I am building a tracking device and am looking for a secure authentication method to use when the device wants to establish a connection to the server.
The server is a TCP server that we open a connection with over TLS. We use TLS to encrypt traffic between the device and the server to rule out the chances of having the data being sniffed by a hacker. The device establishes a connection with the server using mobile network data from the onboard SIM.
If the device is physically compromised, this isn't a problem (we're not bothered about preventing this, as if they've lost the device it's not their location anyway). Also, as we're using TLS, we don't have to worry about someone scanning communications between the device and the mobile network. The main concern is to stop someone from spoofing/emulating one of the tracking devices. We don't want hackers setting the location of another user's tracking device.
Would it be sufficient to provide a device ID and a secure hash password that we send to the TCP server for authentication (obviously unique for each device) when a connection is established? I am unsure of authentication methods here and would appreciate any guidance.
BOUNTY EDIT: Some comments mention the best way to do this is through client certificates. I do not have any knowledge in this area and if this is the best option, would be interested to see an answer explaining this in more detail. Also, on a complete sidenote, would it be a bad idea to stop using TLS in our devices and use another method that doesn't include encryption? We're aware of the extra overhead that we incur when using TLS so if there's another method for securing authentication that doesn't use encryption then I'd love to hear it. After all, what are the chances of somebody actually sniffing traffic between one of our devices and a mobile network, and then using the device's identity to send malicious/fake coordinates?