# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 1 Introduction  
Traditional authentication mechanisms--such as username-password schemes and centralized identity providers--pose critical challenges in industrial settings, including single points of failure, vulnerability to credential theft, and limited user control over identity data [1].  
To address these issues, biometric authentication has become increasingly relevant in modern access control systems, as it enables identity verification based on inherent user characteristics. Among these, voice biometrics has emerged as a particularly effective alternative due to its non-invasive nature and ease of integration in industrial environments, where the deployment of specialized sensors may be constrained. Similarly, behavioral biometrics supports continuous authentication (CA) through the dynamic analysis of user interaction patterns, offering an additional layer of protection against anomalous or unauthorized access [2]. Nevertheless, the intrinsic characteristics of biometric systems, combined with various external factors that may affect their performance, suggest that authentication relying solely on biometrics might not achieve the levels of reliability required in industrial environments. As a result, it is essential to complement these systems with additional mechanisms to strengthen the overall security and robustness of the authentication process.  
To address these challenges, SIBERIA is introduced as a novel identity management system designed for secure authentication and authorization in private industrial services. SIBERIA integrates Self-Sovereign Identity (SSI) principles [3], Spoofing Aware Speaker Verification (SASV) authentication, and behavioral biometric monitoring to enhance security and user control. The system consists of three main modules:  
* **SSI Module:** Implements a decentralized identity model where users control their information via a mobile wallet. Identity credentials, stored as Verifiable Credentials (VCs), are issued and signed by trusted entities. A private blockchain based on EOSIO manages identity-related smart contracts, ensuring compliance with the European Blockchain Services Infrastructure (EBSI) standards.
* **Secure SASV Module:** Requires users to authenticate using their voice in addition to traditional username and password credentials. The system generates a voiceprint, issues a corresponding VC, and stores it in the user's wallet. During authentication, a similarity score is computed to grant or deny access. This module incorporates anti-spoofing measures and protection against deepfake audio attacks.
* **Behavioral Biometric Authentication Module:** Monitors user interaction with the protected service by analyzing events such as mouse movements, visited options, and session durations. This module detects anomalies in user behavior and triggers alerts or terminates the session in case of suspicious activity.  
By integrating these modules, SIBERIA provides a robust and scalable identity management solution that enhances security in industrial environments. This paper presents the architecture, implementation, and evaluation of SIBERIA, demonstrating its effectiveness in securing access to critical industrial services.