To prevent counterfeit devices from joining a network or to limit the opportunity for network attacks, it’s important to authenticate devices attempting to join Internet of Things (IoT) networks and subsequently connect only authorized devices. The standard mechanism to securely authenticate clients connecting to a server is transport-layer-security (TLS) client-side authentication.
To implement such authentication in an IoT network, the appropriate certificate authority (CA)—usually the IoT device provider—issues a unique X.509 certificate to each IoT device and the associated private key that functions as a unique security credential for the IoT device. Once the certificate and associated private key are stored on the IoT device, it may use them during the TLS client-authentication process to securely join the IoT network.
The act of supplying the necessary credentials to a device joining a network is known as “provisioning.” It’s important to have a user-transparent provisioning process in order to minimize onboarding challenges or security lapses. Therefore “zero-touch provisioning,” which eliminates the need for any user interaction, is highly desired in IoT applications.
A common but challenging certificate provisioning approach is to physically add CA-issued credentials to devices during manufacturing. Since it’s critical to prevent unauthorized parties from learning the values of private keys, manufacturing processes that involve the management of private keys must be highly secure and completely trustworthy. Such a requirement rules out many—if not all—low-cost contract manufacturers. But the need to keep many classes of IoT devices low cost requires approaches that entail using these types of manufacturers.
One provisioning process that has gained traction is pre-populating “secure elements” with certificates at a secure location and then shipping the secure elements to a low-cost manufacturer, which assembles the complete IoT device. Secure elements are chips that provide hardware-based cryptoaccelerators and secure key storage, sometimes augmented with additional protections against hardware tampering and side channel attacks. A number of companies, such as semiconductor distributors, now offer specific services to program secure elements with certificates in a trustworthy environment.