Device Identity
Establishing and maintaining a trustworthy identity for each device in a fleet — including the parts that must work for a decade without physical access.
Definition
Device identity is how a system knows which device it is talking to, and whether that device should be trusted. It covers provisioning, authentication, rotation and revocation.
The lifecycle, and where it goes wrong
Provisioning. How does a device get its first credential? Options: injected at manufacture (secure, requires a trusted supply chain), issued at first connection (a bootstrap credential that is itself a target), or derived from hardware. This is the decision that determines everything after it, and it must be made before manufacture.
Authentication. Per-device credentials, never shared. A fleet with a shared secret has one compromise between an attacker and everything, and the secret cannot be rotated without touching every device.
Rotation. Certificates expire. A device that cannot renew its credential becomes unreachable, and if the fleet is in the field, that is unrecoverable. Renewal must work reliably, long before expiry, and must handle a device that has been offline for months.
Revocation. A compromised or decommissioned device must be excluded, and the mechanism must work for devices that check in rarely. Short-lived credentials with regular renewal are usually more practical than revocation lists, precisely because they fail closed by default.
The properties a fleet demands
- Hardware-backed keys where the threat model includes physical access, so a key cannot be extracted and cloned.
- Least privilege per device. A sensor should be able to publish its own telemetry and nothing else. Broad permissions turn one compromised device into a fleet-wide problem.
- Identity that survives replacement. A device is repaired or swapped; the logical identity and its data history must be separable from the physical unit.
- Enrolment that scales, without a manual step per device.
Failure scenarios
- A shared credential across the fleet, unrotatable.
- Certificates expiring with no working renewal, bricking devices remotely.
- Bootstrap credentials that never expire, so extracting one from any device grants enrolment.
- No revocation path for a device known to be compromised.
- Provisioning designed after manufacture, when the options have already closed.
Interview question
"A fleet of devices has certificates expiring in two years. What must be true today for that not to be an incident?"