Articles in this section

OneVue architecture technical overview

  • Updated
Follow

OneVue is a multi-tenant solution built on top of Amazon Web Services (AWS). AWS is designed with multiple layers of protection, including secure data transfer, encryption, network configuration, and application-level controls distributed across a scalable, secure infrastructure. AWS provides a scalable architecture with security capabilities while lowering the application life-cycle costs and total cost of ownership for the OneVue capabilities.

OneVue Application Architecture

  • Application Development Language: Public and private service layers are constructed with Ruby on Rails. The front-end experience is developed with a responsive design through HTML5 and JavaScript.

  • Operating System: CoreOS and CentOS

  • Database Architecture: PostgreSQL (AWS RDS), DynamoDB, and Redis (ASW ElastiCache)

OneVue Technology Stack

tech_stack.png

OneVue Security Architecture

The security architecture of OneVue is multi-layered, operating through the Amazon Web Services (AWS) security infrastructure. AWS is ISO 27001 certified, SOC (1,2, and 3), and is validated as a Level 1 service provider under the Payment Card Industry (PCI) Data Security Standard (DSS).

AWS provides a secure infrastructure, including physical security, employee life-cycle management, and regular, third-party audits. The adoption of AWS by Homeland Security, NASA, and the Central Intelligence Agency demonstrates the high level of security AWS provides in its architecture.

Primex leverages the secure architecture of AWS to provide a cost effective solution that encompasses the high-security needs of our customers.

  • AWS Identity and Access Management (IAM) with Multi-Factor Authentication: Controls and manages user credentials, including passwords, access keys, and permissions policies.

    IAM allows for the central management of all users, allowing Primex to control user access to individual records and services. Primex adds to this multi-factor security by controlling and managing the Primex resources granted access to the OneVue development and production environments through IAM. This provides complete security and ensures that not only can Primex control the security of customer information, but also audit and manage the access of Primex development, engineering, and support resources.

  • AWS Virtual Private Cloud (VPC): Provides the separation of OneVue customer instances.

    Primex uses the AWS VPC services to provide separation of data and services between environments. Additionally, Primex uses the VPC service to secure all connectivity for development, training, and technical support functions.

  • Encrypted Data Storage: Secures data throughout the record lifecycle.

    OneVue only accepts TLS-encrypted connections from client connections and reporting Primex IP devices. Additionally, data is AES encrypted and maintained securely in storage with all of the AWS database services.

OneVue Architecture - Amazon Web Services (AWS)

OneVue is comprised of the following Amazon Web Services (AWS).

Database

DynamoDB - Predictable and Scalable NoSQL Data Store

  • Primex uses DynamoDB to store large data sets; such as sensor readings.

  • DynamoDB is designed by AWS for zero administration, low latency, and unlimited throughput - making it the perfect selection as a service to provide OneVue sensor reading and logged reading functions.

ElastiCache - In-Memory Cache

  • Primex uses ElastiCache to store user sessions and cache data.

  • ElastiCache provides automatic failure detection and recover, detailed monitoring and metrics, and “push-button” scaling.

Relational Database Service (RDS) - Managed Petabyte - Scale Data Warehouse

  • Primex uses RDS to run the relational Databases for OneVue; Amazon manages all backups and maintenance.

  • AWS designed RDS for ease of deployment and efficient host replacement in a big-data environment.

Storage & Cloud Delivery Network (CDN)

Simple Storage Service (S3) - Scalable Storage in the Cloud.

  • Primex uses S3 to store backups, User Profile images, and reports. Files are backed up and readily available to users.

  • The S3 service is designed for durability and resilience, ensuring data is never lost or at risk.

Compute & Networking

Elastic Cloud Compute (EC2) - Virtual Servers in the Cloud.

  • Primex leverages EC2 to reduce the time required to obtain and boot new server instances down to minutes - allowing the Primex engineering team to quickly scale capacity, both up and down, as computing requirements change.

Virtual Private Cloud (VPC)- Virtual Secure Network

  • Primex uses VPC to separate each service that makes up OneVue. This secures the EC2 servers for each part of OneVue to ensure they can only communicate with the servers needed.

Elastic Load Balancing (ELB) - Load Balancing Service

  • Primex uses ELB to automatically distribute incoming traffic between multiple Elastic Cloud Compute (EC2) instances.

Auto Scaling Groups (ASG) - Automatically Scale Up and Down

  • Primex uses ASG to maintain application availability and scale the Amazon EC2 capacity up or down automatically.

Route 53 - Scalable Domain Name System

  • Primex uses Route 53 to manage all DNS settings for OneVue. This allows Primex to change DNS settings as needed to spread the load across servers or direct traffic to new servers when deploying new versions of OneVue.

Deployment & Management

CloudFormation - Template AWS Resource Creation

  • Primex uses CloudFormation to manage all of the resources used for OneVue - allowing Primex to spin up new environments as needed. In the event of a major outage of AWS, OneVue can quickly be moved to a new region of AWS.

CloudWatch - Resource and Application Monitoring.

  • Primex uses CloudWatch to monitor servers and trigger ASG to scale servers based on load.

Identity and Access Management (IAM) - Secure AWS Access Control

  • Primex uses IAM to control access to all of the OneVue services. Each user is required to use a Multi-Factor Authentication to log in.

  • Primex uses IAM Roles to restrict each EC2 servers access to resources, including the S3, SQS, RDS, and DynamoDB resources.

App Services

SES - Email Sending Service

  • All email traffic sent from OneVue uses SES.

SQS - Message Queue Service

  • Primex uses SQS for guaranteed message delivery between the services that make up OneVue.

  • For example, when a Text Message or Voice Call needs to be sent out the requests are sent into a queue before they are then forwarded on to Twilio.

SWF - Coordinating App Components

  • Primex builds, runs, and scales background jobs that have parallel or sequential steps - allowing for a fully-managed state tracker and task coordinator in the Cloud.

  • For example, SWF is used to manage the background processes of OneVue. The timers are used to control when email, text, or voice alert notifications are sent out and escalated.

Security

CloudFront

  • To provide an extra layer of network and application-level protection, Primex uses CloudFront as a gateway to some of the OneVue backend services.

  • CloudFront’s infrastructure and processes are all compliant with PCI, DSS, HIPAA, and ISO to confirm secure delivery of sensitive information.

WAF (Web application firewall)

  • Primex uses WAF to protect OneVue against common web exploits that may affect availability, compromise security, or consume excessive resources.

  • Primex uses the WAF security rules to mitigate common attack patterns. The security rules include HTTP flood detection, reputation lists and blacklists, and country blocks.

Related articles