A computer-implemented method to control access to an Internet of things, IoT, device, comprising: sending a first request (210, 310), by a requesting device to the IoT device, for an IoT device identifier of the IoT device over a first communication link between the requesting device and the IoT device; receiving (220, 310), by the requesting device, the requested IoT device identifier from the IoT device; sending a second request (230, 320), by the requesting device to an authorization device over a communication network including at least one Transmission Control Protocol/Internet Protocol, TCP/IP, communication link, for authorization to command the identified IoT device to perform an action; receiving, by the authorization device, the second request from the requesting device, wherein the second request includes the IoT device identifier and an identifier of the requesting device; determining, by the authorization device in response to receiving the second request, an authorization of the requesting device to command the identified IoT device to perform the requested action, wherein the determining of the authorization comprises verifying that the identifier of the requesting device is listed in one or more access control lists of the identified IoT device on the authorization device; if the requesting device is determined by the authorization device to be authorized to command the identified IoT device to perform the requested action, transmitting, by the authorization device to the requesting device over the communication network, an encrypted authorization for the requesting device to command the IoT device to perform the action; receiving, by the requesting device, the transmitted encrypted authorization from the authorization device via the communication network; relaying, by the requesting device to the IoT device via the first communication link, the received transmitted encrypted authorization; receiving, by the IoT device, the encrypted authorization from the requesting device via the first communication link; decrypting, by the IoT device, the received authorization; and performing, by the IoT device, the action specified in the authorization. sending a first request (210, 310), by a requesting device to the IoT device, for an IoT device identifier of the IoT device over a first communication link between the requesting device and the IoT device; receiving (220, 310), by the requesting device, the requested IoT device identifier from the IoT device; sending a second request (230, 320), by the requesting device to an authorization device over a communication network including at least one Transmission Control Protocol/Internet Protocol, TCP/IP, communication link, for authorization to command the identified IoT device to perform an action; receiving, by the authorization device, the second request from the requesting device, wherein the second request includes the IoT device identifier and an identifier of the requesting device; determining, by the authorization device in response to receiving the second request, an authorization of the requesting device to command the identified IoT device to perform the requested action, wherein the determining of the authorization comprises verifying that the identifier of the requesting device is listed in one or more access control lists of the identified IoT device on the authorization device; if the requesting device is determined by the authorization device to be authorized to command the identified IoT device to perform the requested action, transmitting, by the authorization device to the requesting device over the communication network, an encrypted authorization for the requesting device to command the IoT device to perform the action; receiving, by the requesting device, the transmitted encrypted authorization from the authorization device via the communication network; relaying, by the requesting device to the IoT device via the first communication link, the received transmitted encrypted authorization; receiving, by the IoT device, the encrypted authorization from the requesting device via the first communication link; decrypting, by the IoT device, the received authorization; and performing, by the IoT device, the action specified in the authorization.