The document discusses the challenges of device provisioning in IoT, highlighting the complexities of supply chains and the manual nature of initial configurations. It describes a two-step provisioning process involving enrollment and registration, and outlines features of the Device Provisioning Service (DPS) such as support for multiple authentication methods and device management capabilities. Additionally, it offers a demo for provisioning a device using symmetric key attestation.

1. Device Provisioning
Service
John Chang
Commercial Software Engineering
Microsoft
2019.09

2. Why provisioning
is hard today
• Solutions must have per-device
revocable access
• Provisioning is a manual process
• Initial configuration can become
irrelevant between manufacturing
and deployment
• Device supply chains are complex

4. An IoT device’s relationship to DPS

5. Provisioning
process
• There are two distinct steps with
security flows
• The manufacture step in which the
enrollment information is harvested and
placed in the enrollment list
• The registration step in which the
device phones home to the DPS

6. Automated Device Provisioning
Device
Management
System
2. Return the device information.
1. Create the Enrollment list.
Device Service
Bus
Logic App
ASP.NET Core
(On Device)

7. IoT Hub
IoT Hub
IoT Hub
IoT Hub
Provisioning with DPS
IoT Hub
Device
Device Provisioning
Service
Business logic
“where’s my home?”Identity attestation
Device enrollment info
Register new device,
populate initial configRegistered device info
Registered device info
Establish connection
Initial configuration
Device telemetry
Insights
Device telemetry
…etc

8. Brief feature
overview
• Cross-region, cross-subscription
DPS→IoT Hub connection
• Group and individual enrollment
• Multiple auth methods supported
• Symmetric keys
• TPM endorsement key
• X.509 certificates
• Automatic re-provisioning
• Factory reset
• Migration
• Enrollment-level device assignment logic
• Static assignment
• Evenly weighted
• Lowest-latency (geo-sharding)
• Custom assignment logic

9. Provision with
Symmetric key
attestation
• Represents a "Hello world" experience for
developers who are new to device
provisioning, or do not have strict security
requirements.
• Device attestation using a TPM is more
secure and should be used for more
stringent security requirements.
• Legacy devices may not have a certificate, TPM,
or any other security feature that can be used
to securely identify the device.
• Symmetric key attestation can be used to
identify a device based off information like
the MAC address or a serial number.

10. Demo – Provision Device with
Symmetric key
https://github.com/michael-chi/automate-device-provisioning

11. Code Flow

12. Questions?