Securing first connection of non provisioned IoT device

Question

Assumptions

• The IoT Device is actually a software installable on supported operating system, e.g. Windows or Linux. Lets named it Software-Device.
• The Software-Device is available to download by signed-up customers.
• Customers can manage fleet of their Software-Devices through some management panel.
• Downloading and installing Software-Device should be as maintenance-free as possible for end-customer.
• AWS IoT Core is going to be base platform.

Workflow

Customer downloads Software-Device, installs it on a computer and runs. When Software-Device is ran for the first time, it's not connected to the network yet nor the customer's account. The connection and management will be handled by AWS IoT but in order to connect to the AWS IoT the device has to have valid certificates.

The idea is to display some digit code that customer must enter in the management panel (it's like connecting Android TV to your Google Account - TV displays code that you enter on google.com/device). In the background system will identify device, attach to the customer's account and provision it (sets certificates, IoT endpoint and any additional configuration).

How this may look from technical perspective?

• Software-Device connects to the WebSockets first and send metadata including digit code that is displayed to the user
• When user enters the code in the management panel, some background job verifies if it's valid and certificates are generated and send to the Software-Device (via WebSocket connection)
• Device can connect to the AWS IoT using received certificates
• Customer can manage their device

The concern

I'm thinking about how to secure connection to the WebSocket when the device is not provisioned yet? What I came with for now:

• Do not secure this endpoint just set some rate limits.
• Set some token on build phase.
• Include some certificate into Software-Device sources (one certificate for all downloaded Software-Device by different customers).
• Generate custom build with dedicated certificate when download is requested (build take some time so this may be frustrating for the customer).

What do you think about it? How this should be handled properly or at least the best way as possible?

Answer 1

In this case, since its a software, why not just allow it to have a UI, where you can ask for a userID, password and make an API call where you can then provision a device and get an IoT certificate ? If for some reason, this has to be a headless device, you have two things to do:

• You need a unique ID. This can just be a guid. Or you can call an API to get a guid.
• You want to do the provisioning. This can be another set of API calls, that include the unique number as android TVs do. Ending with a IoT certificate coming down.
• If you want to protect your APIs from being DoS attacked, you could put in a common certificate in your software. If someone reverse engineers it, you can change it and create a new download. You can try harder then to prevent reverse engineering.

Search also for jitp AWS IoT provisioning