13.6.1: Device Identity and Authentication

A fundamental governance question is “How do we trust that a device connecting to our cloud is the device it claims to be?” Unlike users, devices cannot type passwords or use interactive logins, so IoT systems rely on cryptographic identity for devices. The best practice is to provision each device with a unique identity credential at manufacturing or onboarding time. This could be an X.509 certificate with keys stored in the device, or a symmetric key stored in a secure element on the device. Public key infrastructure (PKI) is heavily used: for example, AWS IoT Core requires devices to present an X.509 client certificate signed by a trusted Certificate Authority to authenticate – once verified, the device assumes the IoT “Thing” identity tied to that cert in AWS IoT. Azure IoT Hub similarly supports X.509 certs or symmetric keys per device (with keys derived for SAS tokens). The device identity is associated with an entry in a device registry in the cloud (which often stores metadata like device type, owner, etc.).

Robust identity governance means managing the full lifecycle: issuing credentials, storing them securely on the device (hardware security modules are ideal to prevent extraction), rotating or revoking them if needed (for instance, if a device is decommissioned or compromised, its certificate should be revoked so it can no longer connect). IoT platforms provide features like certificate revocation lists or automated rotation policies. For compliance, especially in industrial or medical contexts, traceability of device identity is required – you should be able to trace which physical device corresponds to which digital identity and vice versa (often via serial numbers mapped to certificate IDs).

---