Automated Device Provisioning
1 like183 views
The document discusses the challenges of device provisioning in IoT, highlighting the complexities of supply chains and the manual nature of initial configurations. It describes a two-step provisioning process involving enrollment and registration, and outlines features of the Device Provisioning Service (DPS) such as support for multiple authentication methods and device management capabilities. Additionally, it offers a demo for provisioning a device using symmetric key attestation.
Automated Device Provisioning
- 1. Device Provisioning Service John Chang Commercial Software Engineering Microsoft 2019.09
- 2. Why provisioning is hard today • Solutions must have per-device revocable access • Provisioning is a manual process • Initial configuration can become irrelevant between manufacturing and deployment • Device supply chains are complex
- 4. An IoT device’s relationship to DPS
- 5. Provisioning process • There are two distinct steps with security flows • The manufacture step in which the enrollment information is harvested and placed in the enrollment list • The registration step in which the device phones home to the DPS
- 6. Automated Device Provisioning Device Management System 2. Return the device information. 1. Create the Enrollment list. Device Service Bus Logic App ASP.NET Core (On Device)
- 7. IoT Hub IoT Hub IoT Hub IoT Hub Provisioning with DPS IoT Hub Device Device Provisioning Service Business logic “where’s my home?”Identity attestation Device enrollment info Register new device, populate initial configRegistered device info Registered device info Establish connection Initial configuration Device telemetry Insights Device telemetry …etc
- 8. Brief feature overview • Cross-region, cross-subscription DPS→IoT Hub connection • Group and individual enrollment • Multiple auth methods supported • Symmetric keys • TPM endorsement key • X.509 certificates • Automatic re-provisioning • Factory reset • Migration • Enrollment-level device assignment logic • Static assignment • Evenly weighted • Lowest-latency (geo-sharding) • Custom assignment logic
- 9. Provision with Symmetric key attestation • Represents a "Hello world" experience for developers who are new to device provisioning, or do not have strict security requirements. • Device attestation using a TPM is more secure and should be used for more stringent security requirements. • Legacy devices may not have a certificate, TPM, or any other security feature that can be used to securely identify the device. • Symmetric key attestation can be used to identify a device based off information like the MAC address or a serial number.
- 10. Demo – Provision Device with Symmetric key https://github.com/michael-chi/automate-device-provisioning
- 11. Code Flow
- 12. Questions?