Identity in IoT

IoT is expanding rapidly as digital transformation spreads across industries and consumer life, connecting “things” (and people) through networks that enable people-to-people, people-to-things, and things-to-things interactions. The ecosystem remains fragmented, yet IoT’s convergence of wireless technologies, micro-electromechanical systems, microservices, and the Internet is breaking down barriers between operational technology and IT, enabling analysis of machine-generated data for operational improvements. Manufacturing illustrates the shift: long-used sensors that once operated only locally are becoming IP-enabled via smart sensors, powering the Industrial IoT.

Security is a central weakness because IoT was largely not designed with protection in mind, and many devices lack the CPU, memory, storage, update mechanisms, and standardization needed for basic identity and security. The 2016 Mirai botnet attack on Dyn—using compromised webcams—demonstrates how insecure devices can be weaponized at scale. Robust device identity, paired with user identity, is presented as foundational for authentication, authorization, traffic control, and protecting sensitive data such as PII in smart healthcare scenarios. However, integrating identities across devices can also amplify risk if weaker components expose shared credentials, especially given common password reuse.

The paper surveys communication constraints (wired/wireless, power, range, protocols like MQTT, REST, XMPP, CoAP, ZigBee), hardware tradeoffs (security capacity versus power consumption), and identity mechanisms including x.509/PKI, FIDO (notably UAF), PUFs (promising but attackable), and secure hardware (Secure Elements and TEEs). Because many devices cannot support full on-device controls, CIAM-driven approaches—especially OAuth 2.0 Device Flow—plus API gateways and representational device models (e.g., ThingShadow) provide near-term paths. Regulatory pressure such as GDPR further elevates the need for fine-grained consent and data export/deletion capabilities.

• IoT connects devices to the Internet and to each other, forming a network of “things,” including people.
• A “thing” can include a person with a heart monitor implant, livestock with a biochip transponder, or an automobile with built-in transponders.
• Manufacturing has used sensors for decades, but many were not IP-enabled and could not communicate beyond local processes.
• The October 2016 Dyn incident involved Mirai botnet malware recruiting internet-connected webcams for a DDoS attack that disrupted major websites for several hours.
• Many IoT devices cannot obtain or protect strong digital credentials, encrypt communications, update firmware, or be remotely inventoried and managed.
• CoAP is an IETF constrained protocol that generally works over UDP and is designed for resource-constrained devices.
• MQTT is an ISO and OASIS standard publisher/subscriber protocol built atop TCP/IP and can use brokers for filtered distribution.
• FIDO assigns different cryptographic keys per user, per device, and per relying party application to preserve privacy.
• GDPR treats email addresses as personal data and requires consent for each use, plus export and/or deletion of consumer data upon request.
• GDPR non-compliance fines can reach up to 4% of global revenues.

• “Just like real estate, location is an important design factor for IoT”
• “As in desktop and server computing, stronger and faster CPUs can enable more robust identity schemes.”
• “Keys and certificates installed at manufacture promote a strong root-of-trust”
• “Identity apps should run in Secure Enclaves or TEEs”
• “The sheer variety in hardware and communication make standardization for identity and security in IoT more difficult than in other computing paradigms”
• “Digital identity can play an important role in protecting both IoT devices and the systems with which they interact.”
• “Identity is the basis for authenticating and authorizing traffic and data transactions.”
• “Authentication and access control at the device level are paramount to securing the devices, their associated data, and even the Personally Identifiable Information (PII) of individuals.”
• “Compromising IoT apps running in the rich OS is trivial, and a good way to provide security assurance for critical apps is to utilize SE and TEE.”
• “The Internet of Things must have digital identity built-in to improve user experiences, privacy, and security.”