nrf9160 Azure IoT Hub with DPS (share certificates)

RE: nrf9160 Azure IoT Hub with DPS (share certificates)

dejans — Fri, 03 May 2024 12:58:39 GMT

Hi Thomas,

You could read through IoT Hub DPS documentation to check if DPS can be used the way you want (and expect), and that the usage of DPS actually aligns with your security requirements. In addition, you can read more about installing derived device key in Azure documentation. Using symmetric keys for attestation keys does not have support in NCS, but you could potentially consider doing this on your own.

Best regards,
Dejan

RE: nrf9160 Azure IoT Hub with DPS (share certificates)

tkeilbach — Fri, 03 May 2024 07:59:05 GMT

Hi Dejan,

just talked again with my colleague and he said, he created the diagram by his own based on the knowledge he gained from the Microsoft Azure IoT Hub Learn page and tested the setup with a python script. So this is no original Microsoft picture.

Lets take one step back and let me summerize what we want to archive:

Produce the device in the production facility (PCB assembly, download firmware, end test)
Send a bunch of devices to a customer
If the device gets turned on the first time, the device connects 'somehow' to our prepared Azure cloud. If it is a known device (over the IMEI, the cloud knows which IMEI belongs to which customer) it gets everything it needs to connect to the right IoT Hub over a secure connection (TLS). This process must be done only once. If I understood it correctly, the "Device Provision Service (DPS)" is exactly doing this.

Is there a way to provision the device like described above or is the only possible way to download the certificates already at production time?

Best regards,

Thomas

RE: nrf9160 Azure IoT Hub with DPS (share certificates)

dejans — Fri, 03 May 2024 06:45:20 GMT

Hi Thomas,

Can you share the link to the Microsoft Azure IoT Hub Learn page where you took the screenshot from?

Best regards,
Dejan

RE: nrf9160 Azure IoT Hub with DPS (share certificates)

tkeilbach — Thu, 02 May 2024 12:56:20 GMT

Hi Dejan,

thanks for your reply!

Is there any other way to produce devices without adding individual certificates in production but to have the ability to connect to the Azure IoT Hub (and download the certificates and hub informationen while the device is in field / at the customer)?

In general, Azure IoT Hub seems to support a mechanism to get the certificates from the the cloud:

It uses the "Symmetric Key Exchange", but the questions are:

Does Nordics Implementation of "Azure IoT Hub for embedded C" in nRF Connect SDK supports the symmetric key exchange?
1. If not, is it limited to connect to the Azure IoT Hub (DPS service) only over TLS / X509 certificates?
2. If not, would it be possible to add this feature in the library by Nordic / by us?
Is there a documentation for the Azure IoT Hub implemenation?

Thomas

RE: nrf9160 Azure IoT Hub with DPS (share certificates)

dejans — Tue, 30 Apr 2024 14:14:49 GMT

Hi,

It is not possible to have common device certificate. Certificates need to be for individual device. DPS does not send the certificate.

Best regards,
Dejan