Home▸IoT & Smart City▸IoT Device Authentication: PSK vs Certificate vs TPM

IoT Device Authentication: PSK vs Certificate vs TPM

Interactive 3D simulator of IoT fleet authentication: compare pre-shared keys, X.509 certificates and TPM/secure-element-backed keys under a credential-leak attack, and watch scheduled key rotation revoke stolen secrets in real time.

IoT & Smart City3DModerate60 FPS📱 Mobile-adapted

A ring of IoT devices continuously authenticates against a central gateway using one of three real-world credential models — a shared pre-shared key, a software-held X.509 certificate, or a private key sealed inside a TPM / secure element. Triggering a simulated credential leak marks a subset of the fleet as compromised and reveals the actual security difference between the methods: PSK and software-certificate secrets keep authenticating successfully as an attacker until the next scheduled key rotation revokes them, while a TPM/SE-backed key never leaves its hardware in the first place, so a cloned device can never complete the handshake at all. Live readouts track authentication success rate, handshake latency and the countdown to the fleet's next key-rotation cycle.

⚙ Under the hood

Interactive 3D simulator of an IoT device fleet authenticating against a gateway with pre-shared keys, X.509 certificates or TPM/secure-element-backed keys, showing how a simulated credential leak stays exploitable until scheduled key rotation revokes it — except for TPM-sealed keys, which are never exposed at all.

iotauthenticationtpmcertificateskey-rotationcybersecurity

3D · Three.js / WebGL renderer · 60 FPS target · runs fully client-side, no install