TPM Authentication

TPM (Trusted Platform Module) provides hardware-based security for IoT devices connecting to /IOTCONNECT™. By storing cryptographic keys in a dedicated, tamper-resistant hardware chip, TPM offers the strongest protection against credential theft, device cloning, and physical attacks on device security.

What Is TPM?

A Trusted Platform Module (TPM) is a specialized cryptographic processor physically embedded in a device’s hardware. Unlike software-based key storage, TPM provides a secure enclave where private keys are generated, stored, and used without ever being exposed to the operating system or application layer.

TPM chips are designed to be tamper-resistant — physical attempts to extract keys will destroy the chip, making hardware-based attacks impractical. This makes TPM the most secure option for devices deployed in untrusted or publicly accessible environments.

Key Capabilities of TPM

Secure Key Generation: Generates cryptographic keys within the hardware. Private keys never leave the TPM chip.

Hardware-Bound Identity: Each TPM has a unique Endorsement Key (EK) burned in at manufacturing, providing an unforgeable device identity.

Secure Boot Support: Verifies firmware integrity before device boot, preventing rootkit and bootloader attacks.

Attestation: TPM can cryptographically prove the device’s hardware and software state to remote parties.

How TPM Works with /IOTCONNECT™

/IOTCONNECT™ integrates with TPM-equipped devices through the device provisioning service. The authentication flow leverages the TPM’s Endorsement Key (EK) and Storage Root Key (SRK) to establish device identity.

TPM Authentication Flow

1. During manufacturing, the device’s TPM Endorsement Key (EK) public portion is registered in /IOTCONNECT™.

2. When the device boots, it contacts the /IOTCONNECT™ provisioning service.

3. The platform issues a cryptographic challenge encrypted with the device’s EK public key.

4. The TPM decrypts the challenge using its internal EK private key (never exposed externally).

5. The device returns the decrypted response, proving possession of the TPM.

6. The platform provisions the device and establishes a secure connection.

This process ensures that only the physical device containing the registered TPM chip can authenticate — cloning or emulation is not possible.

Supported TPM Versions

/IOTCONNECT™ supports the following TPM specifications:

TPM 2.0 (Recommended): The current standard with enhanced cryptographic algorithms (SHA-256, ECC P-256), improved authorization mechanisms, and better flexibility. Required for new designs and recommended for all production deployments.

TPM 1.2 (Legacy Support): The older specification using SHA-1 and RSA only. Supported for backward compatibility with existing hardware, but not recommended for new deployments due to cryptographic limitations.

TPM 2.0 provides significant improvements over TPM 1.2, including support for modern elliptic curve cryptography (ECC), multiple hash algorithms, and enhanced key hierarchies. Always select TPM 2.0 hardware for new IoT projects.

TPM Enrollment Process

To enroll a TPM-equipped device with /IOTCONNECT™, follow these steps:

Step 1: Extract the TPM’s Endorsement Key (EK) public key from the device hardware. This is typically done during device manufacturing or initial setup.

Step 2: In the /IOTCONNECT™ portal, navigate to Security → Enrollment and select TPM as the authentication type.

Step 3: Register the device by providing the EK public key (base64-encoded) and a unique Registration ID.

Step 4: Configure the device’s firmware to use the /IOTCONNECT™ provisioning endpoint with TPM attestation.

Step 5: On first boot, the device automatically provisions itself through the TPM challenge-response flow.

Step 6: Once provisioned, the device receives its connection details and begins secure communication.

Benefits Over Software Keys

TPM-based authentication provides significant security advantages over software-stored keys:

Key Non-Extractability: Private keys generated inside a TPM can never be read or exported. Software keys stored in files or memory can be copied by malware or physical access.

Clone Resistance: Since keys cannot be extracted, it is impossible to clone a TPM-authenticated device. Software keys can be copied to create unauthorized device replicas.

Tamper Evidence: Physical attempts to probe or decap a TPM chip trigger protective mechanisms that destroy the stored keys. Software keys have no such protection.

Secure Boot Chain: TPM enables measured boot, verifying each firmware component before execution. This prevents compromised firmware from accessing credentials.

Hardware Root of Trust: TPM provides an immutable identity anchor that persists across firmware updates and OS reinstalls. Software keys can be lost or corrupted during updates.

ⓘ NOTE

TPM authentication requires hardware support on the device. Ensure your device hardware includes a TPM 2.0 chip before selecting this authentication method. For devices without TPM hardware, use X.509 certificates or symmetric keys as alternatives.