Programmatically regenerate primary key of an existing IoT device

Question

I have a requirement to rotate the access key of my IoT devices periodically. Let say each device should rotate their key every year, started from the registration date. In my use case, I don't wish to rotate the access key of all devices in same batch. It should instead performed one by one.

I understand that IoT Hub provides primary & secondary keys for each device, in case we wish to perform key rotation, however with this approach the device will have to try both keys right? Also, at some point of time still we need to find a way sync the new key to the device?

I wish to build an app to programmatically trigger the regenerate of primary key, get the latest key and pass it down to the IoT device (well, I will have my way to pass it down). So my device shall always use only the Primary Key, and ignore the secondary key.

My question here is, does the Azure IoT SDK provide a way for us to programmatically regenerate the primary key only for a particular device? Or any alternative way to achieve that?

Answer 1

Hello @John Wong Yek Hon ,

welcome to this moderated Azure community forum.

Each Azure IoT Hub Device has its own credentials.

For a symmetric key, a primary and secundary key are provided.

You need to renew the keys yourself, for each device separately.

Here is a working C# example:

var rm = RegistryManager.CreateFromConnectionString("[connectionstring]");
var deviceId = "testDevice";

var device = await rm.GetDeviceAsync(deviceId);

var primaryKey = Guid.NewGuid();
byte[] primaryKeyBytes = Encoding.UTF8.GetBytes(primaryKey.ToString());
string base64PrimaryKey = Convert.ToBase64String(primaryKeyBytes);
device.Authentication.SymmetricKey.PrimaryKey = base64PrimaryKey;

device = await rm.UpdateDeviceAsync(device, true);

You need to generate the key based on a GUID and update the device via the RegistryManager.

This class is available in the Azure Devices server SDK.

<PackageReference Include="Microsoft.Azure.Devices" Version="1.39.1" />

---

If the response helped, do "Accept Answer". If it doesn't work, please let us know the progress. All community members with similar issues will benefit by doing so. Your contribution is highly appreciated.