Demetronics
I. Charge
IoT device fleets controlled via decentralized client-writes face security vulnerabilities, lack global audit trails, and are difficult to manage centrally.
II. Investigation
A smart water management IoT system connecting mobile controls, a web portal, and backend services. The mandate was to move device control from decentralized mobile apps to a centralized backend architecture, enforcing strict authorization and complete auditing.
III. Exhibits - Architecture
- Replaced direct device writes with a centralized API that requires all device control and scheduling to pass through it.
- Every action that changes the state of a device is captured to a central database for global audit logging.
- When the cloud is unreachable, the mobile app communicates directly with the local hardware and queues audit events to sync later.
- Node.js and Express power the centralized backend, standing between the clients and the database.
IV. Cross-Examination
Q: Why enforce a centralized API instead of direct client-to-device communication?
A: Direct client writes bypass central authorization and auditing. A centralized API ensures business rules are enforced before any device state changes and maintains a complete audit trail of all operations.
Verdict
ALLOW - Architecture shift successfully routed device control through a centralized, auditable backend.