Verifiable Credentials for IoT Devices in the Context of the eIDAS Trust Framework

The increasing adoption of Internet of Things (IoT) systems in machine-to-machine (M2M) scenarios requires authentication mechanisms that support trust and accountability across organizational boundaries. Standard X.509-based mTLS mechanisms provide strong technical device authentication, while operational information such as the responsible legal entity, device role, authorization scope, and deployment context can evolve independently of the technical identity. This paper proposes a two-layer architecture that separates a relatively stable X.509 technical credential from a dynamic operational Verifiable Credential bound to the authenticated device identity. The base credential represents the device–entity association, while the context-aware credential adds a versioned domain profile, operational role, permitted operations, and deployment context. We define evidence-based issuance, lifecycle, runtime verification, and independent status mechanisms and relate the trust model to eIDAS concepts for certificate-based trust and electronic attestations of attributes. We experimentally evaluated the verifier-side processing cost of the proposed context-aware model, together with credential presentation and technical and operational status checking. The results show that context-aware verification including request-to-operation mapping requires approximately 226 microseconds per request on average, with cryptographic signature verification representing the dominant processing cost.