An Experimental Approach for Establishing TLS Trusted Channels with Device Identification in IoT Environments

Internet of Things technologies continue to expand rapidly, and one of the most critical challenges is reliable device identification and authentication within the IoT networks. Although Trusted Platform Modules (TPMs) are commonly used to establish a hardware root of trust, their integration into IoT and embedded devices is often unfeasible due to limitations in physical space, power consumption, and computational capabilities. This work proposes an alternative approach for secure device identification that does not rely on dedicated TPM hardware. Instead, it leverages DICE (Device Identifier Composition Engine), a framework proposed to deliver cryptographically strong device identity used along with lightweight cryptographic mechanisms and softwarebased trust anchors. As root of trust, the system integrates the MARS (Measurement and Attestation RootS) framework, a TCG architectural framework specifically designed for constrained devices. We develop a prototype and an experimental implementation that simulates a secure TLS-enabled MQTT (Message Queuing Telemetry Transport) communication channel between an IoT device and its broker. In this use case, device identification is performed through the establishment of a TLS-PSK (Pre-Shared Key) channel, where the pre-shared identity key serves both as an attestation and identification key, enabling thus an implicit attestation process during the secure session setup. Through experimental tests, we measure the device boot time, the key derivation time, and the time required to complete the TLS handshake, changing different parameters. Our solution demonstrates that small and resource-limited IoT devices can achieve secure device identity, authentication and attestation within a reasonable time.