IoT, industrial and medical devices, edge gateways

Attested devices

Enrolment proves day one. Your device lives ten years.

Devices live for ten years or more, in places nobody watches. Attestation at enrolment proves very little about year seven. Re-attestation and continuous attestation turn a one-time certificate into an ongoing statement of health.

Who this is for

• Device makers, IoT, industrial and medical
• Product security teams, preparing for the Cyber Resilience Act
• Operators of device fleets, utilities, factories, hospitals

When trust has to be proved again

What we deliver

• Device attestation architecture using TPM, DICE or secure elements, aligned with IETF RATS.
• Lifecycle design: enrolment, renewal, re-attestation and revocation.
• Evidence your customers' auditors can read.

Questions worth answering

• What does a device prove when it renews its certificate?
• Can you revoke a firmware version across the fleet?
• Who verifies the evidence, and with which reference values?

Across the life cycle

DesignBuildMake or deployOperateUpdateRetire

The stage that decides here: make or deploy. The factory decides everything. An identity that was not put in at manufacture cannot be added in the field. See attestation in the product life cycle.

Rules and standards your buyers cite

Cyber Resilience ActIEC 62443NIS2

Industries that use this

Healthcare and medical dataPharma and life sciencesEnergy and smart grids

Go deeper

• How the platforms attest: DICE, TPM, Arm TrustZone and PSA, Android
• Terms explained: Reattestable, Remote attestation, EAT and CoRIM, Measured boot, TPM, DICE, Runtime integrity, IEC 62443, Attestable computing, Provisioning and onboarding, Self-sovereign identity (SSI), Why small devices struggle to be trusted, Attestation in the product life cycle, Anonymous attestation: DAA, EPID and group signatures, Attested authorship
• Read next: Why small devices struggle to be trusted, Attestable computing

Who builds in this area

From our public landscape: NXP EdgeLock SE050, Kudelski IoT, Device Authority, Trusted Firmware, Azure IoT DPS TPM attestation, balena, Medcrypt, Xage Security, Zymbit, Crypto Quantique, ZEDEDA, Mender, Foundries.io, PSA Certified, Caliptra, OpenTitan, lowRISC, ZeroRISC, Infineon OPTIGA TPM, Rambus Root of Trust, Lattice Semiconductor PFR, Axiado, tpm2-software, Trusted Computing Group, TCG DICE Work Group, Keylime, ProvenRun.

Not quite your case? Factory, grid or building equipment? Attested OT. Medical devices in a hospital? Healthcare.

Concepts: Re-attestation · Continuous attestation · Remote attestation · IETF RATS architecture