Security Overview

/IOTCONNECT™ provides Enterprise-grade security mechanisms for IoT device communication. The platform supports multiple authentication methods to ensure only authorized devices connect to your cloud infrastructure. Every device must prove its identity before exchanging data, protecting against unauthorized access and man-in-the-middle attacks.

Device Authentication in IoT

Device authentication is the process of verifying a device’s identity before allowing it to connect to the IoT platform. In large-scale IoT deployments, thousands of devices communicate simultaneously, making strong authentication essential to prevent unauthorized access, data breaches, and device spoofing.

/IOTCONNECT™ enforces mutual authentication — both the device and the platform verify each other’s identity. This ensures that devices only communicate with legitimate cloud endpoints, and the platform only accepts data from registered devices.

Why Device Security Matters

IoT devices often operate in untrusted environments (factories, remote sites, public spaces). Without proper authentication, attackers could inject false telemetry, intercept commands, or gain unauthorized access to your infrastructure. /IOTCONNECT™ addresses these risks through certificate-based and key-based authentication mechanisms.

Authentication Types

/IOTCONNECT™ supports the following authentication types for device provisioning and secure communication:

X.509 Certificates: Industry-standard digital certificates that provide the highest level of security. Devices authenticate using a certificate signed by a trusted Certificate Authority (CA). Ideal for production deployments requiring mutual TLS authentication.

TPM (Trusted Platform Module): Hardware-based security using a dedicated cryptographic processor embedded in the device. TPM stores keys in tamper-resistant hardware, making it extremely difficult to extract or clone credentials.

Symmetric Key: Shared secret key authentication where both the device and platform hold the same key. Suitable for development, testing, and constrained devices that cannot support certificate-based authentication.

Individual Enrollment: Per-device provisioning that allows you to assign unique credentials and configuration to each device independently. Supports both X.509 and symmetric key authentication at the individual device level.

Certificate Authority Hierarchy

/IOTCONNECT™ uses a hierarchical Certificate Authority (CA) model to manage device certificates at scale. This chain-of-trust approach allows you to issue and verify device certificates without managing each one individually on the platform.

How the CA Hierarchy Works

The certificate chain consists of:

Root CA Certificate: The top-level certificate that anchors trust. This is registered and verified in the /IOTCONNECT™ portal. All device certificates must trace back to this root.

Intermediate CA Certificate (Optional): An intermediate certificate signed by the Root CA. Used in larger deployments to delegate certificate signing without exposing the root key.

Device Certificate: The leaf certificate installed on each device, signed by either the Root CA or an Intermediate CA. This is what the device presents during TLS handshake.

How Certificates Secure Device Communication

When a device connects to /IOTCONNECT™, the following process occurs:

1. The device presents its device certificate during the TLS handshake.

2. The platform validates the certificate chain — verifying the device certificate was signed by a registered CA.

3. The platform checks the certificate is not expired or revoked.

4. Upon successful validation, a secure TLS channel is established for data exchange.

This mutual TLS (mTLS) ensures both parties are authenticated, providing confidentiality, integrity, and authenticity for all device-to-cloud communication.

ⓘ NOTE

For production deployments, X.509 certificate-based authentication is strongly recommended. Symmetric keys should only be used for development and testing purposes. Always store private keys securely on the device and never transmit them over the network.