Secure and scalable data ingestion pipeline
A system and method for a secure and scalable data collection and ingestion data pipeline is discussed. The data pipeline provides secure ingestion of data into internet-of-things (IoT) platform, while providing high throughput, replication, and fault-tolerance, which makes it suitable for large scale systems where data can be received from millions or billions of devices, sensors, or clients. In addition, the data pipeline provides a platform for real time event generation and data analysis. Further the data pipeline reduces operational costs and platform-as-a-service (PAAS) vendor dependencies.
1. A method for securely ingesting data from a plurality of devices over one or more networks, the method comprising:
(a) establishing, by a data pipeline platform executing on one or more servers, a secure tunnel connection with a plurality of devices, each of the of the plurality of devices assigned by the data pipeline platform a unique application programming interface (API) key;
(b) receiving, by the data pipeline platform, an application layer request over the secure tunnel connection via one or more networks from a device of the plurality of devices, the application layer request comprising an encrypted message from the device;
(c) determining, by the data pipeline platform, that the application layer request comprises the unique API key assigned to the device in a predetermined authentication header of the application layer request;
(d) accepting, by the data pipeline platform, responsive to the determination, the application layer request;
(e) using, by the data pipeline platform responsive to accepting the request, the unique API key of the device to determine an encryption key to decrypt the encrypted message to a message; and
(f) storing, by the data pipeline platform responsive to accepting the application layer request, the message to a first partition of a plurality of partitions corresponding to an input data topic.
2. The method of claim 1 , further comprising processing, by a data stream processor, the message as input from the first partition and storing an output from processing to a second partition of the plurality of partitions corresponding to an output data topic.
3. The method of claim 2 , further comprising subscribing, by a plurality of consumer applications, to the output data topic of the second partition receive output data published to the second partition.
4. The method of claim 2 , further comprising obtaining, by a consumer application, a batch of records at a time from the output data topic of the second partition.
5. The method of claim 1 , wherein the plurality of devices comprises one or more of the following: a hub device, an Internet of Things (IoT) device, a sensor, a vehicle and a computing device.
6. The method of claim 1 , wherein the data pipeline platform executes on one or more servers in one of a cloud or Software-As-A-Service computing environment and provides an API for the plurality of devices to communicate with the data pipeline platform.
7. The method of claim 1 , wherein (c) further comprises authenticating, by the data pipeline platform, the plurality of devices based at least on the unique API key.
8. The method of claim 1 , wherein (e) further comprises determining the encryption key as a symmetric key comprising the unique API key combined with a hash of a unique identifier of the device.
9. The method of claim 1 , wherein each of the plurality of partitions comprises an ordered immutable sequence of records.
10. The method of claim 1 , further comprising maintaining, by the data pipeline platform, records in each of the plurality of partitions for a configured lifetime to enable re-consumption by one or more consumer applications.
11. A system for securely ingesting data from a plurality of devices over one or more networks, the system comprising:
a data pipeline platform executing on one or more servers, wherein the data pipeline platform is configured to:
establish a secure tunnel connection with a plurality of devices, each of the of the plurality of devices assigned by the data pipeline platform a unique application programming interface (API) key;
receive an application layer request over the secure tunnel connection via one or more networks from a device of the plurality of devices, the application layer request comprising an encrypted message from the device;
determine that the application layer request comprises the unique API key assigned to the device in a predetermined authentication header of the application layer request;
accept the application layer request responsive to the determination;
use the unique API key of the device to determine, responsive to accepting the application layer request, an encryption key to decrypt the encrypted message to a message; and
store, responsive to accepting the application layer request, the message to a first partition of a plurality of partitions corresponding to an input data topic.
12. The system of claim 11 , further comprising a data stream processor configured to process the message as input from the first partition and storing an output from processing to a second partition of the plurality of partitions corresponding to an output data topic.
13. The system of claim 12 , wherein a plurality of consumer applications are subscribed to the output data topic of the second partition to receive output data published to the second partition.
14. The system of claim 12 , the data pipeline platform is further configured to obtain, by a consumer application, a batch of records at a time from the output data topic of the second partition.
15. The system of claim 11 , wherein the plurality of devices comprises one or more of the following: a hub device, an Internet of Things (IoT) device, a sensor, a vehicle and a computing device.
16. The system of claim 11 , wherein the data pipeline platform is configured to execute on the one or more servers in one of a cloud or Software-As-A-Service computing environment and provide an API for the plurality of devices to communicate with the data pipeline platform.
17. The system of claim 11 , wherein the data pipeline platform is further configured to authenticate the device based at least on the unique API key.
18. The system of claim 11 , wherein the data pipeline platform is further configured to determine the encryption key as a symmetric key comprising the unique API key combined with a hash of a unique identifier of the device.
19. The system of claim 11 , wherein each of the plurality of partitions comprises an ordered immutable sequence of records.
20. The system of claim 11 , wherein the data pipeline platform is further configured to maintain records in each of the plurality of partitions for a configured lifetime to enable re-consumption by one or more consumer applications.