Decentralized Identity for Edge Computing
An Industrial Internet Consortium Tech Brief
2020-09-18

Decentralized Identity for Edge Computing

Table of Contents
The Identity on Edge .............................................................................................................. 3
About this Tech Brief ............................................................................................................. 3
Overview of Emerging Concepts............................................................................................. 4
Decentralized Identifier ................................................................................................................. 4
Verifiable Credential ..................................................................................................................... 5

DIAM-IoT: A Decentralized IAM Framework for IoT ................................................................ 5
Business Opportunities .......................................................................................................... 7
About the Authors ................................................................................................................. 8Dr. Xinxin Fan, Head of Cryptography, IoTex .................................................................................. 8Dr. Raullen (Qi) Chai, CEO, IoTex .................................................................................................... 8
About IoTex .................................................................................................................................. 8Copyright .............................................................................................................................. 92

Decentralized Identity for Edge Computing

THE IDENTITY ON EDGE
The explosion of networked smart devices, ranging from home appliances to medical devices toconsumer electronics, is shaping our lives and disrupting traditional businesses at a staggering
rate during the past few years. According to Gartner, connected devices across all technologies
will reach 20 billion by 2020. This means that identity and access management (IAM) services
need to identify billions of IoT devices and millions of potential users uniquely.
Unfortunately, legacy IAM systems are not able to fulfil this requirement, largely because they
focus extensively on identifying people, rather than identifying smart devices of internet of things(IoT) systems.
In an increasingly connected world, managing device and user identities as well as therelationships among various entities faces significant challenges:
1. Due to the lack of IAM standards for IoT, manufactures have to use proprietary
approaches for naming and identifying their devices, which results in IoT application silos,and hinders interoperability among connected devices from different manufactures.
2. An IoT system needs to go through a series of stages during its lifetime, which further
complicates integration of IAM capabilities into the operational lifecycle of IoT devices.
3. Last but not least, there exists a multitude of protocols and standards for various IoT
devices and applications. A lack of a common operating and security framework has posedsome serious concerns for device manufacturers and consumers. As a result, there is astrong need for introducing a new IAM framework that is able to adapt to the proliferationof connected devices in the coming years.

ABOUT THIS TECH BRIEF
This Tech Brief provides an overview of emerging concepts such as decentralized identifiers (DIDs)
and verifiable credentials (VCs), and it describes how to create a unified, interoperable andtamper-proof device identity registry on top of the blockchain by introducing DIDs and VCs into
the lifecycle of IoT devices, thereby breaking IoT application silos and unlocking the potential ofIoT on a global scale. Learn more about our ongoing Edge initiatives at https://iiconsortium.org.
Related presentation from IIC: “Decentralized Identity for Edge Computing,” from the IIC’s Edge
Computing Task Group meeting 2020-04-23. (YouTube video.)3

Decentralized Identity for Edge Computing

OVERVIEW OF EMERGING CONCEPTS
DECENTRALIZED IDENTIFIER
A decentralized identifier (DID) is a new type of identifier that is globally unique, resolvable withhigh availability and cryptographically verifiable. A DID comprises three components separated
by colons, as shown below:

where the scheme, did, is fixed for all DIDs. The method describes how DIDs work with a specificblockchain and the DID Method Registry of the World Wide Web Consortium (W3C) summarizes
the DID method specifications currently in development. The method-specific identifier is analphanumeric string that is guaranteed to be unique within the context of the DID method. To
discover what a DID means, the DID method outlines the way to resolve a DID to the associate
DID document.
A DID document is a JSON-LD document containing six optional components, as illustrated inFigure 1. “id” denotes the DID, “publickey” a list of public keys, “authentication” a list of protocols
for verifying the control of the DID and delegated capabilities, “service” a set of service endpoints
for interacting with the entity that the DID identifies, “created/updated” a timestamp thatindicated when the DID document was created or updated and “proof” a digital signature forverifying the integrity of the DID document.

Figure 1. An Example of a DID Document4

Decentralized Identity for Edge Computing

VERIFIABLE CREDENTIAL
A verifiable credential (VC) is a tamper-evident credential that has authorship that can be
cryptographically verified. VCs attest identity attributes of subjects and the exchange of VCs
builds up trust among DID-identified peers. In particular, issuers of VCs determine which claims
are contained in the credentials, whereas verifiers make their own decisions regarding thetrustworthiness of the received credentials. A VC is also a JSON-LD document as shown in Figure2. “id” denotes the DID of the VC, “type” is the type of the VC, “issuer” is the DID of the credential
issuer, “issued” indicates the date that the VC was issued, “claim” is a list of identity attributes
attested by the issuer and lastly, the “proof” comprises a digital signature for verifying the validityof the credential.

Figure 2. An Example of a Verifiable Credential

DIAM-IOT: A DECENTRALIZED IAM FRAMEWORK FOR IOT
Consider a global-scale IoT ecosystem that contains a large number of device manufacturers,
billions of IoT devices and millions of users. In such an ecosystem, a variety of IoT systems thatfeature proprietary IAM solutions and different communication standards coexist, thereby
creating application silos and preventing the vision of interoperability. To address thesechallenges, a new decentralized IAM (DIAM) framework for IoT called DIAM-IoT is proposed to5

Decentralized Identity for Edge Computing
connect IoT application silos and facilitate user-centric data sharing in a decentralized manner,
as illustrated in Figure 3.

Figure 3. A High-Level System Architecture of DIAM-IoTDIAM-IoT introduces DIDs and VCs into the lifecycle of IoT devices without significantly changing
the existing system workflows and leverages distributed ledger and smart contracts to manage
device manufactures and DIDs. After IoT devices are sold to consumers, it is up to the consumers
to decide whether they would like to share their device data with others. If data sharing is not anoption, consumers just use their IoT system as usual. Otherwise, they receive VCs during thedevice binding process and register device DIDs by invoking manufacture-managed smart
contracts.
Furthermore, consumers manage data access with their own smart contracts on the blockchainthat act as the service endpoints and ensure fairness of the data sharing process. The salientfeature of DIAM-IoT is that device owners have full control over how their device data is being
accessed. In the following subsections we present the detailed design of DIAM-IoT.
The DIAM-IoT framework consists of the following major steps:● IoT manufacturer onboarding. DIAM-IoT uses a two-layer approach for managing DIDs ofIoT devices with smart contracts. While a master smart contract maintains a registry ofIoT manufacturers, each manufacturer manages its own device registry with amanufacturer smart contract. From a consumer perspective, the manufacturer handles
the DID operations for its own IoT devices, whereas the master smart contract deals with
the DID resolution for all other devices.

6

Decentralized Identity for Edge Computing● User account registration. A cryptocurrency wallet is created for a user interacting withthe blockchain. The IoT cloud needs to verify that both the user account (e.g. an emailaddress) and the blockchain address belong to the same user. At the end of user
registration, the IoT cloud binds the user account with its blockchain address and publickey.
● Device binding and verifiable credential generation. To register a DID for an IoT device onthe blockchain, a user needs to obtain a VC from the IoT cloud which binds the device DID
and its owner's DID. This confirms the device ownership and allows only the device ownerto register the DID for its IoT device on the blockchain. In DIAM-IoT, a VC is generated by
the IoT cloud after a device binding is performed successfully.
● Device DID registration. Before registering a DID for the IoT device on the blockchain, thedevice owner first deploys a service smart contract, which serves as the endpoint forinteracting with the IoT data service and ensures the fair payment and timely
dissemination of IoT data. In DIAM-IoT, a DID document is stored off-chain and only its
hash value is kept on-chain for maintaining consistency with the off-chain record. The DID
document is signed by the device owner and contains service-related information such asdevice owner, device metadata, service endpoints, among others. Upon completing thestorage of the DID document, the device owner initiates the device DID registration by
invoking the manufacturer smart contract.
● Decentralized and user-centric data authorization. The decentralized and user-centric
data authorization enables device owners to realize fine-grained access control on datacollected by their IoT devices. A data requester needs to first resolve the IoT device’s DIDof a device owner by invoking the master smart contract and extracting the address ofthe corresponding service smart contract. The data requester then requests data accessby interacting with the device owner’s service smart contract. Once the data accessrequest is granted by the device owner, the data requester is able to retrieve data using
the access token issued by the device owner.

BUSINESS OPPORTUNITIESDIDs and VCs enable the existing IoT solutions across their own application domains and facilitate
the value exchange among various IoT applications. As a result, IoT systems that integrate theDIAM-IoT framework are able to interact with each other seamlessly in a global-scale ecosystem.
In particular, IoT solution providers are able to build powerful decentralized applications by
incorporating data from other IoT systems. From the perspective of consumers, the DIAM-IoT
framework allows them to have full control of their IoT devices and data, thereby giving
consumers the peace of mind they deserve.

7

Decentralized Identity for Edge Computing

ABOUT THE AUTHORS
The views expressed in the IIC Technical Brief on Edge are the contributing authors’ views and donot necessarily represent the views of their respective employers nor those of the Industrial
Internet Consortium.

DR. XINXIN FAN, HEAD OF CRYPTOGRAPHY, IOTEX
Dr. Fan is responsible for directing the company's strategy andproduct roadmaps as well as developing the core technologies andIP portfolio. Before joining IoTeX, he was a senior research scientistof Security and Privacy Group at Bosch Research Technology CenterNorth America, where he defined and conducted innovative
research on security and privacy for Internet of Things, machine-tomachine communication, cloud computing and data mining. He is an inventor with 16 patentfilings for innovative information security and privacy-enhancing technologies. Dr. Fan received
his Ph.D. in Electrical and Computer Engineering from the University of Waterloo.

DR. RAULLEN (QI) CHAI, CEO, IOTEX
Dr. Chai founded IoTeX in 2017 to focus on the building of autoscalable and privacy-centric blockchain infrastructure that is designed
and optimized for Internet-of-Things (IoT). Previously, he worked at
Google as senior software engineer leading many security initiatives
for its technical infrastructure. He was also the founding engineer ofGoogle Cloud Load Balancer, which now serves thousands of cloudservices with 1+ million queries per second. Prior to that, he was thehead of cryptography R&D at Uber, leading the research and development of credential storage
system, authentication system, risk management and in-house cryptographic tools. Dr. Chai
received his Ph.D. degree in Engineering from the University of Waterloo.

ABOUT IOTEX
Founded as an open source platform in 2017, IoTeX is building the Internet of Trusted Things,
where all physical and virtual “things”—humans, machines, businesses and DApps—can exchange
information and value at a global scale. By serving as a decentralized trust fabric for IoT, IoTeX will
empower the future decentralized economy by “connecting the physical world, block by block”.
During the past few years, IoTeX has amassed considerable expertise and experience in IoT
security and privacy and is actively collaborating with other IIC members to address a wide rangeof industry challenges.

8Decentralized Identity for Edge Computing

COPYRIGHT
Copyright © 2020, Industrial Internet Consortium, a program of the Object Management Group©. All copying, distribution and use are subject to the limited License, Permission, Disclaimer
and other terms stated in the Industrial Internet Consortium Use of Information – Terms,Conditions & Notices, as posted at http://www.iiconsortium.org/legal/index.htm#use_info. If
you do not accept these Terms, you are not permitted to use the document.

9