{"id":2915,"date":"2020-05-20T10:19:00","date_gmt":"2020-05-20T08:19:00","guid":{"rendered":"https:\/\/www.basyskom.de\/?p=2915"},"modified":"2020-05-28T15:01:11","modified_gmt":"2020-05-28T13:01:11","slug":"iot-hub-device-provisioning-service","status":"publish","type":"post","link":"https:\/\/www.basyskom.de\/en\/iot-hub-device-provisioning-service\/","title":{"rendered":"IoT Hub Device Provisioning Service, bring your IoT Devices into the Cloud. (Part 4 of 4)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Introduction<\/h2>

While it is possible to fully provision an IoT device during production, there are several problems related to load balancing and selecting an IoT Hub in the geographical region where the device is going be used. It would be helpful if the device would just need to know where to get provisioning information and how to authenticate to the provisioning provider.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t
\n\t\t\t<\/i>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The Azure IoT Hub Device Provisioning Service<\/h2>

\"deviceThe Device Provisioning Service<\/a> is a managed service running in the Azure cloud which supports automatic provisioning of IoT devices for IoT Hub.<\/p>

The following sections will give a short introduction to the most important features of the Device Provisioning Service.<\/p>

Identifying a Device Provisioning Service instance<\/h3>

Every Device Provisioning Service instance is assigned a so called ID scope<\/code> on creation which is unique and does not change during the entire lifetime of the instance. It must be used by the IoT devices when querying the Device Provisioning Service.<\/p>

Enrollments<\/h3>

The basic requirement for provisioning a device via Device Provisioning Service is an enrollment<\/code>.<\/p>

Devices can be enrolled in groups using X.509<\/code> certificates or static keys. This means that all devices having a certificate signed by the same CA or a static key derived from<\/a> the same master key have the right to query provisioning information from the Device Provisioning Service.<\/p>

Individual enrollments are enrollments for a single device. For devices with a Trusted Platform Module (TPM), an individual enrollment can also use TPM attestation<\/a>. This allows a device having a TPM with a certain endorsement key<\/code> to connect to the Device Provisioning Service. Challenge-response authentication is employed to verify that the device really is in possession of the private key<\/code> belonging to the endorsement key<\/code> and at the same time, the device obtains a token<\/code> which is used to retrieve the provisioning data from the Device Provisioning Service as well as for authentication to the IoT Hub.<\/p>

An individual enrollment with TPM attestation is the best way to use the Device Provisioning Service because there is no static key to be stored on the device and no process for creating and renewing certificates is required. The only additional steps required for provisioning a device during production or the end test is to store the ID scope<\/code> of the Device Provisioning Service on the device and to read out the public part of the TPM’s endorsement key<\/code>.<\/p>

The extracted public key is used in a later step to create an individual enrollment for the device in the Device Provisioning Service. This could be made an automatic process, for example in cooperation with an ERP system.<\/p>

The default device twin<\/h3>

The values for the tags<\/code> and desired<\/code> properties of the initial device twin are individually configurable for every enrollment.<\/p>

IoT Hub assignment<\/h3>

The Device Provisioning Service can be linked to several IoT Hubs in different geographical regions.<\/p>

An enrollment can be assigned to one of the linked IoT Hubs or a subset of the linked IoT Hubs based on different policies<\/p>