One of the fundamental aspects needed for security for IoT
(and for that matter many Internet-based services)
is the ability to identify, with certainty, users or devices that make up the system.
For most Internet services,
especially the free ones,
there is no confirmed identity of a user.
For other systems,
the identity is based on either a bank account or credit card verification.