# A Lightweight Blockchain-Based IoT Identity Management Approach
## 3 Blockchain-Based Identity Management Architecture and Protocols
### Architecture  
The Internet of Things is changing the era of digital identity drastically from user-centric to entity-centric [18; 19], where identity management should focus on all entities participating in the IoT network. As all entities in the IoT have the same interaction ecosystem, the IoT identity management must be able to manage human-to-device, device-to-device, and device-to-application interactions and data exchange while taking into consideration the relationships between the different IoT entities, as shown in the Figure 1. All of the communication endpoints in the IoT ecosystem, such as users, smart things, and applications, should register and authenticate to the blockchain-based IDM. The blockchain-based IDM network is the backbone for the IoT system that formed by a defined consortium sharing the same industrial needs or business interests that are responsible for building and defining the network policies and governing the shared ecosystem. The blockchain-based IDM solution includes a consortium membership service and identity management protocol. The membership service is responsible for issuing and revoking authority certificates for the network components, such as BC admins, nodes, consensus ordering, and communication channels. Unlike the other works, our design aims to split the identity protocol into three phases identity registration, identity verification, and identity revocation, and each phase is taking place by issuing, resolving, or revoking unique identifiers as well as certificates to each entity. The identity protocol employs smart contracts to interact with the blockchain network. On the blockchain ledger, each block contains a set of identity transactions that are issued by the identity protocol. In addition to the decentralization, privacy, and security offered by DLT, our design goals include simplicity to provide an efficient protocol to meet the needs of all IoT organizations. Interoperability, to permit sharing sensors within and across organizations by following the decentralization standards. Extensibility, by employing only the main phases of an identity system on the top of the DLT structure, which can be tailored by all identity management of things models. Adopting a modular consortium blockchain architecture will help to match any use case in all domains, and it gives a greater degree of flexibility and resiliency. The consortium blockchain should provide essential architecture components to meet the need of a blockchain-based IDM, such as:  
* Identity protocol: several existing BC solutions use remote procedure call (RPC) as an identity service; all other solutions also make use of BC cryptography primitives to perform such services that lead to weak entities identity management. Designing an identity protocol on the top of the BC solution will help to manage the solution effectively and have more control regarding transaction types and transactions outcome. * Membership service: is a crucial component in the consortium blockchain network. Membership service is responsible for listing the defined participants, mapping the resources of the participants, and, most importantly, setting the roles and access privileges of the network resources, such as admins, nodes, ledgers, and communication channels. * Network policies: in order to form a solid structure of the consortium and to reach specific outcomes, all of the participants and the IoT entities should follow the endorsement policies that are defined by the network participants. Such arrangements provide robust governance over the network and assure transparency and enforce consortium decisions in order to reach the needed outcomes. * Smart contract: generates an executable logic in order to interact with the immutable blockchain record. Developing a refined smart contract will help to keep the records guarded and it reduces security concerns.