IoT Security & Device Management
SIM-anchored device identity, private APN with IPsec backhaul, per-device anomaly detection and over-the-air management - securing connected fleets from the SIM up, from ten devices to millions.
SIM-level
Device identity
IPsec
Private APN backhaul
24×7
Anomaly monitoring
What is IoT Security & Device Management?
Connected devices are the largest and least defended part of most networks. Meters, trackers, payment terminals, cameras and sensors ship with default credentials, rarely receive patches and sit in places no security team can reach. Dollu’s IoT Security & Device Management service uses the one asset every cellular device already carries, the SIM, as the root of trust, and wraps it with private connectivity, traffic analytics and remote management so a fleet can be secured and operated without visiting a single site.
Identity starts on the SIM. Each SIM or eSIM profile is bound to a specific IMEI, so a card removed from a meter and placed in a phone stops working immediately, and every session is authenticated by the network before an IP address is even assigned. Devices attach to a private APN dedicated to your fleet, with RFC 1918 or your own addressing, no internet breakout unless you allow it, and IPsec or MPLS backhaul from our core to your data centre or cloud VPC. Firewall policy per device group defines exactly which hosts and ports each class of device may reach.
Because all traffic traverses our core, we can watch it. Behavioural baselines are learned per device type: how much data a smart meter sends per day, which endpoints a POS terminal contacts, when a tracker normally reports. Deviations such as a sudden data spike, a new destination, a change of IMEI, roaming into an unexpected country or SIM cloning indicators raise alerts and can trigger automatic quarantine, throttling or suspension through the API. Rate plans and data caps add a financial backstop against runaway devices.
Management completes the lifecycle. Our device management platform supports LwM2M and MQTT for constrained devices and OMA-DM for gateways and routers, providing OTA firmware and configuration updates in staged campaigns with rollback, remote diagnostics, reboot and factory reset, and certificate and credential rotation. Fleet policy, connectivity events and telemetry integrate with AWS IoT Core, Azure IoT Hub, Google Cloud IoT and your own back-end through APIs and webhooks, so security, connectivity and operations are managed in the tools your team already uses.
Why choose Dollu for iot security & mdm.
The advantages of buying from a carrier that owns its network, interconnects and operations - rather than a reseller.
Stop SIM theft and misuse cold
IMEI binding, private APN and data caps mean a stolen SIM cannot be used for internet browsing or resold; it simply fails to attach anywhere but its own device.
Shrink the attack surface to zero public exposure
Devices receive no public IP and cannot be scanned from the internet, while outbound traffic is limited to the endpoints you whitelist, so a vulnerable firmware build is far harder to exploit.
Catch compromised or faulty devices early
Traffic baselines flag botnet recruitment, data exfiltration and runaway firmware within minutes, and quarantine stops both the security risk and the bill shock.
Patch fleets without truck rolls
Firmware, configuration and credential updates roll out in controlled waves with automatic rollback, keeping devices in the field for years without site visits.
One platform for connectivity, security and operations
SIM lifecycle, security policy, device management and billing share one portal, one API and one support team, alongside our IoT connectivity and eSIM services.
Capabilities in detail.
Everything included with IoT Security & Device Management - the platform features, options and controls you get from day one.
- 01
SIM-based device identity
Multi-IMSI SIM and eSIM (SGP.32 IoT eSIM) with IMEI binding, SIM lock, PIN enforcement and network-side authentication; optional SIM applet for key storage and certificate signing.
- 02
Private APN and secure backhaul
Dedicated APN with private or customer-provided address space, static IP per device, RADIUS integration and IPsec, MPLS or direct cloud connect from our core to your VPC or data centre.
- 03
Fleet firewall and traffic policy
Per-device-group allow-lists by destination, port and protocol, DNS filtering, blocking of internet breakout by default and time-of-day or roaming-based rules.
- 04
Anomaly detection and automated response
Behavioural baselines per device type; alerts on data volume, destination, IMEI change, location and signalling anomalies; automatic throttle, quarantine or suspend via rules or API.
- 05
OTA firmware and configuration management
Campaign-based updates with canary groups, scheduling, delta packages for low-bandwidth links, integrity verification and automatic rollback on failure.
- 06
Remote diagnostics and control
Signal, cell and session diagnostics from the network side, plus device-side logs, reboot, factory reset and parameter changes over LwM2M, MQTT or OMA-DM.
- 07
Certificate and credential lifecycle
Provisioning of X.509 device certificates at manufacture or first attach, scheduled rotation, revocation and integration with your PKI or cloud IoT platform registry.
- 08
Cloud IoT platform integration
Connectivity events, device state and security alerts pushed to AWS IoT Core, Azure IoT Hub, Google Cloud, ThingsBoard or your own platform via REST APIs, MQTT bridges and webhooks.
- 09
Reporting and compliance
Fleet dashboards, security event history and audit logs; data-residency options in India, the EU, the US and Singapore aligned to GDPR and TRAI/DoT M2M guidelines.
How it works.
From first conversation to live traffic - a tracked, engineer-led onboarding with a named owner at every step.
- Step 01
Design
We map your device types, data flows, cloud endpoints and regions, then define the APN, address plan, backhaul method, device groups and firewall policy.
- Step 02
Provision
SIMs or eSIM profiles are shipped or downloaded with IMEI binding pre-set; the private APN, IPsec tunnels and cloud connectors are built and tested with pilot devices.
- Step 03
Enrol and baseline
Devices enrol into the management platform, certificates are issued and two to four weeks of traffic learning establish per-group behavioural baselines and alert thresholds.
- Step 04
Operate
Run OTA campaigns, monitor anomalies and manage policy from the portal or API, with our 24×7 NOC handling connectivity incidents and security alerts per your playbook.
Who uses this and why.
Typical deployments across carriers, enterprises, platforms and contact centres.
Smart metering and utilities
Millions of low-bandwidth meters on a private APN with SIM lock, delta firmware updates and anomaly alerts for tampering or cloning.
Payment terminals and kiosks
PCI-DSS-aligned segmentation of POS traffic to acquirer hosts only, certificate rotation and remote diagnostics for retail estates.
Fleet telematics and asset trackers
Roaming-aware policy, IMEI binding against SIM theft from vehicles and OTA updates for trackers across borders, integrated with our fleet tracking service.
Connected healthcare devices
Private connectivity for monitors and infusion pumps, encrypted backhaul to hospital systems and audit trails for regulatory review.
Video surveillance and smart city
Cameras, signage and sensors isolated from the internet, with bandwidth caps and quarantine to prevent botnet recruitment.
Industrial gateways and remote sites
Cellular routers at pumping stations, substations and remote plants managed over OMA-DM with IPsec to the OT security stack.
Technical & commercial specifications.
Key parameters at a glance. Ask us for the full service description and SLA document.
| SIM formats | 2FF/3FF/4FF, MFF2 industrial, eSIM (SGP.02, SGP.32); multi-IMSI |
|---|---|
| Identity controls | IMEI binding, SIM lock, PIN, network authentication, X.509 via applet |
| Connectivity | 2G/3G/4G LTE, LTE-M, NB-IoT, 5G; private APN; static or dynamic IP |
| Backhaul | IPsec (IKEv2), MPLS, AWS/Azure/GCP direct connect from Dollu core |
| Policy | Per-group allow-lists, DNS filtering, roaming and time-based rules |
| Detection | Volume, destination, IMEI, location and signalling anomalies; auto-quarantine |
| Device management | LwM2M 1.1, MQTT, OMA-DM; OTA firmware with delta and rollback |
| Integrations | REST API, webhooks, MQTT bridge; AWS IoT, Azure IoT Hub, Google Cloud |
| Scale | From 10 to millions of devices per tenant; multi-tenant for resellers |
| Support | 24×7 NOC; P1 response ≤ 15 min; named account manager |
How Mobile & IoT is priced.
IoT connectivity is priced per active SIM per month with data pooled across the estate; roaming and signalling by usage; device management per device.
We publish the model, not a public rate card - actual rates depend on destination, route class, volume and regulatory cost. See how every Dollu service is priced.
- Per-SIM monthly fee with pooled data across the estate
- Roaming per MB, per minute or per SMS by zone
- Signalling per transaction or per link
- Device management per device per month
- Volume tiers by active SIM count
- Billing
- Monthly per active SIM plus metered usage; postpaid after credit review
- Commitment
- None on usage; committed SIM volumes earn discounts
IoT Security & MDM - your questions answered.
The questions customers and carriers ask us most often before they interconnect. If yours is not here, our team answers within one business day.
Still have a question?
Ask our solutions teamRelated services.
Services customers commonly combine with IoT Security & Device Management.
Secure the fleet from the SIM up.
Share your device types, volumes and cloud platform and we will propose an APN, policy and management design with a pilot kit of SIMs within one week.
