Soracom Arc

Overview

Soracom Arc is a secure link service that allows compatible devices to connect directly to the Soracom platform using any standard Internet connection, such as Wi-Fi, ethernet, or satellite.

While the device connectivity provided by Soracom Air for Cellular and Soracom Air for Sigfox is managed and secured directly by Soracom, unmanaged networks like Wi-Fi and ethernet traditionally pose many integration challenges, as it is often difficult or even impossible to guarantee consistent security from one unmanaged network environment to another.

Arc provides a mechanism that allows a device to establish an end-to-end secure connection directly with Soracom, providing a similar level of security provided by Soracom Air, no matter the type or configuration of the underlying network connection. In turn, devices that use Arc to connect to Soracom are able to securely access Soracom platform services such as Beam, Funnel, Funk, and Harvest, just as if they were connected using a Soracom Air cellular connection.

Because Arc can be combined with any standard Internet connection, this extends the flexibility of Soracom platform services to support mixed-mode IoT systems that use a combination of connectivity technologies, and allows IoT developers the ability to seamlessly transition between them without building separate architectures for each network connection type. For example:

In addition, Arc provides a simple way to test many of Soracom's platform services directly from any Internet-connected computer without the need to purchase a Soracom IoT SIM or cellular device, while keeping the ability to add or switch to Soracom Air cellular connectivity at a later stage without affecting the application architecture.

Architecture

Arc uses WireGuard®, a lightweight open-source VPN implementation that employs the latest encryption technologies, in order to create a secure connection between a device and the Soracom platform.

While the secure connection between a device and Soracom is functionally a standard WireGuard VPN connection, Arc manages the connection as though it were a cellular connection. This is accomplished by generating a Virtual SIM and associating it to a WireGuard connection. In this way, when a device establishes a connection to Soracom using Arc, it will appear as though the device is connecting to Soracom using a cellular connection, even though the device is using a standard Internet connection.

Arc architecture

Once a device has established a secure connection to Soracom using Arc, it can access most of the same features and services available for Soracom Air for Cellular devices. By default, only connections to Soracom platform services (such as Beam, Funnel, Funk, and Harvest) will utilize Arc's secure connection, while all other Internet traffic will continue to use the device's existing Internet connection without going through Soracom.

Because the Arc connection is treated as though it originates from a cellular connection, there is no need to implement separate Soracom platform service configurations for Soracom Arc devices from Soracom Air devices. Since a Virtual SIM will be associated with the device, the device can use the same platform service configurations, just as if it were using a standard Air for Cellular SIM.

Virtual SIMs

Arc provides two options for creating Virtual SIMs:

Virtual SIM

Standalone Virtual SIM

A Standalone Virtual SIM allows a device to connect to Soracom without the need for using an actual IoT SIM or configuring a cellular network interface.

When creating a Standalone Virtual SIM, both a SIM ID and an IMSI will be generated for the Virtual SIM, equivalent to the SIM ID and IMSI of a standard Air for Cellular SIM.

The SIM ID and IMSI of the Virtual SIM will then be used to uniquely identify the device when it establishes a WireGuard connection with Soracom and accesses Soracom platform services.

Subscription Container Virtual SIM

A Virtual SIM that is added to an Air for Cellular SIM as a Subscription Container will allow a device to connect to Soracom using either a cellular connection (with Soracom Air for Cellular) or non-cellular connection (such as Wi-Fi or ethernet), while being recognized as the same logical device in either case.

When creating a Subscription Container Virtual SIM, only an IMSI will be generated for the Virtual SIM. This IMSI will then be attached to a selected IoT SIM as an additional IMSI, which has its own SIM ID and IMSI.

Unlike a planP1, planX1, planX2, planX3, plan-US-max, or plan-US-NA subscription container, no data is added to the IoT SIM itself when adding a Virtual SIM. Instead, the Virtual SIM is associated with your IoT SIM within the Soracom platform.

Because the Virtual SIM's IMSI will be associated with an IoT SIM, when a device using the IoT SIM establishes a WireGuard connection with Soracom, Arc will automatically map the Virtual SIM IMSI to the IoT SIM IMSI. As a result, even though the device is connected to Soracom using a non-cellular connection, it will still be identified as the IoT SIM. In turn, when the device accesses Soracom platform services such as Beam, Funnel, Funk, and Harvest, the connections will continue to appear as coming from the same IoT SIM.

Adding a Virtual SIM as a Subscription Container to an existing Air for Cellular SIM is supported for the following SIMs:

Global Coverage Japan Coverage
plan01s plan01s - LDV plan-NA1 plan-US planX3 planX3-EU plan-D plan-DU plan-K plan-K2 plan-KM1

Features

Connection Process

Connecting to Soracom using Arc involves the following steps:

Arc Connection Process

  1. Create a Virtual SIM (Standalone or as a Subscription Container) - Creating a Virtual SIM can be done through the User Console, or using the Soracom API or CLI. Once a Virtual SIM has been created, Arc will generate a WireGuard configuration.

    In addition to creating a Virtual SIM from the User Console, API, or CLI, Soracom also provides a command line tool called soratun that allows a device to create its own Virtual SIM (a process called bootstrapping). For more information, refer to the Soratun documentation.

  2. Configure WireGuard on the device - Copy or enter the WireGuard configuration details to your device. If using the Soratun tool to bootstrap your device, the configuration is stored on the device automatically.

  3. Activate WireGuard on the device - Finally, activate WireGuard on your device. The WireGuard client will automatically connect to the Arc server endpoint and negotiate the connection. Once connected, your device will be able to access Soracom platform services directly.

Requirements

To connect your device using Arc, you will need to install a WireGuard® client on your device. This will allow your device to connect to Soracom as a WireGuard client. WireGuard client implementations are currently available for many platforms, such as:

Refer to the WireGuard installation documentation to check if a WireGuard implementation is available for your device's platform, and for installation instructions.

When using the Soratun tool, a WireGuard client is built in to the tool, so there is no need to install WireGuard separately.

In addition, your device must have an Internet connection (not provided by Soracom).

Limitations

Before using Arc, please be aware of the following limitations: