Skip to main content
For the complete documentation index, see llms.txt.

Hubble Network developer documentation: integrate Bluetooth devices with terrestrial and satellite connectivity.

Provisioning Devices at Scale

There are several possible methods for provisioning your devices with the Hubble device keys at scale, which allows for flexibility when managing key integration.

Common provisioning practices for secure key management:​

  1. Online Production Line or OEM Integration
  2. Offline Key Management and Provisioning
  3. Field Provisioning
  4. Customer-Defined Hybrid Approaches

Online Production Line or OEM Integration​

This method integrates provisioning directly into the manufacturing or production line process, ensuring secure and efficient deployment at scale. Devices are programmed during manufacturing or assembly using specialized hardware interfaces and automated scripts.

Steps:​

  1. Hardware Connection: Devices are connected to a provisioning system via interfaces such as pogo pins, USB, or fast-release cables.
  2. Firmware Flashing: The provisioning system flashes the firmware, embedding the Hubble BLE advertisement packet structure as specified by the Hubble Zephyr library.
  3. Authentication: OEM or contracted manufacturing partner leverages the customer-specific authentication credentials.
  4. Key Retrieval: The provisioning system connects to Hubble Network Cloud APIs over HTTPS to request a unique AES-256 key for each device.
  5. Secure Key Programming: The retrieved key is programmed into the device's non-volatile memory, often protected by hardware security modules (HSMs) or secure elements to prevent tampering.

Why Use This Approach?​

  • Ensures keys are securely provisioned in a controlled environment.
  • Automates large-scale deployment with minimal human error.
  • Reduces security risks by embedding keys before the device leaves the production line.

Offline Key Management and Provisioning​

This method allows customers to provision devices in environments where direct access to the Hubble API is not feasible or not preferred. Keys can be pre-generated by the customer and distributed to the manufacturing partner offline for later association with devices during provisioning.

Steps:​

  1. Key Generation: The customer uses the Hubble Network Cloud APIs to pre-generate a batch of unique AES-256 keys.
  2. Offline Key Distribution: The keys are exported to a secure file format (e.g., Excel or CSV) and shared with the OEM or contracted manufacturing partner through a secure channel.
  3. Device Programming: During production, the manufacturing partner uses the offline key file to program each key into the corresponding device. The association of keys with devices is logged in the file.

Why Use This Approach?​

  • Flexibility: Enables provisioning in environments with limited or no internet connectivity and without sharing authentication credentials externally.
  • Scalability: Supports bulk provisioning without requiring real-time API access.
  • Security: Keys are distributed securely, reducing risks associated with direct API exposure during production.

Field Provisioning​

This method is suitable for devices that are already deployed or need provisioning outside the production line, using Over-the-Air (OTA) updates or local reprogramming.

Steps:​

  1. Initial Setup: Devices are either locally connected via Bluetooth or other interfaces, or receive updates through OTA mechanisms.
  2. API Integration: The provisioning system communicates with Hubble Network Cloud APIs to securely retrieve AES-256 keys.
  3. Key Installation: Keys are installed onto the device secure memory through the local connection or OTA firmware update.
  4. Verification: Post-provisioning, the system verifies that the keys and firmware have been correctly updated.

Why Use This Approach?​

  • Ideal for retrofitting existing devices or provisioning devices in remote locations.
  • Provides flexibility for customers to deploy keys as their infrastructure supports.
  • Minimizes logistical challenges of recalling devices for provisioning.

Customer-Defined Hybrid Approaches​

Customers may implement custom workflows that combine aspects of the above methods, tailored to their operational and infrastructure needs.

Examples:​

  • A customer might perform initial provisioning at the OEM level but rely on production line integration for key updates.
  • For devices in the field, customers may use secure key injection devices to program keys locally while maintaining security standards.

Why Use This Approach?​

  • Offers the greatest flexibility, allowing customers to optimize provisioning workflows for their unique scenarios.
  • Ensures compatibility with diverse hardware configurations and use cases.