Services > Security
Device identity management for connected industrial products
Unique, verifiable identities for every device, using certificates, secure elements and TPMs, so only authentic devices, firmware and data are trusted.
- Unique identity per device
- Keys placed at the factory
- Proven in payment terminals
Why Proekspert
Our experience
Proekspert has over 20 years of experience securely integrating payment terminals with banking backend services. Today, we use our expertise to implement device security solutions in the industrial device manufacturing world.
Device identity management is used in two scenarios
Establishing the authenticity of connected devices and services
Establishing identities for endpoints like devices with extremely high risk and responsibility: payment terminals, national ID-cards, life-critical devices, electronics with safety features.
Securely exchanging data between services and connected devices
Reconfiguring and updating critical devices. Exchanging high-risk confidential data or monetary value.
Common risks when communicating with remote devices
Unverified sources
Offline devices cannot verify if a specific firmware image is coming from an authentic source.
Lack of trained specialists
Updating device software manually on a site is costly for maintenance service providers.
Malicious users
Malicious users may tamper with a device by spoofing it or replacing data packages sent to the server.
Unintended features
A wrong firmware version may ruin a user experience, break important features, or even brick the device.
BENEFITS
Key features of our solution
Secure remote device updates
Enabling secure remote device updates over the air and via ethernet
Preventing human errors
Preventing human errors by protecting a device against manual invalid FW updates online and offline
Protecting against malicious usage
Protecting device software and data against malicious usage and network attacks
License policies and certificate updates
Enabling device-level software license policies and certificate updates
How it works
Principles of the service
Encryption key
To ensure security, data exchange between a device and the outside world is encrypted with a data encryption key (DEK).
Authenticity and security
To guarantee the DEK’s authenticity, it is generated using certificates and private keys that are securely placed before the device leaves the factory. These are also employed to verify the origin of the data.
What we deliver
Building blocks of the solution
Secure elements
Strong embedded device security is built with secure elements and TPMs that enable unique identities for devices.
Over-the-air firmware updates
Remote device management over the cloud enables over-the-air (OTA) firmware updates and secure device connectivity over the internet.
For product engineering teams
A device identity management system is required when you have to manage many devices with unique identities in your organization.
FAQ
Everything you need to know
It gives every device a unique, verifiable identity, based on certificates and private keys. Your services can then check that they’re talking to an authentic device, and the device can check that the data and firmware it receives come from a trusted source. This matters most where devices are reconfigured or updated remotely, or exchange sensitive data.
Certificates and private keys are securely placed in the device before it leaves the factory. They’re used to generate the keys that encrypt data exchange, and to verify where data comes from throughout the device’s life in the field.
The strongest protection comes from storing keys in a secure element or TPM, so they can’t be read out of the device. Whether that’s possible depends on your hardware. For existing products without one, we assess what level of protection the current hardware can support.
They build on each other. Secure firmware updates depend on the device being able to verify that an update is authentic, and that verification relies on device identity and certificates. The EU Cyber Resilience Act requires products to protect against unauthorized access and to protect the integrity of their software and data, and device identity is one of the building blocks for both.
Contact us
Get in touch
We have 30+ years of experience in developing secure software by design. Keeping the balance between security and end-user experience is a common practice for us. Leave your contacts below, and let's have a quick online call to see if we are the right partner for you to prepare your devices and infrastructure for CRA.
Jukka Antero Halttunen
Embedded Software and Systems Lead
Languages: EST, ENG, FIN