Trusted Internet of Things Device Onboarding and Lifecycle Management
summary
Current provisioning leaves networks open and devices hijackable; with 40 billion devices expected by 2025 the session argues for scalable, automated, repeatable credentialing that enforces mutual authentication, encrypted delivery, and per-device keys. Practical workstreams: DPP (Wi‑Fi Easy Connect)—QR/public‑key one‑step provisioning, works offline, no manufacturer PKI required; BRSKI—voucher-based zero‑touch but needs an online manufacturer service and PKI; FDO—FIDO Device Onboard focuses on application onboarding and late binding, requires a manufacturer rendezvous service. NCCoE project plans end‑to‑end demos integrating attestation, MUD and lifecycle management.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:37Challenge
- 2:38What is Trusted Network Layer Onboarding?
- 3:25Network-Layer Onboarding
- 7:00Application-Layer Onboarding
- 8:09Onboarding-Related Aspects of Lifecycle Management
- 10:11NIST Cybersecurity Paper
- 11:16Onboarding Security Characteristics and Capabilities
- 13:05Onboarding Characteristics of interest to Manufacturers and Vendors
- 17:15Summary
- 22:50A potentially fancier approach: router or service keeps track of device
- 23:49DPP Advantages and Disadvantages
- 25:56Bootstrapping Remote Key Infrastructure (BRSKI): It centers around a voucher (RFC 8366)
- 28:34FIDO Device Onboard (FDO)
- 30:25FDO Advantages and Disadvantages
- 32:03Next Steps
related talks
30mSupply Chain Security for IoT Devices
39mZero touch secure device onboarding and management
19mSimplifying device deployment
19mProviding appropriate trust for IoT devices
29mEnabling a secure IoT from design to deployment
39mApplied IoT security for healthcare and industrial
18mBeyond the Default Password: Building Trustworthy IoT Products
45mBuilding a Secure IoT Device