Implementation guide
OWASP AISVS v1.01
Infrastructure, Configuration & Deployment Security · Edge & Distributed AI Security
Edge devices use strong authentication
Verify that edge AI devices authenticate to central infrastructure using strong authentication mechanisms.
OWASP AISVS v1.01, requirement 4.3.1
In plain English
Edge devices that run AI must prove who they are with strong credentials before your central systems will talk to them. Each device should have its own identity, so that one stolen device can be cut off without touching the rest.
What good looks like
- Every device has a unique credential, stored in hardware where the device supports it.
- Central services authenticate the device on every connection.
- A single device's credential can be revoked quickly.
- No shared, default or hard-coded credentials exist in the fleet.
How teams usually do it
- A device certificate per unit with mutual TLS, the private key generated and held in a TPM or secure element.
- A provisioning process at manufacture or first boot that issues the certificate, with automated rotation.
- A managed device identity service, for example AWS IoT Core or Azure IoT Hub with its device provisioning service.
Suggested evidence
- The device identity design and provisioning process.
- The revocation procedure and a record of it being used or tested.
- Server configuration showing client certificates are required.
Common mistakes
- One API key compiled into every device.
- Private keys stored in a plain file on the device.
- No way to revoke one device short of rotating the whole fleet.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.