A hardware-locked identity for every device.
TPM 2.0 locks a secret key inside the chip, and it never leaves, so only genuine devices connect to your network, cloud or services.
A name that can't be faked, borrowed or stolen
No cloning
Copying the firmware or disk to another device doesn't copy the identity.
No shared secrets
Each device has its own key, so one compromised device doesn't expose the others.
Zero-touch provisioning
Devices can enroll themselves securely without anyone typing in credentials.
Revocation
If a device is lost or retired, you revoke its certificate and it's locked out.
Where it usually gets hard
Doing this by hand means working with the TPM Software Stack (TSS), key hierarchies, authorization policies and certificate provisioning. That's a steep learning curve for most teams, and EnactTrust removes it.
What's actually happening
Keys never leave the chip
The TPM holds private keys that never leave the chip. Because the key is locked in hardware, copying the software or the disk to another device doesn't copy the identity.
Endorsement Key
The Endorsement Key (EK) is typically installed by the manufacturer and comes with a certificate. The EK does not sign things - signing is done with the device's identity keys.
IEEE 802.1AR identities
The device can have identity keys, such as IDevID and LDevID under the IEEE 802.1AR standard, which act as its permanent digital passport.
Standard protocols
In practice this usually happens inside standard protocols, for example mutual TLS (mTLS) with a TPM-backed client key, or TPM-based device enrollment during cloud onboarding.
Start with a conversation
Strong Identity is available on request. Every project starts with a conversation with a TPM engineer about your devices and requirements.
Book a discovery call