Fleet Device Identity

A logistics company operated thousands of vehicles, each carrying a telematics unit that streamed location, fuel, and diagnostics back to a central platform. Every unit authenticated to the cloud with the same embedded shared secret. If one device was pulled from a junked truck and reverse-engineered, that single secret unlocked the data plane for the entire fleet — and rotating it meant touching every vehicle.

The company needed each device to be its own identity: individually authenticated, individually scoped, and individually revocable.

The challenge

Telematics units are machine actors, but they had been provisioned like a fixed appliance — one credential, baked in, shared everywhere. There was no way to attribute a data stream to a specific unit with confidence, no way to retire a decommissioned vehicle’s access without a fleet-wide re-key, and no policy boundary between a unit reporting telemetry and a unit allowed to receive remote commands.

They wanted device identity managed centrally, with the same rigor applied to human accounts: scoped credentials, lifecycle, and an audit trail.

What Veripass deployed

Veripass modeled each telematics unit as a first-class machine identity within the fleet’s tenant. Every device received its own scoped API key for machine-to-machine traffic instead of a shared secret, so a single unit could be authenticated, throttled, or revoked without affecting any other vehicle. Decommissioning a truck became a one-line revocation rather than a rolling re-key.

Device entitlements were expressed through capabilities and access profiles. A standard unit’s identity carried capabilities to publish telemetry only; units cleared for remote actions — door unlock, immobilizer — carried elevated capabilities gated by context-aware policy. Every authentication and every command request was written to an immutable audit trail keyed to the specific device.

• First-class machine identity per telematics unit within the fleet tenant
• Scoped, per-device API keys for machine-to-machine traffic
• Individual revocation on decommission — no fleet-wide re-keying
• Capabilities and access profiles separating telemetry from remote-command devices
• Context-aware, policy-based authorization for elevated device actions
• Immutable audit trail keyed to each device identity

Because devices were modeled in the same control plane as people, the company could reason about the whole estate uniformly: a remote-command request from a unit was evaluated against policy the same way a sensitive human action would be, and denied if the device’s identity lacked the capability or the context was wrong.

Outcome

The shared-secret blast radius was gone. Compromising one unit no longer threatened the fleet, because each device authenticated as itself with a credential good only for its own scope. Retiring a vehicle took effect immediately with a single revocation, and stale device access stopped accumulating.

For the first time the company could answer, per device, exactly what it was entitled to do, what it had done, and when its access ended — with an immutable trail that treated machines with the same discipline as human identities.