Factory Provisioning of Device Identities & Credentials

At its core, our device identity provisioning solution is a system for securing delivering individualized identity data and credentials to devices being manufactured in a factory. What sets it apart from competing offerings is the value-added advantages it offers:

• comprehensive protection and management of secure device data
• extensive deployment support
• vast expertise in protecting and managing a security-critical infrastructure

We take care of the complementary logistics so you don’t have to.

Comprehensive Protection and Management of Secure Device Data

Many electronics products, such as mobile devices, cable modems, set-top boxes, require pre-installed individualized device identity data and digital certificates to enable security functions. If the secret data that gives devices their unique identities is leaked, rogue devices can be created to impersonate genuine, compliant devices. Data entrusted to such rogue devices, such as commercial entertainment content, can be stolen. To learn more about the importance of digital supply chain security, see our blog post on the subject.

We provide comprehensive and fully managed supply-chain device identity provisioning services with multiple layers of encryption and integrity checks, so that even if any specific network node or encryption layer is compromised, the overall supply-chain security is still intact. All the hardware and software elements of our identity provisioning system are provided by and fully managed by CommScope Sentry™, whose team of experts have experience spanning three decades in end-to-end cryptographic identity provisioning.

Unauthorized duplication (cloning) of device-unique credentials can undermine the effectiveness of device authentication and subscriber authentication. To combat this threat, anti-cloning measures are deployed at every step of the provisioning process, from the time device-unique credentials are generated or acquired all the way through their installation into the target devices. Our system ensures that each set of device credentials is provisioned into a single target device.

Our system has been engineered to provide very high provisioning capacity. Currently it interfaces with hundreds of secure factory servers deployed at 30+ sites across over a dozen countries, with enough capacity to provision 30+ billion sets of device data annually. Capacity can be scaled to support even higher volumes if needed.

• Argentina
• Brazil
• Canada
• Chile
• China
• India
• Indonesia
• Mexico
• Philippines
• Singapore
• Taiwan
• USA
• Vietnam
• plus others

Storage and processing elements of our credentials generation and import system are housed in a state-of-the-art secure facility protected by multiple layers of physical security controls. Housed inside this facility is a PKI infrastructure, including certificate authorities that undergo annual audits for compliance with WebTrust security requirements. This infrastructure

• generates X.509 certificates used for SSL/TLS, IPsec, DOCSIS cable modems, MediaKind set-top boxes and many more secure interfaces;
• generates proprietary conditional access credentials and unique symmetric keys installed into secure chips; and
• imports credentials from third-party licensing authorities, including DTCP, HDCP, Netflix, Widevine, Marlin and many more.

This provisioning system provides real-time inventory monitoring of identity data sets that are consumed as devices are made. And it can generate standard and customized reports. Our experience has shown that customized reports can be invaluable in troubleshooting manufacturing problems.