Associating applications with Internet-of-things (IoT) devices using three-way handshake

A system, comprising:

• a memory storing instructions, which, when executed on the system, performs an operation for pairing an Internet-of-Things (IoT) device with an application, the operation comprising:
• sending the application, over a first communication link established between the application and an IoT service, a service managed client identifier (client ID), wherein the application is executed on a user device separate from the system and the IoT device,
• receiving from the IoT device, over a second communication link, a request for a token, wherein the request includes the client ID and a device identifier (device ID) associated with the IoT device, wherein the second communication link is established between the IoT device and the IoT service,
• sending, over the second communication link, an encrypted token to the IoT device,
• receiving from the application, over the first communication link, a pairing request, wherein the pairing request includes a copy of the encrypted token, the device ID, and the client ID, and
• upon validating the pairing request, pairing the client ID and the IoT device by associating the client ID and the device ID.

A computer implemented method for pairing an Internet-of-things (IoT) device with an application, the method comprising:

• sending the application a service managed client identifier (client ID) associated with a user of the application by an IoT service, wherein the client ID is sent over a first communication link established between the application and the IoT service, and wherein the application is executed on a user device separate from the IoT service and the IoT device;
• receiving from the IoT device, over a second communication link, a request for a token, wherein the request includes the client ID and a device identifier (device ID) associated with the IoT device, wherein the second communication link is established between the IoT device and the IoT service;
• sending, over the second communication link, an encrypted token to the IoT device, wherein the encrypted token stores the client ID and the device ID;
• receiving from the application, over the first communication link, a pairing request, wherein the pairing request includes a copy of the encrypted token, the device ID, and the client ID;
• and
• validating the pairing request by decrypting the encrypted token included in the pairing request and verifying that the device ID and the client ID recovered from the decrypted token matches the device ID and client ID received in the pairing request.