# Reliable Application Layer Routing Using Decentralized Identifiers
## 4 Design
### The Use of Decentralized Identifiers  
The proposed system leverages decentralized identifiers (DIDs) to implement secure URL management. In particular, a new DID method is defined that uses the ICN registry specified in [30]. This registry allows DID owners to store a DID document in a _storage node_ in the network. Any entity can _read_ that document by sending an ICN _subscription_ message. The subscription message, which includes in its header the requested DID, is rooted by the ICN network to the appropriate node, which in return _publishes_ the requested document alongside the corresponding document and authorization proofs. As it is discussed in the following section, a DID in our system is associated with a \(Resource_{\textit{URL}}\) domain, and _domain_ is used as our DID method identifier, e.g.,  
\[did:domain:building1.iot\]  
A DID in the proposed system is associated with a DID document, which is a JSON-encoded data structure that includes two claims:  
* _id_: The DID which the DID document concerns. * _assertion_: A list of public keys that can be used for verifying the digital signatures included in the corresponding _advertisements_. Each entry in the assertion list includes the following claims:
* _id_: An identifier which is unique for the assertion list entries. * _prefix_: A URL prefix for which the key can be used for singing advertisements. * _expires_: A timestamp after which the defined public key cannot be used for signing advertisements. Figure 1: System overview. _edge_: The identifier of the edge node in which the IoT device is attached. * _type_: The type of the public key. * _publicKey_: The public key whose encoding depends on the type. The type of an element of the assertion list can be either _url_ or _JsonWebKey_. In the former case, the _publicKey_ is a pointer to a key defined in another document, and the _publicKey_ is a JSON web key (JWK) [31]. Listing 1 is an example of a DID document used in our system for the DID \"did:domain:smart-city.iot\". ```
1{
2\"id\".\":\"did:domain:smart-city.iot\",
3\"assertion\":{
4\"id\".\"#Key1\",
5\"expires\":\"1651072705\",
6\"prefix\":\"smart-city.iot/\",
7\"edge\":\"edge-1\",
8\"type\":\"JsonWebKey\",
9\"publicKey\":{
10\"crv\":\"Ed25519\",
11\"x\":\"7a345 vc...\",
12\"kty\":\"OKP\"
13},
14{
15\"id\":\"#key2\",
16\"expires\":\"1651072710\",
17\"prefix\":\"smart-city.iot/building1\",
18\"edge\":\"edge-2\",
19\"type\":\"url\",
20\"publicKey\":\"did:domain:building1.iot\"
21}
22}
23}
```  
A DID document is protected by a _document proof_ and an _authorization proof_. The _document proof_ is used for verifying the DID document's integrity. The _authorization proof_ is used for learning the public key of the DID _owner_. A _document proof_ is a compact encoded JSON web signature (JWS) [32], and its payload includes the following claims:  
* created: A timestamp indicating the creation time of the proof. * expires: A timestamp indicating the expiration time of the proof. * sha-256: The base64 url encoded SHA-256 hash of the DID document. The signature of the proof is generated using EdDSA and the private key of the DID owner. The _authorization proof_ is also a compact encoded JWS, and its payload includes the following claims:  
* id: The DID. * created: A timestamp indicating the creation time of the proof. * expires: A timestamp indicating the expiration time of the proof. * controller: The public key of the DID owner. The signature of an authorization proof is generated by the registrar. Given a DID and the corresponding DID document, any entity can validate its correctness by executing the following steps:  
1. Verify that the DID is included in the id claim of the DID document. 2. Verify that the document proof has not expired, it includes DID in the id claim, and it includes the correct value in the sha-256 claim. 3. Verify that the authorization proof has not expired and includes DID in the id claim. 4. Verify that the signature of the authorization proof has been generated by a trusted registrar and validate it. 5.