Executive Summary
This white paper outlines best practices for IoT device identity and lifecycle management across smart city and industrial IoT deployments. From manufacturing to retirement, securing the identity of every device ensures trust, resilience, and compliance. This framework leverages secure provisioning, cryptographic agility, zero-trust onboarding, and secure retirement policies.
Lifecycle Phases
Manufacturing (T0)
- Inject hardware root of trust (HRoT).
- Generate asymmetric keypairs inside secure elements.
- Record immutable identity in a manufacturing ledger.
Provisioning (T1)
- Use authenticated onboarding protocols (e.g., DPP, FDO, SPAKE2+).
- Bind device to owner via X.509 or COSE credential issuance.
- Assign initial policy (network access, telemetry scopes).
Operational (T2–Tn)
- Regular session key rotations.
- Certificate renewal/short-lived credential issuance.
- Remote attestation for runtime integrity.
- Policy enforcement via cloud or edge PDP.
Retirement (Tx)
- Revoke credentials in cloud CA.
- Secure wipe of all secrets.
- Update asset register and compliance logs.
Best Practices
- Per-device certificates signed by trusted CA.
- No shared secrets; all keys derived or unique.
- Automated certificate renewal (ACME-like flows).
- Hardware secure storage mandatory for identity keys.
- Audit trails linked to each lifecycle phase.
Frequently Asked Questions
What are the phases of the IoT device identity lifecycle?
Four phases: Manufacturing (T0) — inject a hardware root of trust and generate keypairs in secure elements; Provisioning (T1) — authenticated onboarding (e.g., DPP, FDO, SPAKE2+) and X.509/COSE credential issuance; Operational (T2–Tn) — session-key rotation, certificate renewal, and remote attestation; Retirement (Tx) — revoke credentials, securely wipe secrets, and update compliance logs.
How should device identity keys be stored?
Identity keys should use mandatory hardware secure storage, with per-device certificates signed by a trusted CA and no shared secrets — every key is unique or derived.
Which onboarding protocols does the framework reference?
Authenticated onboarding protocols such as DPP, FDO, and SPAKE2+, with device-to-owner binding via X.509 or COSE credential issuance.
What standards does this identity strategy help comply with?
A robust identity and lifecycle-management strategy helps enterprises comply with NIST, ETSI, and IEC standards while scaling to thousands of devices.
Conclusion
A robust identity and lifecycle management strategy ensures long-term IoT resilience. Cities and enterprises can prevent rogue devices, simplify credential rotations, and comply with NIST/ETSI/IEC standards while scaling to thousands of devices.
For the issuance side of this problem — injecting and managing device identities during production — see AmbiSecure’s engineering note on device identity at manufacturing scale.
