The ECC608 TrustMANAGER is part of the CryptoAuthenticationTM family. It's a secure authentication IC that's preconfigured and pre-provisioned with birth credentials. In others words, credentials needed to initiate the connection to the keySTREAM SaaS secured by Kudelski IoT. Once the first connection has been established with keySTREAM birth credentials, the SaaS will in-field provision the necessary custom certificates into the ECC608 TrustMANAGER. Afterwards,the keySTREAM SaaS will management the lifecycle of the certificate chain (expiry date, rotation, revocation, refurbish).

Before performing the in-field provisioning, the system needs a root CA to be created. keySTREAM offers a self-service fully automated custom root CA creation, hosted and secured in Kudelski HSM.

In addition to the custom root CA creation, the associated leaf certificates are also created in the keySTREAM secure HSMs before being in-field provisioned in the ECC608 TrustMANAGER.