nRF9160 Cannot make Kconfig options have an effect in Segger Embedded Studio

[Johan]

I have a nRF9160 DK and I'm adapting the asset tracker to connect to our own AWS cloud solution.

I see the code nrf_cloud uses defines coming from the Kconfig at \nrf\subsys\net\lib\nrf_cloud\Kconfig.
For example: NRF_CLOUD_HOST_NAME, NRF_CLOUD_PORT, NRF_CLOUD_PROVISION_CERTIFICATES, NRF_CLOUD_CERTIFICATES_FILE etc

How do I make changes to the Kconfig have an effect when building in Segger Embedded Studio? No matter what I do, changes to this Kconfig doesn't have an effect to the built result.

Am I missing the point, how it's supposed to work perhaps?
Anyone who can educate me, how to work "correctly" with this, would be appreciated.

I tried to build from commandline, but couldn't make it work, so I'm sticking with Segger Embedded Studio so far.
Build platform: win7

Johan

[Martin Lesund]

Hi Johan, 

The NCS tag v0.4.0 just got released! https://developer.nordicsemi.com/nRF_Connect_SDK/doc/0.4.0/nrf/doc/release-notes-0.4.0.html

Please go to:

cd ncs/nrf
git checkout master
git pull
git checkout v0.4.0
west update

To get the stable release.

Remember that you need to flash the nrf52 (nrf52840_pca10090) on the nRF91 DK with the HCI_UART sample.

as described here: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/samples/nrf9160/lte_ble_gateway/README.html

Best Regards,

Martin L.

[Johan]

Some more questions for you Martin:

1.How do I know what kind of connection the LTE is using, with the sample BLE_LTE_gateway?
I want to be in control of and set it to NB-LTE forced, and also read and verify this setting has been taken effect.
How can I accomplish this?

2. What is "Security tag to use for nRF Cloud connection"? Is it for AWS or just your own solution? I haven't found any documentation on AWS of this yet.

Cheers,
Johan

[Johan]

As, well, how do I remove pairing with nrfCloud? 
I removed my unit from it, but the local device refuses to go into "led 3 and led 4" -blink.
Just "led 3" - blinking.

It seems it's receiving this from the cloud, what to do. So the cloud solution tells my unit it doesn't need any paring, but I have removed it, so it does!
Bug?

[Martin Lesund]

Hello Johan,
1. You can get/set that data from a simple AT command: AT%XSYSTEMMODE?

1,0,0,0 = LTE CAT-M1

0,1,0,0 = LTE CAT-NB1

0,0,1,0 = GNSS

This has to be set before the modem is turned on (AT+CFUN=1)

and can be changed if the modem is in Offline mode (AT+CFUN=4) 

(When you turn on the nRF91 it will default be in Offline mode if the application 

---

2. Our nrfcloud solution runs on AWS.

The security tag you are referring to is used when provisioning the certificates to the nrf91.
Please see how this is used in nrf_cloud_transport.c.

So if you are going to provision certificates to the modem you need a security tag.

Best Regards,

Martin L.

[Johan]

Hi Martin,

great you're back, since I need more support to get this ship going.

1)
So If I get you, you recommend setting these settings then resetting the modem, for it to boot up in the correct mode ?

I'm using the "ble_lte_gateway"-example. I'm guessing there is no easy way to put at-commands anywhere in it as it is, without rewriting parts, or? I could just use at_client-example as well, to set them, then put back this ble_lte_gateway to continue testing to get the certificates working. Sounds good to you? 

2) The security tag, is this something I should request from our AWS-guy then?
I'm not into the AWS-stuff, just receiving certificates from him, to put in the certificates.h so far.

3) I see also a clientID, it's probably from AWS. Could it be the numbers in the filename?
"70ff304fdd-private.pem.key", ie 70ff304ffdd ?

[Johan]

ps. I did check the source code for security tag, but there is no explanation, more than function calls using it. ds.

[Martin Lesund]

Hi Johan,

1) Since the LTE_Gateway uses the LTE_LINK_CONTROL library, you can actually enable a config so the Application will set the modem in the correct mode at startup.

So you could enable this configs in the prj.conf file, either:

CONFIG_LTE_NETWORK_MODE_NBIOT=y

to enable NB-IoT mode, or:

CONFIG_LTE_NETWORK_MODE_LTE_M=y

to enable LTE-M mode at startup.

---

It is also worth noting that if you want to store the connection mode permanently in the Modem flash you can set it with the AT-command: AT%XSYSTEMMODE=<mode>

then send the command: AT+CFUN=0

to set the modem in power off mode and store the settings in the modem flash.

---

Quick tip:  note that you can set up a socket and send AT-Commands directly in your application similarly to what is done in the LTE Link Control library

---

2)

• The security tag in the nrf_inbuilt_key_write() function is documented as such:

"Application defined tag for this credential to be referred

to in setting up a BSD Secure Socket or to manage the credential"

• The security tag used in the tls_credential_add() function:

"A security tag that credential will be referenced with."

So it is not something you need to request from your AWS guy.

---

3) Yes I think that should be fine. If you are referring to what I think you are referring to.

Since for our solution when we are connecting to the nrfcloud we use the IMEI number for the nrf91 SIP as clientID.

Please use the nrf_cloud_transport.c file as reference.

---

Managing Device certification AWS Documentation

[Johan]

I have requested a security tag from my cloud guy. Let's see if he manages to create one from the AWS console and such.

[Johan]

Ok, I'll tell him to ignore that email then :-)

[Johan]

Ok, I might be tired, but what's the practical use for this security tag, with the BSD-secure socket?
Can I use the same tag as already there, or I need a new one?
What's the penetration risk? Is it a key for encryption?

I can use the same tag for every unit or is that creading a risk I don't see?
I'm new at this nrf-cloud things, so I'm asking rather more than too little.

I'm guessing a different key for every device I'm making is the way to go.
But, I don't need to put them in a database right, it's just a local key, one time made, or can be recreated upon each boot?