Do you know Matter?

Matteris a smart home standard developed by the Connectivity Standards Alliance (CSA) that operates in the Wi-Fi and Thread network layers and is expected to become a future industry standard.Amazon,Apple,GoogleBy linking with smart speakers such asIt is expected to be used for white goods, lighting, electronic locks, etc.When more devices are used in the home in the future,Matter compatibleDevices can be easily connected.

Hidden Issues for Matter Standard Compliance

Apart from clear preparations such as participation in the alliance (CSA) and understanding of the Matter protocol, the requirements for compliance with the Matter standard include the security requirements stipulated by the standard = "adaptation to the Common Authentication Infrastructure". Adapting to a common authentication infrastructure requires a cross-organizational response of development/manufacturing/operation on the home appliance manufacturer side, so it will take a considerable amount of time and man-hours before introduction.

Preparations on the side of home appliance manufacturers required for "adaptation to common authentication infrastructure"

Matter utilizes a certificate authority recognized by Matter as a security requirement, and achieves a high level of security by establishing trust between the root certificate authority, the intermediate certificate authority, and the device. For this reason, it is necessary for home appliance manufacturers to utilize certification authorities that meet Matter's required standards, and to establish an operating system for them.

こちらの図は弊社想定のトポロジになります。

Matter's common authentication infrastructure concept

We will explain how certificates are actually used between Matter products and what kind of certificates are required.

DAC (Device Attestation Certificate)

A DAC is an X.509v3 compliant DER encoded certificate as defined in RFC 5280 and MUST be issued by a PAI (Product Authorization Intermediate) that chains directly to an approved PAA (Product Authorization Authority). A product-specific certificate used to certify product identity and software component vendor identity.

NOC(Node Operational Credential)

A node operational credential is a collection of credentials that allow a node to identify itself within the fabric. All certificates included in Node Operational Credentials are RFC 5280 compliant X.509v3 certificates. It must be issued either by a root certification authority that is trusted within the fabric, or by an intermediate certification authority (ICA) that has issued an ICA certificate directly from such a root certification authority.

Solutions provided by Macnica

Adapting to the Matter common authentication platform requires not only preparing a certificate authority, but also considering how to implement certificates. For example, considering implementation and realization under the severe resource limitations unique to IoT devices,considering how to implement Matter certificates during manufacturing and market launch, This includes post-release management.

In addition to that, there are many implementation matters that need to be carried out across the company, such as designing and operating in accordance with security regulations and requirements other than Matter. At Macnica, we are able to provide one-stop support for these issues faced by our customers, from consultation to providing solutions.

  • PKI introduction support (purpose setting, implementation method study, problem investigation, etc.)
  • Support for formulation of certification authority operation rules, operation training
  • Compliant with RE Directive/EN303 645
  • Security support for product production factories
  • Product security risk analysis

Frequently Asked Questions

I would like to know the difference between the company certificate currently in use and the Matter certificate

First, there is a difference in the base of trust (root certificate authority) when using PKI. With Matter, the CSA standardized Root Certificate Authority will certify the certificate. It is speculated that the currently used in-house certificate also has a root certificate authority installed as a base of trust to certify what to whom. At a conceptual level, the two certificates prove different uses.

How much does it cost to comply with the Matter standard?

In addition to the cost of devices that support Matter, there are costs such as the annual license fee of the certification authority, the certificate fee according to the number of certificates issued, and the certification test fee.

I have almost no experience dealing with certificates, but can you help me with basic consultations such as where to proceed?

Yes, of course we can. In the case of PKI / certificate introduction that we have supported in the past, there are also such customers. We also accept consultations on the general framework of product security.