Authors - Eisenhower D. Aldemita II, Christopher Luis M. Senatin, Wilson M. Tan Abstract - As the Internet of Things (IoT) scales up to billions of connections, securing resource-constrained devices remains a challenge. The lack of lightweight trust management systems and weak access control are some of the existing vulnerabilities in IoT systems. This paper proposes a Public Key Infrastructure architecture integrating a digital national ID system to tie human and machine identity together. The system requires users to present their ID for verification with the digital national ID system before allowing registration of their IoT devices, tying their identity to the certificates issued to their devices. Ownership challenges are implemented during the registration of devices to ensure the user has physical access to and possession of the device. Once registered, mutual Transport Layer Security is used for secure communication between devices and servers. The system was evaluated on ESP8266, Raspberry Pi Pico W, and ESP 32 microcontrollers with 10000 tests per key performance metric. The results show that the proposed architecture provides increased security with minimal impact on device performance.
