Cómo la materia genera confianza: identidad de los dispositivos, integridad del firmware y el papel de los operadores

Matter has quickly become the most promising universal connectivity standard for the smart home, bringing together major ecosystem providers, OEMs, and device manufacturers around a single goal: seamless, secure interoperability. But interoperability only works if every device introduced into the home network is trustworthy. That trust depends on three interconnected pillars: device identity, firmware integrity, and secure operational control of the smart home fabric. 

In a recent discussion with Keyfactor’s IoT security experts, these three pillars emerged as essential for understanding how trust is established and maintained in the Matter ecosystem. This blog breaks down each pillar to help OEMs, operators, and ecosystem partners understand what they need to secure, and how Keyfactor supports these requirements at scale. 

¿Qué problema resuelve Matter en los hogares inteligentes?

For years, the smart home ecosystem has been fragmented. Devices from different manufacturers often required unique apps, hubs, onboarding processes, and communication methods. Matter solves this by enabling devices regardless of their brand to seamlessly work together across ecosystems like Apple, Google, Amazon, and many others. 

But interoperability on its own is not enough, users need assurance that devices are authentic, uncompromised, and communicating securely. Matter delivers this assurance by enforcing a security architecture rooted in strong public key infrastructure (PKI). 

Todos los dispositivos Matter deben poder demostrar qué son, de dónde proceden y si su software fiable. La confianza no es algo que se gana una sola vez al incorporarse, sino que debe mantenerse durante todo el ciclo de vida del dispositivo.

Pilar 1: Identidad de dispositivos en Matter: cómo los DAC y los NOC establecen la confianza

To prevent counterfeit or unauthorized devices from entering the home, Matter defines a certificate-based identity model built on two certificate types: 

Certificados de certificación de dispositivos (DAC)

The DAC is a unique, factory-installed certificate embedded in every Matter device during manufacturing. Its role is straightforward but crucial: 

• Prove the device was produced by a legitimate manufacturer 
• Establish an unforgeable root of trust during onboarding 
• Allow the commissioner (the device that adds new Matter devices to the fabric) to verify authenticity 

DAC issuance is a high-volume process. OEMs may manufacture millions of units, each requiring a unique certificate and key pair—generated, protected, and delivered securely. 

Por qué la emisión de DAC debe automatizarse

Manual approaches risk delays, errors, and security gaps. Manufacturers need: 

• Automated, compliant issuance workflows 
• Secure key generation and storage 
• A scalable PKI platform capable of handling high-throughput manufacturing environments 

Keyfactor supports DAC generation through a horizontal PKI infrastructure built for large-scale IoT manufacturing, ensuring certificates are issued and managed consistently across production lines and geographies. 

Certificados de operatividad de nodos (NOC)

Once a Matter device is onboarded, it needs a trusted identity within the home network known as the fabric. This identity is provided through the NOC. 

NOCs are used to: 

• Secure device-to-device messaging 
• Establish trust within the operational network 
• Support encrypted communication 
• Enable post-onboarding lifecycle operations 

Unlike DACs, which are created at manufacturing time, NOCs are short-lived and issued when a device joins or asks to remain on the home network. This requires dynamic, real-time certificate issuance that scales to any household, device fleet, or operator environment. 

Por qué los operadores y los fabricantes de equipos originales confían en la emisión escalable de NOC

Matter fabrics can consist of dozens, or in some deployments, hundreds of interconnected devices. Maintaining trust requires: 

• Fast, reliable NOC issuance 
• Consistency across large, distributed systems 
• Strong lifecycle management as devices are added, removed, or updated 

Keyfactor enables both OEMs and operators to automate NOC provisioning with centralized policies, high-volume issuance, and full visibility into certificate usage across environments. 

Pilar 2: Firma de firmware y arranque seguro: garantía Software en los dispositivos Matter.

Trust doesn’t end at onboarding. Devices must continuously prove that the firmware they run, and any updates received, are legitimate and unaltered. 

Matter devices rely heavily on signed firmware to protect against tampering, malware, and unintended modifications. 

Por qué es importante la firma del firmware

Embedded devices are increasingly targeted by attackers who attempt to: 

• Push malicious firmware updates 
• Exploit vulnerabilities to gain persistence 
• Hijack devices for lateral movement or botnet activity 

To prevent these outcomes, Matter requires: 

• Firmware signing at the OEM level 
• Signature verification before installation 
• Integrity validation during secure boot 

This ensures that only firmware produced and authorized by the OEM can run on a Matter device. 

Retos para los fabricantes de equipos originales que gestionan la firma de firmware

Secure firmware signing is often complex because manufacturers must: 

• Store signing keys in secure cryptographic hardware 
• Prevent unauthorized personnel/tools from signing firmware 
• Maintain audit logs and enforce policies 
• Support distributed development teams and CI/CD pipelines 

Any weaknesses in key protection or signing workflows can undermine the entire trust model. 

El papel Keyfactoren la integridad del firmware

Keyfactor simplifies secure firmware signing by providing: 

• Key protection: Signing keys secured in HSMs or cloud key vaults 
• Policy enforcement: Only approved individuals or systems can sign firmware 
• Workflow integration: Seamless connection to build pipelines and OTA update systems 
• Auditability: Full traceability of when, how, and by whom firmware was signed 

This ensures every firmware release is authentic, tamper-proof, and verifiable by devices during secure boot. 

Pilar 3: El papel emergente de los operadores como pilares de confianza en los hogares inteligentes

Beyond manufacturers, a new and increasingly influential group is becoming central to Matter security: operators. These include: 

• Internet service providers (ISPs) 
• Telecom operators 
• Hyperscale platform providers (“GAFAM”) 
• Large ecosystem administrators 

According to insights discussed in the interview, these organizations will play a critical role in managing trust at the network level. 

Por qué los operadores son la opción ideal para la gestión de la confianza

Operators already maintain infrastructure within households: routers, gateways, modems, and consumer networking equipment. As Matter adoption grows, operators can: 

• Serve as fabric administrators for home networks 
• Issue and manage NOCs at scale 
• Provide consistent trust services across millions of devices 
• Enhance overall consumer security posture 

They don’t need to build devices or apps: Matter solves that. What they can provide is the trust layer that ensures each device entering the home inherits a secure operational identity. 

Por qué los operadores necesitan una PKI escalable

Managing trust across millions of households requires: 

• High-volume certificate issuance 
• Automated lifecycle operations 
• Reliable cloud or hybrid PKI architecture 
• Policies tailored for diverse device ecosystems 

These are all areas where Keyfactor delivers enterprise-grade PKI solutions designed to scale to operator environments globally.  

Qué significa esto para el futuro de la materia y la seguridad doméstica inteligente

Matter represents a shift toward a more trustworthy, more interoperable smart home ecosystem. But achieving that vision requires: 

• OEMs to implement strong device identity and firmware integrity 
• Operators to take on a growing role in administering trust across household fabrics 
• A unified PKI infrastructure capable of supporting both manufacturing and operational security at scale 

Keyfactor is uniquely positioned to support this evolution by providing: 

• PKI for device identity (DAC + NOC issuance) 
• Secure code-signing for firmware integrity 
• Scalable trust infrastructure for operators 

As Matter adoption accelerates, the organizations that succeed will be those that treat trust not as an afterthought, but as an integrated part of the device lifecycle, from production through deployment and ongoing operation.