What does a device require for X509 provisioning to send down the telemetry to the IotHub

user_4216247 0
Viewed 132

Here is the scenario:

  1. The device calls the endpoint(Function App/WebService) with some device information.
  2. The endpoint will have embedded intermediate certificate(X509)(created using root cert) this intermediate certificate is uploaded to the enrollment group
  3. The endpoint will create device id and leaf certificate for device and call the DPS service(using DPS sdk) to register the device
  4. DPS registers the device successfully.

Now, the endpoint needs to return some information to the device that'd tell the device that it has been provisioned and registered in the iothub and it can start sending the telemetry.

I am not sure what the device will require in this step. If we use symmetric key, we'd normally use the device id and symmetric key to create device client and use device client to send device to cloud messages.

azure-iot-hub ios-provisioning azure provisioning x509certificate
1 Answers

The endpoint will create device id and leaf certificate for device and call the DPS service(using DPS sdk) to register the device

When we reach this step we then need to install the leaf certificate in a secure way to the device - how is this being achieved in your architecture? Always make sure that you are protecting your device's private key on this process. Using a secure silicon chips in the form of Hardware Secure Modules (HSM) for protecting device private keys.

Now, the endpoint needs to return some information to the device that'd tell the device that it has been provisioned and registered in the iothub and it can start sending the telemetry.

If you can trust that the endpoint is secure, then the information to be exchanged with the device is the leaf certificate containing the private key for the Proof-of-possession needed when establishing a connection with IoT Hub.

Devices manufactured for X.509 CA authentication are equipped with device unique certificates and a certificate chain from their respective manufacturing supply chain. Device connection, even for the very first time, happens in a two-step process: certificate chain upload and proof-of-possession.

enter image description here

Ref: https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-x509ca-concept

user_94010380
Related