Digital Trust & Device Orchestration – Simplified for Every OEM
Implement Zero Trust security for IoT/OT devices without the engineering overhead. From GPOS to RTOS, Symmera provides flexible, standards-based lifecycle management from factory to field.
Symmera offers original equipment manufacturers (OEMs) a flexible implementation models (low-coding agent-less, zero-coding utilities or agents) for general purpose operating system (GPOS) and real-time operating system (RTOS) platforms. Our services platform offers end-users multi-vendor and heterogeneous device lifecycle management from factory to field for security, availability, scalability and interoperability in open, closed, air-gapped, mobile, and cellular environments.
End-User Use Cases: Cyber Resilience & Zero Trust Architectures
Secure, scalable, and interoperable device lifecycle management from factory to field.
Identity & Authentication
- Trusted Device Identifiers: Establish trusted initial and local identifiers for every device.
- Robust Authentication: Secure device authentication across heterogeneous environments.
- Secure Onboarding: Streamline onboarding within existing production environments without compromising security.
Certificate & Key Lifecycle Management
- Cryptographic Agility: Complete lifecycle management for both symmetric and asymmetric keys.
- Certificate Lifecycle Management: Certificate management from issuance to renewal and rekeying, with support for local or server-side generation based on hardware constraints.
- Flexible Certificate Types: Support for device, sub-CA, application, join, and OEM certificates to enforce the principle of least privilege.
- PKI Interoperability: Seamless integration with public, private, or enterprise PKI/trusted Certificate Authority (CA) services, including cross-PKI management for OEM licenses.
Secure Field Operations & Communications
- Field Communications: Hardened wired, wireless, cellular, and Bluetooth communications.
- Patch Management: Secure over-the-air/wire updates featuring supply chain provenance and gated workflows for CVE and SBOM introspection.
- Data Protection: Advanced protection for data at rest and in-transit, even over insecure transport protocols like UDP/TCP.
- Cloud Integration: Native integration with public/private hubs and application endpoints such as Azure DPS.
Trusted Data for AI/ML
- Data Driven Insights: Analyze metrics, events, logs, traces, time series data, images, audio, and video.
- Operational Measurements: Empower digital twins for continuous observability and improvements.
- Telemetry and Logs: Secure telemetry and automated application log export to third-party services via brokers.
Global Compliance Standards
Symmera ensures your devices meet the most rigorous security standards and architectural frameworks.
Supported Device Platforms
Command Line Utilities
Command Line Utilities
- RTOS platforms: Sample main application and mTLS client included with source code as a reference for application developers.
- DIN SDK (in C/C++/C#/Java/Go/Rust) low-coding library available for agentless mode. Integrate with line of business applications within 4-8 weeks. Sample DIN utilities provided with source code to illustrate use of 3-5 APIs required for specific use cases (e.g., certificate lifecycle management, symmetric key lifecycle management, device updates, device multi-modal data export for AIoT, sign/verify content with signature manifest, Azure DPS device registration, application endpoint discovery).
- Symmera provides developer quick-start guides, technical workshops, videos, and professional services to accelerate integration at no charge to the OEM.
- The estimated integration effort on RTOS platforms is based on completed integrations with sample applications on the reference boards.
- The RTOS endpoint agent plugin memory usage is ~103KB (code) and ~113KB (data).
- The Linux (Ubuntu x86/64) endpoint agent plugin memory usage is ~977KB (code) and ~174KB (data). The sizes may vary slightly for ARM 32/64-bit builds and Linux variants.
Benefits to OEMs
Built on Standards, Ready for Any Environment
The “OEM Win”
Did you know? Symmera offers zero licensing costs to OEMs and supports integration with any third-party protocol stack, meaning you can provide high-tier security to your customers without increasing your Software Bill of Materials (SBOM) costs.
At Symmera, we value your business model. The global IoT/OT devices market represents a multi-hundred-billion-dollar total addressable market (TAM), with industry forecasts projecting a strong double-digit CAGR over the coming years, driven by accelerating digital transformation, industrial automation, and the convergence of information technologies (IT) and operational technologies (OT). We are pleased to offer a royalty-based incentive structure that rewards device manufacturers with competitive, performance-linked returns tied directly to product adoption and long-term market success.
Standards You Can Trust
Built on proven open standards (e.g., NIST 800 Series, RFCs: DNS, DHCP, TLS, IPsec/IKEv2, EAP, X.509, Pre-Shared Keys, PQC) and global security frameworks, ensuring interoperability, compliance alignment, and long-term future readiness.
Stronger Device Identity, Out of the Box
Revolutionary device two-factor authentication method delivers advanced protection using DHCP address pools, DNS/DNSSEC or SIM based root of trust, and a rotatable device-unique authentication key.
Flexible Integration – Your Way
Choose what fits your engineering model:
- Zero-code deployment with endpoint agent or utilities
- Low-code APIs in C, C++, C#, Java, Go, Rust, and more for agent-less integration
Complete Key & Certificate Management
Support for symmetric keys, PSKs, PKI, Bluetooth key management, and post-quantum readiness – all within a single framework.
Certificate Authority (CA) Agnostic by Design
Integrate seamlessly with private, public, enterprise, or zero-PKI environments (for legacy devices requiring use of enterprise managed self-signed certificates) – without vendor lock-in.
No Rip-and-Replace
Works seamlessly with any third-party protocol stack (e.g., OpenSSL, MbedTLS, Cyclone SSL, wolfSSL, Bouncy Castle SSL, Windows .Net SSL).
Cross-Platform and Processor Support
Compatible with Linux, Windows, and RTOS environments (e.g., FreeRTOS), across architectures such as x86-64, ARM (32/64-bit), and ESP-32.
Lower Engineering Overhead
Simplified engineering effort with no complex key and certificate management protocols to learn or code (e.g., EST, SCEP, CMP, ACME, lock-in with vendor specific REST APIs)
Ease of Validation
Validate end-to-end functionality in a hosted sandbox before going to production.
Quick-Start Integration Steps for OEMs
The estimated integration timeline ranges from 2 to 12 weeks depending on the selected implementation model.
Flexible Implementation Models
Modular Integration Options Designed for Every OEM Platform
Option 1: Zero Coding Utilities
- Command line utilities for Linux and Windows platforms (e.g., device registration, key/certificate/update management, sign/verify content, export metadata)
- No modifications to line of business applications or OEM device update method
- Manual actions on the device (shell) or build custom automation scripts
Option 2: Zero-Coding Endpoint Agent for GPOS Platforms
- Installable aftermarket endpoint agent for GPOS platforms (e.g., Linux and Windows)
- No modifications to line of business applications or OEM device update method
- Notifications to applications for key/certificate renewal or over-the-air/wire device update events
- Simple to implement across device families
- Requires in-field endpoint agent updates
Option 3: Low-Coding Endpoint Agent Plugin for RTOS Platforms
- Plugin endpoint agent module for RTOS platforms (e.g., FreeRTOS)
- No modifications to line of business applications or OEM device update method
- Notifications via callbacks to application for key/certificate renewal or over-the-air/wire device update events
- Lightweight and quick integration (within 4-8 weeks)
Option 4: Low Coding APIs (Agent-less)
- APIs in any programming language (e.g., C, C++, C#, Java, Go, Rust)
- Works seamlessly with any third-party protocol stack (e.g., OpenSSL, MbedTLS, Cyclone SSL, wolfSSL, Bouncy Castle SSL, Windows .Net SSL)
- Works over any GPOS or RTOS (e.g., Linux, Windows, FreeRTOS) platforms
- Only 1 API to register device
- Only 3-5 APIs for certificate or key lifecycle management
- Only 3 APIs for device update management without any modification to OEM update method
- Only 1 API for device metadata export (e.g., telemetry, logs)
- Helper APIs for optional features
- APIs for data encryption and signing over TCP/UDP communications using pre-shared keys
- Sample application templates (TLS client/server, TCP/UDP client/server)
- Command line utilities provided with source code
- Lightweight and quick integration with line of business application (within 4-8 weeks)
- Low memory and storage footprint (on resource constrained platforms)
- Low battery usage with configurable settings for refresh intervals
OEM Challenges
- No local secure element for key protection on brownfield and low-cost greenfield devices
- No ubiquitous solution for resource constrained and resource slack device families
- Inadequate resources (compute, memory, storage) for PKI key and certificate life cycle management on resource constrained devices
- No writable storage to renew and persist keys/certificates on flash/HDD
- Battery usage limitations and controls on devices
- Long-tail engineering and maintenance cycles for integration with PKI services, security protocols, and crypto engines
- Managing cross-PKI systems from manufacturing (at factory) to onboarding (in the field)
- Increase in software bill of materials (SBOM) cost and supply chain risk without revenue gain
End User Challenges
- High cost of PKI buildout and sustenance (NRE services and recurring annual charges)
- High TCO to manage the supply chain of device identities, and key/certificate lifecycle
- Dichotomy between IT/OT workflows poses challenges for NOC/SOC/field operators
- Unclear return on investment (ROI) for device owners without extensive application re-engineering to use operational certificates broadly (from onboarding to provisioning and field operations)
- Lack of in-house resources with requisite technical knowhow for IT/OT convergence
- The build versus buy decision: “R&D with open-source” or “evaluate and buy a commercial solution”
OEM and End-User Impasse
- Major decision forks in the road for stakeholders
- Certificate (PKI) versus Key (PKI less) based identity for device authentication
- Agent versus Agent-less solution for ubiquity
- OEM pushback on installing and supporting certificates and third-party/aftermarket agents
- Application engineering for certificate-based authentication over secure transport protocols (e.g., TLS, IKE/IPsec, EAP) and use of cryptographic libraries for tokenized access controls (e.g., JWT, SAS)
- Support for heterogeneous device platforms and OEMs
- Pricing for device certificates expensive despite SaaS models
- On-premises fulfillment is a challenge and requires solution engineering by end-users for integration with ecosystem services and interoperability between brownfield and greenfield devices
- Cloud platform lock-in with vendor specific SDKs that requires extensive engineering by OEMs on GPOS & RTOS platforms
- Quantum-safe PKI is a major implementation challenge on resource constrained devices (with multi-schema signatures and large certificates)