The IoT Hub platform assigns a unique ProductID to each created product. Users can customize the Devicename to label the equipment. The product label, equipment label, and equipment certificate/key are used to verify the legality of the equipment. When creating a product, users need to select the equipment authentication method. During equipment access, users need to report product, equipment information, and key information according to the specified method. Only after authentication can the equipment connect to the IoT Hub platform. Due to different user equipment resources and security level requirements, the platform provides various authentication schemes to meet different usage scenarios.
IoT Hub provides the following three authentication schemes:
Certificate authentication (device-level): it assigns a certificate + private key to each device and uses asymmetric encryption to authenticate the access. You need to burn different configuration information for each device.
Key authentication (device-level): it assigns a device key to each device and uses symmetric encryption to authenticate the access. You need to burn different configuration information for each device.
Dynamic registration authentication (product-level): it assigns a unified key to all devices under the same product, and a device gets a device certificate/key through a registration request for authentication. You can burn the same configuration information for the same batch of devices.
The three schemes have their own pros and cons in terms of ease of use, security, and device resource requirement. You can comprehensively evaluate them and choose the most appropriate one according to your own business scenarios. They are as compared below:
Feature | Certificate | Key Authentication | Dynamic Registration Authentication |
Burned device information | ProductId, Devicename, device certificate, device private key | ProductId, Devicename, device key | ProductId、Devicename、ProductSecret |
Whether device creation is required | Mandatory | Mandatory | Support automatically creating based on the Devicename carried in the registration request |
Security | High | General | General |
Use Limits | Up to 1 million devices can be created under a single product | Up to 1 million devices can be created under a single product | Up to 1 million devices can be created under a single product, users can customize the upper limit of devices automatically created through registration requests |
Device resource requirement | High, with TLS support required | Moderately Low | Low, with only AES support required |