Skip to content
Identity and Access Management

Device Bootstrap

Challenge

Trimble devices deployed in the field often have no credentials to authenticate with cloud services. Today the devices are pre provisioned in back office with device certificates from IAM that creates a challenge when the certificate is expired or due for expiry. A solution is required for devices to get fresh or renew device certificates, while ensuring the following:

  • Only genuine factory-provisioned devices can obtain credentials
  • Devices follow least privilege until they receive device certificates
  • The process scales to millions of devices without manual intervention

Solution

Recommendation is to use “Bootstrap Service” that validates device identity using factory-registered public keys and issues an operational certificate (device credentials).

At the factory

  • Manufacturer generates key pair (private + public)
  • Public key is registered in IAM with the device serial number using device-id-cert-tools

In the field

  • Device sends a CSR signed by its private key to the Bootstrap Service
  • Bootstrap validates against the IAM-stored public key
  • If valid → issues an operational certificate
  • Device use this certificate to obtain device token on successful mtls authentication against TID and communicate with downstream services (EMS, IoT/MQTT)

Workflow

  1. Field devices try to check for its operational cert. If not, devices contact IAM:Bootstrap api with CSR and Serial number. IAM:Bootstrap verifies the identity of the device by verifying CSR with the public key and serial number and issues an operational certificate. With this step, the device can be termed as a “connected device” as it has cloud connectivity enabled.

  2. Device now proves its identity to IAM:TID to get device token

  3. Using device token devices can now talk to any of the cloud apis for which it is authorized. Say for instance, devices can now verify its license against EMS/TLS

  4. Using the same certificate device shall start bidirectional communication using MQTT for real-time connectivity

API Reference

Refer to Bootstrap

Use case

  • Seamless Certificate Renewal and Lifecycle Management