Secure IIoT onboarding: Choosing an identity method

Defining critical requirements for IIoT device onboarding

Secure device onboarding in the Industrial Internet of Things (IIoT) is a fundamental step that determines the system's resilience against cyber threats. For the head of an IoT security department at an industrial enterprise, this task extends beyond simple connectivity: it demands a strategic choice that considers both technological aspects and the operational requirements of the production chain. Standards such as ISA/IEC 62443 provide a comprehensive framework for securing industrial automation and control systems (IACS), covering security by design for devices and strategies for zone and conduit segmentation. These standards help assess risks and define target Security Levels (SL) for components and systems.

The U.S. National Institute of Standards and Technology (NIST) in its document SP 800-213 provides guidance on IoT device cybersecurity, defining both technical capabilities and non-technical supporting actions expected from manufacturers. This includes Device Identification (DI) and Identifier Management Support (IMS). Typical IIoT device deployment volumes can reach millions, requiring solutions that ensure scalability without compromising security. The lifecycle of industrial devices often exceeds a decade, emphasizing the need for long-term identity support and update mechanisms.

Architectural approaches to cryptographic device identity

The choice of device identity method is central to secure onboarding. Let's consider three main architectural approaches:

• Trusted Platform Modules (TPM) and Hardware Security Modules (HSM): A TPM is a specialized security chip embedded in a device's motherboard, providing a hardware root of trust for protecting device identity, secure boot, and local encryption keys. Keys generated within a TPM cannot be exported in plain text. An HSM, unlike a TPM, is an external or network-attached device designed for generating, storing, and managing high-value cryptographic keys for enterprise applications, PKI, and large-scale cryptographic operations. TPMs provide security at the device level, while HSMs focus on centralized key management and high throughput. Many organizations use both: TPMs for endpoints and HSMs for centralized enterprise keys. The Trusted Computing Group (TCG) provides guidance on using TPMs to ensure the identity and integrity of IoT devices.
• X.509 certificates and Public Key Infrastructure (PKI): X.509 certificates are the standard for verifying device identity in most IoT provisioning processes. Each device receives a unique certificate during manufacturing or initial provisioning, containing cryptographic keys and identity information signed by a trusted Certificate Authority (CA). PKI ensures reliable authentication and encrypted communication, replacing password vulnerabilities with cryptographic verification. For manufacturing environments, it is recommended to purchase an X.509 CA certificate from a professional certificate service provider.
• Pre-Shared Keys (PSK): PSK encryption is a form of symmetric encryption where a shared secret key is agreed upon before communication begins. Both parties use this key to encrypt and decrypt information. PSK is easy to implement and requires less computational power, making it popular in resource-constrained environments like IoT devices. However, if the key is compromised, communication security is at risk. To enhance security, each device should have its unique PSK.

Identity deployment methods: From manufacturing to operation

The choice of device identity deployment method directly impacts the scalability and operational costs of IIoT solutions:

• Manufacturing Provisioning: This method involves embedding identity (e.g., X.509 certificates or unique PSKs) directly into the device during its manufacturing. This ensures a high level of security, as keys are generated and stored in a secure environment, often using a TPM or Secure Element. "Security by Design" models emphasize the importance of integrating security at early stages.
• Just-in-Time (JIT) Provisioning: This approach allows devices to register and obtain their credentials upon their first connection to a cloud platform. For example, AWS IoT Core uses JITP, where devices with certificates signed by a registered CA can automatically register. Azure IoT Device Provisioning Service (DPS) also offers "zero-touch" JIT provisioning, automating the registration and configuration of millions of devices. This significantly simplifies initial setup and management of large deployments.
• Fleet Provisioning: This method is designed for mass deployment, allowing large fleets of devices to be automatically registered and configured. It often uses provisioning templates and integrates with cloud services, such as Azure DPS, to ensure scalability and efficiency. GSMA IoT Security Guidelines recommend best practices for secure design, development, and deployment of IoT services, including identity management.

Integration with IIoT platforms and identity lifecycle management

After onboarding, managing device identity throughout its lifecycle is equally important. Modern IIoT platforms, such as AWS IoT Core and Azure IoT Hub, offer built-in capabilities for this.

AWS IoT Core allows managing X.509 certificates, including their registration, activation/deactivation, and revocation. JITP in AWS IoT Core enables devices with certificates and private keys present on the device prior to onboarding to connect if their CA is registered with AWS IoT. Azure IoT Hub Device Provisioning Service (DPS) is a helper service for IoT Hub that enables zero-touch, just-in-time provisioning to the right IoT hub without human intervention. DPS supports secure attestation for X.509 and TPM-based identities.

Identity lifecycle management also includes mechanisms for certificate rotation and PSK updates. Regular certificate rotation is critical for mitigating risks associated with compromised private keys. Platforms provide tools for monitoring device identity status, auditing all provisioning actions, and ensuring compliance with regulatory requirements.

AZIOT integrates various protocols, such as MQTT, Modbus, BACnet, KNX, Zigbee, Z-Wave, LoRaWAN, Matter, SCADA, BMS, and ERP, and utilizes edge computing, Unity Base, rules/scenarios, dashboards, auditing, and access control to ensure efficient management of IIoT solutions. Choosing the optimal IIoT device onboarding method is critical for ensuring the security and efficiency of industrial solutions, which can be integrated with the AZIOT platform for centralized management and monitoring.

For more information on enterprise solutions, visit Intecracy solutions and inbase.com.ua solutions.

IIoT device onboarding strategy selection matrix

Choosing the optimal onboarding strategy for IIoT devices requires a thorough analysis of an enterprise's specific needs, its production chain, and operational requirements. It is important to consider not only the initial cost but also long-term operational expenses, scalability, and compliance with industry security standards such as ISA/IEC 62443 and NIST SP 800-213 recommendations. Investing in robust identity mechanisms at early stages will provide a strong foundation for the entire IIoT architecture, minimizing risks and ensuring stable operation in the future.