In general, most of the leading IoT cloud service providers support X.509 certificate-based, mutual authentication between device and cloud. This authentication method has become more or less a standard for Public Key Infrastructure-based (PKI) security in the connectivity between IoT devices and the cloud. Not only does this type of authentication provide a good level of security for the communication between device and cloud, but it also allows administrators to revoke any malicious devices, in case of a security compromise, without affecting the entire fleet of devices.

This, however, results in a time-consuming process at the manufacturing level, since generating and programming per-device certificates is complicated. Additionally, since the manufacturer has to manage the cryptographic material associated with this process, the cryptographic key management is bound to pose difficulties to customers.

Espressif has a better solution to this problem. It now provides its customers with securely pre-provisioned modules which have a public key infrastructure already installed in them. The modules come pre-programmed with the private key and device certificate. To further ensure the invulnerability of the cryptographic material, the private key is securely generated and remains encrypted in the flash, while the plaintext access to it is restricted only to the authenticated application.

Espressif provides this service for all ESP32-based modules, including all variants of ESP32-WROOM and ESP32-WROVER. Espressif’s pre-provisioned modules allow customers to reduce manufacturing complexity. By ordering securely pre-provisioned modules from Espressif, customers will be able to connect their products to the cloud with ease and peace of mind.

For further information on Espressif’s new Module Pre-provisioning Services (MPS), please contact our Business Support department.