Authentication answers “who are you” and must happen in both directions. The device proves itself to the platform, usually with an X.509 certificate during the TLS handshake, a pre-shared key, or a token; the platform proves itself to the device through its own certificate so the device cannot be lured to a fake server. Users authenticate to the application layer with passwords, tokens or single sign-on.
The weakest designs use one secret for all units or ship with default credentials the owner never changes; both have fed real botnets. Authentication is also distinct from authorization: proving you are device 17 says nothing about whether device 17 may publish to a topic belonging to device 18, and platforms must check both. IoT security fundamentals covers the mechanisms.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.