https://github.com/ockam-network/ockam/ Skip to content Sign up Sign up * Why GitHub? Features - + Mobile - + Actions - + Codespaces - + Packages - + Security - + Code review - + Project management - + Integrations - + GitHub Sponsors - + Customer stories- * Team * Enterprise * Explore + Explore GitHub - Learn and contribute + Topics - + Collections - + Trending - + Learning Lab - + Open source guides - Connect with others + The ReadME Project - + Events - + Community forum - + GitHub Education - + GitHub Stars program - * Marketplace * Pricing Plans - + Compare plans - + Contact Sales - + Education - [ ] [search-key] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this organization All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up Sign up {{ message }} ockam-network / ockam * Notifications * Star 505 * Fork 66 Trust Architecture tools for end-to-end encrypted messaging and mutual authentication between distributed applications in the cloud and devices at the edge ockam.io Apache-2.0 License 505 stars 66 forks Star Notifications * Code * Issues 241 * Pull requests 17 * Discussions * Actions * Security * Insights More * Code * Issues * Pull requests * Discussions * Actions * Security * Insights develop Switch branches/tags [ ] Branches Tags Nothing to show {{ refName }} default View all branches Nothing to show {{ refName }} default View all tags 138 branches 52 tags Go to file Code Clone HTTPS GitHub CLI [https://github.com/o] Use Git or checkout with SVN using the web URL. [gh repo clone ockam-] Work fast with our official CLI. Learn more. * Open with GitHub Desktop * Download ZIP Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching GitHub Desktop If nothing happens, download GitHub Desktop and try again. Go back Launching Xcode If nothing happens, download Xcode and try again. Go back Launching Visual Studio If nothing happens, download the GitHub extension for Visual Studio and try again. Go back Latest commit @spacekookie @jared-s spacekookie and jared-s chore(rust): rename route fields in transport message ... 6c7688a Apr 2, 2021 chore(rust): rename route fields in transport message 6c7688a Git stats * 1,253 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .github ci: fix dependabot paths for cargo crates Feb 21, 2021 documentation docs: guide updates Mar 31, 2021 implementations chore(rust): rename route fields in transport message Apr 2, 2021 tools build: add influx environment variables to azure template Feb 27, 2021 .dockerignore build: improve dockerignore to limit size of docker build context Feb 17, 2021 .editorconfig chore: ignore cargo lock indentation in editorconfig Jan 10, 2021 .gitattributes chore: ignore files from repository statistics Dec 26, 2020 .gitignore docs: record decision to use architecture decision records Jan 3, 2021 CODE_OF_CONDUCT.md fix: coc link to website url Nov 11, 2020 CONTRIBUTING.md docs: fix broken links to contributing guide Jan 3, 2021 LICENSE docs: add apache license 2.0 Dec 7, 2018 NOTICE docs: attributions for cryptoauthlib, mbed-crypto Jan 30, 2020 README.md docs: fix link to rust guide in readme Mar 31, 2021 build.gradle chore: remove rs Mar 13, 2021 commitlint.config.js ci: lint commit messages Mar 19, 2020 gradlew build: upgrade gradle to 6.5 Jun 21, 2020 gradlew.bat build: upgrade gradle to 6.5 Jun 21, 2020 settings.gradle build: add rust gladle build Jan 15, 2021 View code Features Concepts Secure Channels Application Layer Routing Transports Vaults Enterprise Integrations Get Started License README.md Build your first Ockam application, in 10 mins, with our step-by-step hands-on guide. --------------------------------------------------------------------- Ockam Rust and Elixir libraries for end-to-end encrypted, mutually authenticated communication between edge devices and cloud services. Machines, within the Internet of Things, operate by exchanging messages, with cloud services and other connected machines. Secure, private, and trustworthy connected applications must protect these messages from eavesdropping, tampering, and forgery. Ockam is a suite of programming libraries and infrastructure that make it simple for applications to dynamically create end-to-end encrypted, mutually authenticated, mutually authorized, lightweight secure channels that protect messages, end-to-end -- from their source to their destination. Features * End-to-end encrypted, mutually authenticated secure channels. * Key Lifecycle and Credential Exchange protocols. * Attribute-based Access Control with Credentials that support Selective Disclosure. * Add-Ons for a variety of transport protocols, hardware cryptography, and enterprise integrations. * Libraries for multiple languages - Rust, Elixir (more on the roadmap) --------------------------------------------------------------------- Concepts Ockam Secure Channels To protect en-route messages against eavesdropping, tampering, and forgery ... we usually need a cryptographic secure channel protocol. Most IoT message transport protocols support some way to establish a secure channel. However, such secure channel protocols have traditionally been tightly coupled to their corresponding transport protocols. Their security guarantees are limited by the length and duration of a single transport layer connection. This constraint, often leads to application architectures that violate the foundational security principle of least privilege ... exposing applications to a vulnerability and liability surface that is a lot bigger than it needs to be. Ockam secure channels are decoupled from the transport layer and instead use Ockam Application Layer Routing to provide end-to-end data integrity and confidentiality. Application Layer Routing It is common, for messages in intelligent, connected applications, to traverse a complex path that isn't a simple point-to-point transport protocol connection. To support occasionally connected devices, low power radio protocols and containerized microservices ... messages usually travel via a number of message queues and caches, often over a series of network layer connections ... before reaching their end destination. Ockam Application Layer Routing is a compact binary protocol that can carry messages over multiple hops of transport layer connections. Each transport hop, along the route of a message, may use a different transport protocol. It is possible to describe a route where the first hop is a TCP connection and the second hop is also a TCP connection. Or a different route where the first hop is bluetooth connection, the second hop is TCP connection, and the third hop is a UDP connection and so on. This enables end-to-end Secure Channels over complex, multi-hop, multi-protocol routes. It also enables en-route encrypted messages to be stored in databases, message queues and caches for asynchronous, end-to-end, secure communication between entities that may not be online at the same time. Transports High level Ockam protocol implementations, like Secure Channels and Credential Exchange, are designed to remain the same regardless of how their messages are delivered. Support for a specific transport protocol can be plugged into the routing layer as a Transport add-on. Vaults Various Ockam protocols, like secure channels, key lifecycle, credential exchange, device enrollment etc. depend on a variety of standard cryptographic primitives or building blocks. Depending on the environment, these building blocks may be provided by a software implementation or a cryptographically capable hardware component. In order to support a variety of cryptographically capable hardware we maintain loose coupling between our protocols and how a specific building block is invoked in a specific hardware. This is achieved using an abstract Vault interface. A concrete implementation of the Vault interface is called an Ockam Vault. Over time, and with help from the Ockam open source community, we plan to add vaults for several TEEs, TPMs, HSMs and Secure Enclaves. Enterprise Integrations Ockam protocols and libraries are designed to become a part of larger enterprise systems and applications. To make integration easy with existing enterprise applications, we are building add-ons that tightly integrate Ockam with other systems like Kafka, InfluxDB and Okta that are commonly leveraged within modern enterprise architectures. Get Started We've put together a short walk through of building your first Ockam application, click here to begin. License This code is licensed under the terms of the Apache License 2.0. --------------------------------------------------------------------- Continuous Integration Contributor Covenant About Trust Architecture tools for end-to-end encrypted messaging and mutual authentication between distributed applications in the cloud and devices at the edge ockam.io Topics rust iot security identity library elixir encryption kafka influxdb authentication messaging internet-of-things edge trust identity-management encrypted-messages key-management ockam Resources Readme License Apache-2.0 License Releases 52 ockam v0.4.1 Latest Apr 1, 2021 + 51 releases Contributors 33 * @mrinalwadhwa * @SanjoDeundiak * @mikelodder7 * @jared-s * @robinbudd * @nilslice * @spacekookie * @dependabot * @mtm0183 * @bitwalker * @malnick + 22 contributors Languages * Rust 68.4% * Elixir 31.6% * (c) 2021 GitHub, Inc. * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.