Device Enrollment in Azure IoT
Question
After the acquisition of an environment monitoring infrastructure from a local operator, your company needs to integrate hundreds of their field devices into your company's IoT infrastructure.
Most of the devices use X.509 authentication but there are some device types that are secured with TPM modules.
For each device, the enrollment list must contain the <............1............> of the device because this is the key that the Device Provisioning Service checks on the first connection attempt of the device.
Which of the following objects completes the above statement <..1..>?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: A.
Option A is CORRECT because the Device Provisioning Service uses the public part of the endorsement key (EK_pub) to identify and enroll the device.
This key has to be provided in the enrollment of the device.
Option B is incorrect because the Device Provisioning Service never checks the SRK or owner of the device.
Option C is incorrect because the private part of any of the device keys is hidden and retained in the TPM; it is never revealed to outside services.
Option D is incorrect because private parts of any of the device keys are hidden and retained in the TPM; they are never revealed to outside services.
Diagram:
/answer/imgckeditor_94.png)
References:
In order to integrate the field devices from the environment monitoring infrastructure into the company's IoT infrastructure, the devices need to be enrolled with the Device Provisioning Service (DPS). DPS is a service that automates the enrollment of devices to IoT Hub and assigns them to a specific IoT Hub based on the device's identity.
The enrollment list is a list of devices that are authorized to connect to the DPS. When a device connects to the DPS for the first time, the DPS checks the device identity against the enrollment list. The enrollment list contains the device identity information, including the key that is used for device authentication.
X.509 certificates are a standard method for device authentication in IoT deployments. A device that uses X.509 authentication has a certificate with a public and a private key. The public key is used for authenticating the device, and the private key is used for decrypting incoming messages.
TPM (Trusted Platform Module) is a hardware-based security module that stores keys and performs cryptographic operations. A TPM module can store different types of keys, such as the Storage Root Key (SRK) and the Endorsement Key (EK).
In the context of the given scenario, the statement <..1..> refers to the key that the DPS checks on the first connection attempt of the device. This key is the public part of the device's identity key, which is either the public part of the Endorsement Key (EK) or the public part of the Storage Root Key (SRK).
Option A, the public part of the endorsement key, is a possible answer because the EK is a key that is unique to each TPM module and is used for attestation and identification of the device. The EK is signed by the manufacturer and is a trusted root of trust for the device. However, the private part of the EK is stored securely within the TPM module and is not shared externally.
Option B, the public part of the storage root key, is also a possible answer because the SRK is a key that is generated by the TPM module during initialization and is used to secure other keys within the module. The SRK is stored in non-volatile memory and is used to authenticate the device. The public part of the SRK is used for authentication and can be shared externally.
Option C, the private part of the SRK, is not the correct answer because the private key is not shared externally.
Option D, the private part of the endorsement key, is not the correct answer because the private key is not shared externally.
Therefore, the correct answer is either option A, the public part of the endorsement key, or option B, the public part of the storage root key, depending on the specific security architecture of the field devices being integrated into the company's IoT infrastructure.