How does Layer 7 help me manage a range of devices across IoT?
IoT is an opportunity for CA and Layer 7 to bring together identity, access and API Management.  To paraphrase a comment on a recent Gigaom article: Everything with an identity will have an API and everything with an API will have an identity.

With so many “things” potentially accessing APIs, what are some strategies for securing these APIs across such a breadth of consumers?
Identify, authenticate and authorize using standards. API for IoT means managing identity for many devices at Internet scale.

How will API discoverability work with the vast number of things, especially if we see REST as the primary communication style?
I reached out to my colleague Ronnie Mitra for this answer. Ronnie pointed out that, in the past, standards like UDDI and WSRR promised to provide service registries but that didn’t really work out. Nowadays, we see lots of independent human-oriented API registries and marketplaces that might have more chance of surviving. There are even some runtime discovery solutions like Google’s discovery interface for APIs and the use of HTTP OPTION to learn about APIs. At the moment, lots of people are trying lots of things, unsure of where it will all end up. It would be interesting to dive deeper into why we need discoverability to power IoT and when that discoverability has to take place.

How can API security get easier when API demand grows exponentially? There’s a big disconnect.
It doesn’t get easier. Transport-level security is reasonably well understood but endpoint identity and trust will be challenging.

Where will the intelligence be in IoT? Will there be some form of on-site intelligence, so that core functionality continues even if the connection is lost? Or will all intelligence be cloud-based?
It depends on whether you design for centralized “hub and spoke” or decentralized “domains of concern”. The former is responsible for correlating data and events within the domain whereas the latter is responsible for communicating with other domains (I owe this concept to Michael Holdmann’s blog). “Domains of concern” design communicates with different domains for different purposes –  in an apartment for home automation, in an apartment building for HVAC, in a city block for energy generation/consumption, in a city for utility grid etc. Emergencies or out-of-bound signals are handled like exceptions and are bubbling up through the domains until intercepted. But most things will serve an inherent purpose and that purpose will not be affected by the absence of any connectivity. There will be intelligence within the core of each domain as well as at the edges/intersections with other domains.

What is the best way to overcome fear of exposing data via APIs in an enterprise?
You need to identify a business opportunity. Unless you know what business impact you are trying to archive and how you will measure it, you should not do it.

Does IoT require a strong network or big data or both?
Not a strong network but ubiquitous connectivity. Not big data but sharing/correlating data horizontally between distinct vertical silos.

What significance (benefits/drawbacks) do the various REST levels have with respect to the Internet of Things (connecting, monetizing etc.)?
I had never heard of levels of REST and had to look it up. Turns out the levels are: resources, verbs and hypermedia. Hypermedia would allow you to embed long-lived clients, which could adapt to changes in API design. But it is actually the data or service behind the API which is monetizable, not the API itself. The API is just the means to an end.

How will IoT evolve? And more importantly how can enterprises solve the security and privacy issues that will arise as IoT evolves?
Culturally, the European regulators will try to put privacy regulations in place sooner rather than later whereas the North Amercian market will initially remain largely unregulated until some abuse prompts the regulator to step in. In Germany, the federal regulator tries to stay ahead of the market and recently published a security profile for smart meters. Personally I would look at designing M2M and IoT applications assuming that endpoint data is inherently unreliable and that I can not necessarily trust the source. But that is very broad guidance and may or may not be applicable to a specific use case.

As we create API frameworks that interact with sensors and control objects in the IoT what/who are the best organizations to follow to learn about new protocols that we should be preparing to handle, such as CoAP etc?
Here are some suggestions:

• IPSO Alliance
• ETSI M2M
• ITU M2M
• oneM2M
• Eclipse M2M

How close are we to having a unified platform for IoT application developers and who is likely to be the winner among the competing platforms?
Chances are there won’t be a winner at all. You have companies like Axeda, Exosite, Gemalto, Digi, Paraimpu, BugLabs, ThingWorx, SensiNode, deviceWISE and more. You have industry working groups like Eclipse M2M and various research efforts like SPITFIRE project, Fraunhofer FOKUS, DFuse and many others. The Eclipse M2M framework is probably a good choice to start with.

Even assuming ubiquitous and common networking (e.g. IPv6 on the public Internet) – how will the IoT identify peers, hierarchy and relationships?  
I think there is a huge opportunity for identity companies like CA to figure this out. Take a look at EVRYTHNG as one of the few startups in that space. Meanwhile, the folks over at Paraimpu are trying to tackle this challenge by combining aspects of a social network with IoT.

One of Brian’s first questions was about the difference between M2M and IoT. The best answer I could give him was actually one I had found through an M2M group on LinkedIn: “I see M2M platforms as mainly enabling vertical integration, as they have historically, of a single capability; where I see IoT as more about horizontal integration of multiple capabilities and resources into a larger system. M2M is about communication, IoT is about integration and interoperability.”

So, whereas M2M feeds data into existing vertical silos, IoT is layered on top horizontally, correlating and integrating data from different silos. A good illustration of this vertical–versus-horizontal distinction was provided in a recent More with Mobile article. The realization that the commercial potential of IoT first and foremost requires a new model of data sharing inspired us to create the Layer 7 Data Lens Solution.

Another question that Brian posed was about the protocols and standards underpinning the M2M/IoT ecosystem. Here is my short list of key protocols (in no particular order):

• IBM MQTT
• OMG’s DDS based on AMQP
• RESTful HTTP
• XMPP
• CoAP
• NanoIP
• SSI

I’d certainly be interested to hear if you had any additions to the list. You’ll find background information about IoT protocols on Telit’s M2M blog and Michael Holdman’s blog. Also, Michael Koster published a very interesting blog post about adding event-driven processing to REST APIs, trying to bridge the necessity of supporting event-driven patterns in IoT within a RESTful API approach.

I’ll be discussing IoT in more detail myself when I take part in Layer 7’s latest API Tech Talk, on Wednesday May 29 at 12pm EDT/9am PDT. If I answer your IoT-related question live during the Tech Talk, Layer 7 will send you a free T-shirt. See you on Wednesday!

The Internet of Things is a simple concept: objects being connected to the Internet. What’s not so simple is managing the enormous, almost sublime amount of data these connected “things” (vehicles, appliances…) generate. There’s also the question of how you give people within your organization secure-but-seamless access to specific subsets of data they can actually make use of.  Well, our man Holger knows how it’s done, so start getting your questions together and join our live Q&A on May 29.

Click here to get the full event details and a reminder in your calendar. On the day of the event, join us at:

•   layer7.com/live

And don’t forget, you can ask questions throughout the stream by chatting or tweeting. Alternatively, you can email your questions in advance and Holger will give you an in-depth answer on the day. IoT is a pretty hot topic right now, so this is bound to be a lively discussion. See you next Wednesday!

Simply put: “things” generate petabytes of data. Putting sensors on everything, as both Cisco and GE propose, creates a data nightmare. Hadoop has made analyzing big volumes of data much easier but what happens when you want to share a small sliver of that information with a customer or partner? After all, the purpose of “Big Data” collection is not altruism – it’s about monetization. In many situations, this will only be possible if data can be shared easily.

A Data Lens gives IoT data owners – such as manufactures or telco carriers – an easy and secure way to share a focused and billable data set with their customers and partners. Anything outside of the scope of a Data Lens cannot be accessed, whereas anything inside the lens is  “in focus”. The data in focus can be raw or aggregated. There can be any number of Data Lenses on a data set. They can be used internally or shared securely with external partners and customers. Data access through individual Data Lenses can be governed by service level agreements and – through metering – monetized.

For manufacturers and network operators looking at ways to share focused data slices from their Big Data, a Data Lens solves a big problem. By leveraging the Layer 7 API Gateway’s unique ability to focus on small data sets inside larger ones and to present these data sets as secure APIs, customized to specific customers or partners, it’s possible for IoT operators to drive new revenue from their Big Data.

1. There’s just so much of it that it’s easy to lose sight of the byte-sized trees in the petabyte-sized forest

2. It’s locked away in every recess of the enterprise – from applications to relational databases, to non-relational databases, to in-memory caches, public clouds, Hadoop clusters etc.

Data growth and diversity have made data access harder. But data access is the foundation of mobile app development, anything to do with the Internet of Things (IoT) and all kinds of Big Data analytics. Given this need for data in the face of access complexity, it didn’t come as a total surprise to see some of the most innovative Layer 7 customers start using our API Gateway technology as a novel data access, aggregation and presentation solution. As our resident IoT expert Holger Reinhardt pointed out to me: they are using our products to build highly-customized “lenses” across their distributed data backends. To me, this characterization is perfect because what these customers are looking for is perspective on their data. A lens gives perspective with focus.

Now, a Layer 7 API Gateway is more than just a data integration solution. Our technology has several unique features that make it ideal for collecting, composing and presenting data. First, we can talk to all kinds of data sources natively. That wasn’t easy to achieve and it’s something we developed over many years. Second, we can represent the source data as a RESTful API. Even better, we can dynamically generate a virtual API view for a specific user, app, partner etc. The API then becomes the entry point for accessing the aggregated data. Third, we can add fine-grained access and protection policies that ensure only authorized consumers get visibility to specific slices of data, while also protecting the data sources from attack and misuse. When combined, these capabilities give organizations a way to focus on just the information that is relevant to a particular mobile, IoT or Big Data analytics project and then share selectively with an app, cloud service, developer or partner.

A data lens is born!

If you want to learn more about our Data Lens solution, have a read of this new solution brief. Also, feel free to reach out to us with any questions.

So, are all these news stories about trillion-dollar business opportunities in IoT just stories? Most likely the truth is that no one has yet figured out how to make money with IoT but everyone wants to make sure that they are at least seen to have a plan – just in case it does take off. As if to prove this point, ZDnet made a very different assessment of M2M at MWC. I went into more detail on these issues during my recent interview with DeviceLine Radio.

Personally, I firmly believe in the disruptive potential for IoT. It will be disruptive because it will break down the separation between manufacturing industry on one side and IT industry on the other. Manufacturing companies like GE, Bosch and Siemens will increasingly see IT – and Big Data in particular – as a core competency they will need to master in order to sustain a competitive advantage. Simply outsourcing to IT companies will no longer suffice.

We can clearly see this developing as, for example, Bosch is readying its Internet Application Platform and GE is aggressively building out its Silicon Valley presence. At the same time IT companies are trying to position themselves as natural partners for manufactures or as integrators of smart things. Credit has to go to IBM, which has been pushing this trend as part of its Smarter Planet campaign, way ahead of other players.

Meanwhile, telecom carriers are also struggling to decide what IoT will mean for them. It’s easy to see how telecom’s core business can be seen as just a set of “dumb” data pipes. The challenge for this sector will be figuring out how to leverage its considerable assets, like cellular networks, global roaming and integrated billing, to create M2M business platforms. I think that Big Data analytics on the data piped through their network will have to be part of it.

It strikes me that there might be more to Cisco’s “Internet of Everything” (IoE) neologism than just a vendor’s attempt to brand what still may be a technology maverick. Internet of Everything sounds so much better than the common alternative when you append “Economy” to the end – and this is how it first appears in Chambers’ post. And that’s actually important because adding economy in the same breath is an acknowledgement that this isn’t just marketing opportunism as much as a recognition that, like mobility, the IoE could potentially be a great catalyst for independent innovation. In fact, Cisco’s white paper really isn’t about technology at all but is instead an analysis of the market potential represented in each emerging sector, from smart factories to college education.

It is exactly this potential for innovation – a new economy – that is exciting. The combination of Mobile Access and APIs was so explosive precisely because it combined a technology with enormous creative potential (APIs) with a irresistible business impetus (access to information outside the enterprise network). The geeks love enabling tools and APIs are nothing if not enabling; mobile just gives them something to build.

I0E, of course, is the ultimate business driver and –  with APIs as the enabler – it equals opportunity of staggering proportions. Like mobile before it – and indeed, social Web integration before that – IoE will come about precisely because the foundation of APIs already exists.

It is here where I disagree with some IoT pundits who advocate specialized protocols for optimizing performance. No thank you; it isn’t 1990 and opaque binary protocols no longer work for us, except when streaming large data sets (I’m looking at you, video).

Security in the IoE will be a huge issue and Cisco has this to say on the topic :

“IoE security will be addressed through network-powered technology: devices connecting to the network will take advantage of the inherent security that the network provides (rather than trying to ensure security at the device level).”

I agree with this because security coding is still just too hard and too easy to implement wrongly. One of the key lessons of mobile development is that we need to make it easy for developers to automatically enable secure communications. Take security out of the hands of developers, put it in the hands of dedicated security professionals and trust me, the developers will thank you.

As IoE extends to increasingly resource-constrained devices, the simpler we can make secure development, the better. Let application developers focus on creating great apps and a new economy will follow.

I’m particularly excited about a very ambitious EU-funded project to map an IoT reference architecture. Whether it will really become the reference architecture or simply a collection of best practices is subject to debate but I think the simple fact of trying to pull together all the different knowledge domains into one set of documents is bound to be interesting.

Forbes recently published an article by Alex Brisbourne called The Internet of Things Isn’t as New as It Seems. The article offers some really fascinating insights into the renewal rates for built-in 3G services in iPads and OnStar. Reflecting upon my own positive experiences with a 3G Kindle, I have to agree with Alex that, for connected devices to really reach their potential, connectivity must be simply built-in without requiring a separate subscription.

Another indication of this trend is the fact that car manufacturers are apparently switching from built-in mobile connectivity (requiring the owner to carry a subscription) to tethering off the driver’s existing smart phone. This highlights the challenges telco providers are facing – as summarized in a recent blog post on telco2.net.

Alex Bassi has provided another look at the way IoT is affecting business models, making the point that technology is enabling us to use things without having to own them. In my humble opinion, we’ll see this service-based model, which we normally associate with SaaS and the cloud, extending more and more into the domain of physical “smart” things. We can already see this usage pattern emerging in the automotive sector: car sharing a la Zipcar; limo service from Uber; electric car solutions from Better Place. FastCompany calls this the new “self-service” economy in an article that explores these issues in depth.

To get a good overview of the Internet of Things, I suggest heading over to ZDnet, which regularly posts articles on IoT and M2M. Postscapes, meanwhile, is completely dedicated to tracking IoT – I particularly like this site’s (currently incomplete) directory of companies in the space. There’s also a good collection of relevant essays gathered together on Bundlr.

Finally, here are a couple of links for the technically inclined. First here’s a presentation on the impressive set of open source building blocks developed as part of the m2m.eclipse.org project. Second is a piece that touches upon some technical aspects of the semantic Web that have a good deal of relevance to IoT. This is an area I’m personally very interested in and it might be a good topic to explore in a future post.

In any case, I expect to have plenty of interesting things to report on after Mobile World Congress. If you’re attending the show, be sure to stop by the Layer 7 booth for a chat. We’ll be at booth  #8.1A47 in the App Planet zone.

As usual, we’re likely to see a very broad sweep across various areas of telco innovation and mobile strategy but there are some fundamental questions facing the community and these will dominate many conference sessions, seminars and exhibits:

1. Connected Living
   As the Internet of Things gains momentum, how can the service provider community deliver the kind of enriched connectivity the broader ecosystem increasingly demands?
   —
2. Mobile Commerce
   For years, mobile has been a key banking and commerce tool for certain markets. With the rise of NFC (near field communication) and success stories like the Starbucks mobile payment app, will mobile become the preferred payment instrument for us all?
   —
3. Next-Generation Communications
   The world of communications moves quickly – too quickly even for service providers at times, with the runaway success of technologies of iMessage, WhatsApp and – next – WebRTC. In this ever-innovating world of mobile communications, can service providers regain some ground and demonstrate their value?

Layer 7 has answers to these questions and will be at MWC, demonstrating a variety of solutions that can help service providers address the challenges ahead. For example:

1. We have been collaborating with AT&T and have planned an M2M solution that will capture anonymous information about visitors as they move around the exhibition halls. This information will be presented as intelligent APIs via the Layer 7 platform.
   —
2. Security and authentication are very familiar terms to Layer 7 and we’ll be showing how mobile payments can be easily and securely integrated with a mobile app without compromising the user experience.
   —
3. “Communications as a Service” opens many opportunities for service providers and the new partnership between Layer 7 and Voxeo Labs will show how easy it can be to capitalize on these opportunities.

Come and meet the team at booth 8.1A47 in the App Planet zone or email info@layer7.com to schedule a meeting. See you there!

The good old measure of progress, mobile subscriber penetration, doesn’t cut it anymore. Now, the real measure is how many other connected devices a subscriber uses – iPads, Smart TVs and even fridges (who wouldn’t want a Galaxy Kitchen or an iPad Mini?) This is just the start of a revolution in connectivity, which will make it easier than ever to consume information and equally easy to emit a lot of information, often through social networks.

But there is another aspect to this – not only will you be able to post your own information but there will be all kinds of devices that can “sense” information about you. I expect to see a lot of this at MWC – sensors and cameras scattered around the floor, mapping passers-by to Facebook profiles and other personal information. Obviously, the capturing and cross pollination of this information raises all sorts of privacy issues.

It will also have a number of significant ramifications for mobile developers. First, there will be a new wealth of information available in the form of Web service APIs, as most of the data will be stored in cloud. The sheer scale of this new information-rich world will require apps to leverage cloud processing capabilities in order to be truly effective. This will create opportunities for enterprises to rethink their mobile architectures.

Second, mobile developers will need to use standard protocols for authentication and authorization. OAuth and OpenID Connect are key standards for protecting resources and allowing app users to authorize apps to leverage their information. Will these standards address all the privacy issues mentioned above? Probably not but they will make it a good deal easier for app developers to comply with privacy laws and regulations.

Third, the most successful app developers will be those that are able to provide a seamless user experience (UX) across multiple devices. This is because the end user of the near future will naturally expect all apps to know about other sessions that user had with an app across all of his or her many smart devices. Devs will therefore want to migrate sessions across devices, to bolster the UX.

If you’re going to MWC, come and say hello to the Layer 7 team. We will be located in the App Planet area Hall: 8.1 Booth: A47. I hope to see you there!