Design identity for devices that must authenticate to a platform for years, without a human present.

Why device identity differs from user identity

There is no human to re-authenticate, no password reset, and no support call. The credential must survive for the device's lifetime, rotate without intervention, and be revocable individually when a device is compromised, sold or decommissioned.

The design

• A unique per-device credential, never a shared secret. A shared key across a fleet means compromising one device compromises all of them, and revocation is impossible without a mass update.
• Certificate-based authentication with a hardware-backed private key that never leaves the device, so extraction requires physical compromise.
• Automated rotation well before expiry, with the renewal path exercised regularly. A rotation mechanism that has never run is a fleet-wide outage waiting for an expiry date — and certificate expiry is one of the most common causes of large simultaneous outages precisely because it fires everywhere at once.
• Individual revocation, checkable at connection time, with a revocation list the platform can distribute.
• Identity bound to attestation where the hardware supports it, so the platform can distinguish a genuine device from a cloned credential on other hardware.

The provisioning problem

How does a device get its first credential? This is the hardest part and it determines the security of everything after it.

• Factory provisioning with a manufacturer-issued identity is strongest and requires supply chain trust.
• A one-time bootstrap credential exchanged for a long-lived one on first connection, which narrows the exposure window to first boot.
• Never a credential shared across a production run, which is the common shortcut and defeats the whole scheme.

What must exist operationally

A registry of every device, its status and its credential validity, with expiry monitored ahead of time. And a decommissioning path, because devices are sold, returned and destroyed, and a credential that outlives the relationship is a standing risk with no owner.