IoT, Embedded and Hardware Security
Device Identity and Key Storage
We review how device-unique keys are provisioned on the production line and stored on the device. We assess whether a key extracted from one device could unlock the entire fleet.
What it is
Every device has an identity by which it proves itself to the cloud and to other devices. That identity usually relies on a key. The review covers how this key is generated and provisioned on the production line. It determines whether the key is stored in secure hardware or readable memory, and whether each device has a unique key.
Scope
- Review of how device-unique keys are generated and provisioned on the production line
- Testing whether each device has a unique key
- Determining whether keys are stored in secure hardware
- Searching for hard-coded keys embedded in source code or firmware
- Whether a key extracted from one device is valid on others
The need
When organizations need it
- When a device identity provisioning process is being designed for the production line.
- When it is uncertain whether all devices share the same key.
- When the cloud service distinguishes devices by their identity and the trustworthiness of that identity is in question.
Method
How we work
-
Process
We document how the key is generated and provisioned on the production line and confirm this with your team.
-
Storage
We review where the device stores the key and whether it can be read externally.
-
Spread
We assess whether a key extracted from one device is also valid on other devices.
Outcome
What you have at the end
A clear assessment of how device identity is protected from production to storage, and whether compromising one device affects the entire fleet.
Frequently asked questions
Why is using the same key on all devices a problem?
A shared key, once extracted from one device, unlocks the entire fleet. A unique key per device confines a compromise to that device only.
Is secure hardware required?
It depends on the use case. Common IoT security standards expect sensitive security parameters to be stored securely and hard-coded keys in code to be avoided.
IoT, Embedded and Hardware Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting