Preloading product-specific DACs into Matter modules can turn identical hardware into multiple dedicated module variants, increasing procurement complexity, inventory costs, and production rework for OEMs. Learn how delaying DAC provisioning and issuing certificates on demand can improve module flexibility.
An OEM developing 10 Matter products may use exactly the same module across all of them. Yet differences in device identity configurations can mean purchasing and managing several separate module variants.
One reason is that modules may already have been provisioned with product-specific Device Attestation Certificates (DACs) before leaving the module factory.
For OEMs, this adds work to purchasing and inventory management. It can also make product changes and production planning more difficult.
A DAC serves as proof of a Matter device's identity. Each device must have its own unique DAC and corresponding private key. The certificate contains a Vendor ID (VID) and may include a Product ID (PID) to identify the manufacturer and product.
Consider products A and B, which use the same chip, PCB, and base firmware. If the modules have not yet been provisioned with product-specific DACs, the OEM can allocate them to either product based on actual orders. But once a module has been provisioned with a DAC intended for product A, it may no longer be directly usable for product B.
The hardware is identical, yet the modules must be ordered and stored separately. As the number of products increases, so can the number of product-specific module variants.
Compared with general-purpose modules, customized modules also tend to have longer production and delivery lead times, requiring more advance planning for procurement and manufacturing.
Of course, DACs are not the only factor affecting whether modules can be shared across products. Firmware configurations, PAI certificate chains, and Certification Declarations (CDs) can also determine whether a module can be used directly in different products.
Changes to product plans are common as devices move from development into mass production. For example, an OEM may have already purchased a batch of modules but later decide to use some of them in a different product.
If the modules already contain DACs and other security data associated with product A, they cannot simply be reassigned like general-purpose modules.
This becomes particularly challenging when secure boot has been enabled and secure debugging configurations have been finalized. The chip's security mechanisms may restrict changes to the stored data or prevent reprogramming.
The OEM must then determine whether the modules can be reworked, whether additional testing is required, or whether they can still be used at all.
What started as a simple change in product planning may lead to additional rework and procurement, potentially delaying production.
For OEMs developing multiple Matter products, the more product-specific modules they prepare in advance, the more complicated procurement, inventory, and production planning become.
For OEMs using the same module across multiple products, one option is to move DAC provisioning to a later stage of production.
The module manufacturer can first program the common firmware and complete basic testing, leaving product-specific DACs unprovisioned. Once the OEM confirms a production order, the required DACs can be issued and provisioned according to the product configuration.
This allows OEMs to purchase general-purpose modules without assigning them to specific products in advance. Device identities can instead be provisioned according to actual production plans, reducing the procurement and inventory pressure associated with maintaining product-specific module variants.
However, delaying DAC provisioning also requires appropriate certificate issuance, factory authorization, and production record management.
Device identity management becomes more complex when an OEM works with multiple products, suppliers, and factories. Each product requires the appropriate device identity, and factories must provision those identities according to the OEM's authorization.
Snowball Technology's OnBoard™ IoT Security (OBIS) platform supports on-demand, real-time DAC issuance, production authorization, and traceability management.
Instead of preparing large quantities of product-specific modules in advance, OEMs can provision device identities according to actual production orders.
OEMs can authorize designated factories for specific production tasks, allowing each factory to provision device identities within its approved scope.
The platform can also link production records from module programming through final product shipment, making it easier for OEMs to look up the certificates, production batches, and operations associated with each device.
If you're preparing for secure Matter device mass production, we'd be happy to discuss your requirements.
