IoT PKI
The MTG IoT PKI enables the secure and scalable creation of digital device identities during the manufacturing process. It supports manufacturers in automatically integrating certificates into devices, thereby establishing a trusted foundation for later operation. The system is designed for industrial series and mass production and supports high production volumes with short cycle times.
During development and manufacturing, devices receive their firmware and operating parameters. Serial numbers and manufacturer identifiers are assigned. In the pre-personalization phase, each device receives its unique identity by requesting a certificate from the MTG IoT PKI.
The device generates its secure, unique key pair. A certificate signing request is then created and transmitted to the MTG IoT PKI “Production“.
After validation, the IoT PKI issues the corresponding initial device certificate, which is installed directly on the device. As a result, every device can be uniquely identified and authenticated with its certificate even before leaving the factory.
The entire process is fully automatable and scalable and designed to support very high production volumes with short cycle times.
Device certificates have defined validity periods. These must align with the planned operational lifetime of the device and the applicable security requirements. Best practice recommends certificate lifetimes of two to seven years.mBefore operational use, the device certificates must be replaced within this period by new certificates from the organization’s own corporate PKI. This takes place via device management, which requests and issues new certificates from the corporate PKI through standardized interfaces such as EST or CMP. Device management ensures that these certificates are renewed in time before their respective validity period expires. Without renewal, the devices lose their communication capability after the certificate validity period expires and therefore their functionality. Usually, they can then only be replaced or brought back into operation with considerable effort.
End-to-end communication security made easy: LwM2M uses EST for full automation during live operation.
Reliable integration of IoT devices into device management via LwM2M lays the foundation for end-to-end communication security. This requires certificates from a trusted PKI. This critical process can be automated directly with the connected MTG Corporate PKI: certificates can be regularly updated during live operation using the EST protocols defined in LwM2M (RFC 7030 & RFC 9148).Another key security aspect is also addressed: private keys can be generated directly on the SMGW and never leave the device at any point during the key lifecycle. The result: enhanced operational security, automated device management, and maximum scalability for your infrastructure.
In modern device production, the trend is increasingly toward the combined use of Public Key Infrastructure (PKI) and a Key Management System (KMS). The PKI provides identities and certificates. The KMS handles the secure generation, storage, management, and use of cryptographic key material.
With the MTG IoT KMS, MTG offers the appropriate complement to the MTG IoT PKI. Both solutions interact seamlessly and enable a consistent security architecture for keys and certificates.
This holistic approach is the central idea of the MTG ERS® architecture. It ensures that identities and keys are managed in a consistent, secure, and scalable way throughout their entire lifecycle.
With certificates from the MTG Corporate PKI, industrial communication networks, machine control systems, and connected production environments can be reliably secured. Against the background of regulatory requirements such as NIS2, the Cyber Resilience Act, or IEC 62443, it supports the technical implementation of security requirements for authentication, integrity, and encrypted communication and creates the basis for compliance and auditable security structures.
Industrial communication standards such as OPC UA can also be fully integrated with the MTG Corporate PKI and use certificate-based authentication and encrypted communication in accordance with industrial security requirements.
Certificates enable strong authentication, protected machine communication, and digitally signed software updates. In this way, rollout, remote maintenance, global production control, and maintenance processes are implemented securely and efficiently.
The architecture also supports hybrid encryption methods and post-quantum cryptography in order to protect industrial systems against future threats in the long term.
For further information feel free to contact us!