Secure provisioning concepts

Key takeaways

You have designed a secure device with strong authentication and encryption. But how do you get the right credentials, certificates, and configuration onto thousands of devices without introducing security gaps? That is the problem secure provisioning solves. This page explains what provisioning means in IoT, why it is harder than it sounds, and how zero-touch approaches make it practical at scale.

What you'll learn

What provisioning actually includes in an IoT context

Provisioning is the process of giving a device everything it needs to operate securely on its intended network. This includes:

• Network credentials: SIM profiles, APN (Access Point Name) configuration, network keys.
• Device certificates: client certificates for mTLS, CA certificates for server verification.
• Configuration data: reporting intervals, server endpoints, firmware update URLs.
• Device identity: unique identifiers registered in the cloud platform.

Provisioning happens at multiple stages of a device's lifecycle: during manufacturing, at first boot, and sometimes during operation when credentials need to be rotated or the device moves networks.

Why provisioning at scale requires automation

For a prototype or small pilot, you can configure each device by hand. But imagine deploying 50,000 smart meters across a region. You can’t physically touch each one to load certificates and configuration. You need an automated, secure process that works without human intervention at the point of deployment. This is where zero-touch provisioning becomes essential.

How zero-touch provisioning works in five steps

Zero-touch provisioning means a device goes from factory to fully operational with no human interaction after it leaves the manufacturing line. The process breaks into five automated steps:

1. Manufacturing: Identity injection burns the initial cryptographic keys and root identity directly into the hardware, establishing the foundation of trust.
2. Bootstrap attach: The device powers on for the first time and connects to a limited bootstrap cellular network, essentially checking in to say it is online and ready to be configured.
3. Cloud registration: The device introduces itself to your management platform, which verifies it is a legitimate piece of hardware from your fleet.
4. Profile and configuration download: The cloud securely delivers the real operational credentials, such as production APN settings and certificates.
5. Operational: The device activates its new credentials, disconnects from the bootstrap network, and attaches to your production network, fully deployed.

Because the process is automated, you can ship tens of thousands of devices globally and they self-configure securely the moment they power on.

How the SGP.32 eSIM standard orchestrates zero-touch onboarding

The SGP.32 eSIM standard defines a complete zero-touch onboarding sequence:

• Bootstrap attach: The device powers on and connects to a bootstrap network using its factory-provisioned SIM profile.
• eIM registration: The device contacts an eSIM IoT Remote Manager (eIM), which acts as the "remote user" for headless devices.
• eIM association: The eIM verifies the device's identity and associates it with the correct fleet.
• Profile download: The eIM orchestrates delivery of the operational SIM profile, either directly from the profile server (SM-DP+) or indirectly through the eIM for power-constrained devices.
• Profile activation: The device activates the new profile and prepares to switch networks.
• Network switch: The device disconnects from the bootstrap network and attaches to the production network.

A critical safety feature of SGP.32 is automatic rollback: if a device enables a new profile but fails to connect within a timeout, the eUICC reverts to the previous known-good profile. Without this failsafe, a failed profile swap could brick a remote device.

What security concerns you must address during provisioning

• Credential injection at manufacturing: Initial identity and keys must be loaded in a secure manufacturing environment; if they leak here, the whole chain of trust is compromised.
• Transport security during provisioning: Over-the-air credential downloads must be encrypted; SGP.32 uses CoAP over UDP secured by DTLS to minimize radio-on time while staying secure.
• Credential rotation: Certificates expire and keys can be compromised, so a good system rotates credentials without physical access.
• Inventory management: Approaches like SGP.32 enable single-SKU hardware: one hardware variant for global distribution, provisioned with the correct operator profile at the destination, which eliminates region-specific inventory and reduces shipping errors.

How to choose between direct and indirect credential delivery

Once single-SKU hardware streamlines your inventory, you must choose how credentials reach devices in the field. There are two models:

• Direct download: The device communicates directly with the profile server. This suits devices with reliable connectivity and enough processing power, like gateways and routers.
• Indirect download: A cloud-based manager retrieves credentials and holds them until the device wakes up. This is optimized for "sleepy" LPWA devices that may only be online for sixty seconds every twenty-four hours.

The right choice depends on your device's power budget and connectivity profile.

Lesson 6.3 Self-assessment

Frequently asked questions