Device Identity

Status: DRAFT

Current model

The EMS backend registers a device using:

• customer e-mail/account
• Raspberry Pi serial number
• NATS JWT identity
• VPN connectivity/identity

Security interpretation

The Raspberry Pi serial number is useful for:

• inventory
• manufacturing/provisioning correlation
• customer/device ownership binding
• support diagnostics

It is not a secret and must not be used as the only authenticator.

The cryptographic device identity should be based on unique secrets/keys assigned to each device.

Required verification

• every device has a unique NATS NKey/seed or equivalent private credential
• NATS credentials cannot authenticate as another device
• every device has a unique VPN private key/certificate
• device credentials are revocable
• credential rotation procedure exists
• device registration requires proof that the registering gateway possesses its cryptographic identity
• cloned SD/device credentials can be detected/revoked

Recommended future hardening

Consider a secure element for non-exportable device keys in a future hardware revision.