live status updates
• Live distributed logging
• Real-time statistics
• System Performance statistics (CPU and memory)
• Remote administration of Routing Service:
• GUI for sending remote commands
• Retrieving and updating current configurations
• Built-in XML editor for modifying configuration files
• Built on top of Eclipse

Application Monitoring Features
• Detailed statistics on traffic, errors, and resource usage
• Detailed system topology display
• Configurable alerts and thresholds
• Track and tune performance
• Diagnose unusual behavior
• Discover full QoS

NI LabVIEW Integration
• Build LabView Application using DDS
building blocks
• Attach LabView logic block to live
data
• Connect Distributed LabView
applications

Spreadsheet Add-in for Microsoft Excel
• Easy integration
• Real-time updates
– Spreadsheets
– Charts
– Formulas
• Content aware
– Learn data types
dynamically

RTI Wireshark Protocol Analyzer
Network packet & traffic analyzer
• Traps RTPS packets
• Shows packet contents
• Counts packet types, produces graphs and
charts
• Also filters other popular protocols
Used to analyze wire traffic and adjust parameters for optimal
performance

RTI: Driving the DDS Standard

DDS Specification History
RPC
over DDS
2014
DDS
Security
2014
Web-Enabled
DDS
2013
DDS
Implementation
App
DDS
Implementation
App
DDS
Implementation
DDS Spec
2004
DDS
Interoperablity
2006
UML Profile
for DDS
2008
DDS for
Lw CCM
2009
DDS-STD-C++
DDS-JAVA5
2012
DDS
X-Types
2010
App

RTI: Defining DDS Standards
DDS Standard RTI Role Product Status
Core DDS API DCPS author 1st implementation
DDS-RTPS Protocol Sole author 1st implementation
DDS-XTypes Primary author 1st implementation
DDS C++ PSM RFP author; spec. co-author EAR available now
DDS Java PSM Sole author Under development
DDS Security Primary author EAR available now
Web-enabled DDS Primary author EAR available now
UML Profile for DDS Co-submitter
1st implementation
(3rd parties)
DDS for lwCCM Co-submitter
1st implementation
(3rd parties)
RPC over DDS Primary author 1st implementation
Instrumentation RFP author Prototype now

RTI DDS Intro with DDS Secure

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to RTI DDS Intro with DDS Secure

Similar to RTI DDS Intro with DDS Secure (20)

More from John Breitenbach

More from John Breitenbach (6)

Recently uploaded

Recently uploaded (20)

RTI DDS Intro with DDS Secure