Azure IoT Hub with x509 certificate and TPM

0
votes

Following situation: our gateways have a TPM and we are going to provision it with per device certificates (issued by our PKI). How could the IoT Hub authentication work? As far as I know one needs to register the thumbprints of the primary and secondary certificates with the IoT Hub, which is ok. Later on we would like to use the primary certificate to authenticate a device with the IoT Hub. According to the source code of this project one is supposed to provide certificate's private key 

 var authWithPrimaryPfx = new DeviceAuthenticationWithX509Certificate(device.Id, primaryCertSecret);

This is something I would like to avoid. I do not want the private key to be in memory (RAM). Is it possible to hash/encrypt and use the result for authentication? How would it work?

We are going to use Windows 10 IoT Enterprise or Linux (NOT Windows 10 IoT Core)

EDIT: Here https://github.com/ms-iot/security/blob/master/Limpet/Limpet.NET/Limpet.cs is the method (SignHmac) used to create a signature for a SAS Token based on the device's primary key directly in the TPM (2.0). I need something similar with a certificate.

1
azureazure-iot-hubtpm
Have you checked this? – Rita Han
Yes, this is where I saw the usage of the TpmDevice class. The example is Windows 10 IoT Core which we do not use and it demonstrates the usage of a symmetric key (primary). I would like to use a certificate – Helikaon
You can open an issue about certificate supported on TPM. – Rita Han
I will, thanks @RitaHan-MSFT – Helikaon

1 Answers

1
votes

@Helikaon,

You can use the new Azure IoT Hub Device Provisioning Service which is now in public preview to register devices using TPM with IoT Hub. You can find more info here:

https://docs.microsoft.com/en-us/azure/iot-dps/about-iot-dps

Rajeev