## 4 Identity Management and Access Control Based on Blockchain under Edge Computing for IIoT
### Certificate and Identity Management Based on Blockchain  
In our system, each entity has an identity. Each identity corresponds to a unique implicit certificate. The identity and certificate of entity in our system are one-to-one correspondence. Moreover, the identity of entity is bound to its implicit certificate. In our system, the identity and certificate are stored in blockchain network, and they are defined as merkle hash trees of blockchain, and their integrity is regularly verified. They can only be stored on the appended form. Thus, it ensures that identity and certificates will not be deleted or modified after being appended. The identity, certificate, and the history of the published key of entity in the network will be archived publicly in the blockchain. If a fraud certificate or fake key is issued, they will soon be detected. The edge centers collect certificate information and verify certificate transactions of other entities in the blockchain. Each edge center collects blocks from other edge centers, validate blocks, and attaches valid blocks to their local copies to make the blockchain longer.  
The timestamp service is an essential component in identity and certificate management. When issuing and storing certificates and public keys, the corresponding timestamp is provided. The nodes in the blockchain network retain local copies of identities and certificates. Before a secure session among the manufacturing terminal, the edge center, and cloud computing center, the certificate of each party will be verified according to the local copy of the blockchain. The certificates can be obtained directly from the local blockchain.  
Each network node must ensure that its certificate is valid. That is, its certificates need to be updated regularly. When a network entity performs a dishonest act and is discovered, its certificate will be revoked. The edge center initiates a transaction that revokes the certificate of a malicious network entity and broadcasts the transaction. After validation by most nodes of blockchain, the transaction is recorded in the blockchain. It also means that the malicious node is removed from the edge network and its identity is invalid. When the unexpired certificate is revoked, the corresponding certificate revocation list (CRL) file will be included in the transaction. The certificate revocation operation is also recorded. Because the blockchain has the characteristics of anti-counterfeiting, non-tampering, and is easy to use, intelligent contracts to realize, certify, and identity revocation have good transparency and credibility. The storage of identities and certificates in the blockchain is shown in Figure 5.  
Due to blockchain, the trust relationship of edge network is established in this system. As new terminals join the network, they can become trust anchors. That is, more terminals are allowed to connect the manufacture network. The trust will evolve to support growth of the decentralized network. The network terminal must first verify the identity of the communicator node, ensure that it is a valid node, and then carry out the corresponding access services.