An apparatus for Internet of Things, IoT, authentication, comprising: an IoT hub including one or more devices, the devices including at least one memory adapted to store run-time data for the devices, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the IoT hub to perform actions, including: storing a plurality of data field targets for a first IoT device (341, 342, 343), wherein the plurality of data field targets includes at least one device identity data field target and at least one telemetry data field target for the first IoT device to be deployed in a physical environment, and wherein the plurality of data field targets correspond to respective target configuration values for data fields for the first IoT device; receiving a first plurality of data field entries from the first IoT device at a first time, wherein the first plurality of data field entries includes at least one device identity data field entry and at least one telemetry data field entry, wherein the at least one telemetry data field entry corresponds to data generated by the first IoT device due to the first IoT device being deployed in the physical environment; making a first determination, wherein the first determination is a determination as to whether the first plurality of data field entries match the respective corresponding data field targets for the first loT device; and selectively allowing the first loT device to connect to the loT hub based on the first determination, such that connection of the first IoT device to the IoT hub is allowed based on whether the first plurality of data field entries match the corresponding data field targets. an IoT hub including one or more devices, the devices including at least one memory adapted to store run-time data for the devices, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the IoT hub to perform actions, including: storing a plurality of data field targets for a first IoT device (341, 342, 343), wherein the plurality of data field targets includes at least one device identity data field target and at least one telemetry data field target for the first IoT device to be deployed in a physical environment, and wherein the plurality of data field targets correspond to respective target configuration values for data fields for the first IoT device; receiving a first plurality of data field entries from the first IoT device at a first time, wherein the first plurality of data field entries includes at least one device identity data field entry and at least one telemetry data field entry, wherein the at least one telemetry data field entry corresponds to data generated by the first IoT device due to the first IoT device being deployed in the physical environment; making a first determination, wherein the first determination is a determination as to whether the first plurality of data field entries match the respective corresponding data field targets for the first loT device; and selectively allowing the first loT device to connect to the loT hub based on the first determination, such that connection of the first IoT device to the IoT hub is allowed based on whether the first plurality of data field entries match the corresponding data field targets. storing a plurality of data field targets for a first IoT device (341, 342, 343), wherein the plurality of data field targets includes at least one device identity data field target and at least one telemetry data field target for the first IoT device to be deployed in a physical environment, and wherein the plurality of data field targets correspond to respective target configuration values for data fields for the first IoT device; receiving a first plurality of data field entries from the first IoT device at a first time, wherein the first plurality of data field entries includes at least one device identity data field entry and at least one telemetry data field entry, wherein the at least one telemetry data field entry corresponds to data generated by the first IoT device due to the first IoT device being deployed in the physical environment; making a first determination, wherein the first determination is a determination as to whether the first plurality of data field entries match the respective corresponding data field targets for the first loT device; and selectively allowing the first loT device to connect to the loT hub based on the first determination, such that connection of the first IoT device to the IoT hub is allowed based on whether the first plurality of data field entries match the corresponding data field targets.