> For the complete documentation index, see [llms.txt](https://docs.net2grid.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.net2grid.com/integration-guide/security.md). # Security During the design and implementation of NET2GRID EnergyAI® Edge on HAN port, many security factors were considered to ensure that NET2GRID’s product would be secure. This section lists all these considerations. ## Network Isolation The services running in the AWS account are deployed in a Virtual Private Network ([VPC](https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html)). Thus, these resources are running in their network and protected from other instances outside it. In addition, [security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) limit access to the services and infrastructure components. This measure ensures that only safe-listed components can connect with the network's core components. ## Identity and Access Management Access to the Kinesis Data stream and SQS queues is provided only by verifying the identity of the user who wants to fetch the messages through the AWS [IAM](https://aws.amazon.com/iam/) service. Using the IAM service, AWS is responsible for verifying the user's identity using the IAM service, which is a best practice when working with AWS services. The level in which access is provided is the AWS account level and can be restricted further after a customer request, e.g., user level. This action is achieved using the API Gateway service and the API Key functionality it supports regarding accessing the Device Management API. Again, AWS is responsible for verifying the API Key and providing access to the API. ## Avoid Malicious Requests External-facing APIs, such as the Device Management API, validate customer input and verify that it matches the expected input, such as the EUI format. This action is used to avoid information injections in the codebase by externals, even if they have been authorized. Thus, it is ensured that the service will deny any request that may be used to perform unauthorized actions as soon as possible. ## IoT Core AWS IoT Core is a managed cloud service that allows connected devices to interact with cloud applications and other devices easily and securely. It supports HTTP, WebSocket, and MQTT, a lightweight communication protocol that tolerates intermittent connections. Each connection must be associated with an identifier known as a client ID. All communication from the IoT Core to the VPC is protected with Bearer Token Authorization on the service level and request header authentication based on encrypted tokens. These Tokens are frequently rotated internally to ensure maximum security. Finally, the HTTP requests coming from the AWS IoT Rules Engine will be signed using AWS Signature Version 4 to contain the x-amz-signature header. ## Communication Encrypted channels provide access to secrets like the API Keys mentioned above during any communication between NET2GRID employees and externals; the API Key is always exchanged through Keybase.io, which is considered secure enough. ## SSL Certificate SSL certificates are used for the endpoints containing the product's domain name. Websites need SSL certificates to secure user data, verify website ownership, prevent attackers from creating a fake site version, and convey trust to users. ## Monitoring The requests received in the endpoints are monitored to identify possible attacks and protect the endpoints using AWS services like AWS WAF. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.net2grid.com/integration-guide/security.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.