# IoT Group Membership Management Using Decentralized Identifiers and Verifiable Credentials
## 1 Introduction  
Traditional Internet-based systems involve one-to-one communication, where a _client_ request a resource from a _server_ (e.g., a web browser requests a web page from an HTTP server). IoT systems, on the other hand, involve uses cases where one-to-many and many-to-one communication patterns can be the norm and not an exceptional case: for example, mass actuation (e.g., turn on the lights of a smart city), or location-dependent queries (e.g., obtain the temperature as measured by all sensors in a smart building), or subscription to alerts (e.g., subscribe for a fire alert from any fire sensor in a building). In this paper, we are considering an IoT system where multiple IoT devices or gateways can provide the same \"type\" of information (e.g., temperature measurements), and all similar information items can be accessed through the same \"channel\", e.g., a user can collect all temperature measurements through that channel: as a channel abstraction, we are considering URIs used by the Constrained Application Protocol (CoAP) group communication [1]. Using CoAP group communication, IoT _endpoints_ can become members of _groups_ that can be accessed by CoAP clients using multicast II. In this context, new security challenges arise. Our paper focuses on the _provenance_ verification security challenge, i.e., how CoAP clients can verify that a response has been received by an IoT device _authorized_ to participate in the corresponding CoAP group. In order to achieve our goal, we leverage Decentralized Identifiers (DIDs) [2] and Verifiable Credentials (VCs) [3].  
A DID is a new form of identification under standardization by W3C. A DID is a URI that can be resolved to cryptographic material that can be used for authenticating the corresponding DID holder. Similarly a VC is a standardized method for asserting attributes of a _subject_ using a machine-readable encoding. In the proposed solution, a DID is usedfor authenticating IoT endpoints as well as for protecting CoAP groups. Similarly, VCs are used for asserting CoAP groups membership for IoT endpoints. From a high-level perspective, the proposed system operates as follows. Each CoAP group is associated with a DID and the corresponding DID document includes public key(s) used for signing group _membership_ VCs for IoT device owners. VCs map the DIDs of IoT device owners to groups in which their devices are allowed to participate. Then, each IoT device owner configures their devices with a signing key, an appropriate DID document and the corresponding membership VC. Using these, IoT endpoints can sign CoAP responses by generating a signature that can be verified using information included in the configured DID document. With our solution, we make the following contributions:  
* Given the DID of a group, any entity can verify that a signed item has been produced by an authorized member of that group.
* The signing keys of the IoT devices can be rotated without requiring any communication with the group administrator, or other group members, or clients.
* IoT endpoints can be easily added to or removed from a CoAP group.
* IoT endpoints have only to implement legacy digital signature algorithms in order to support our solution.
* Breached singing keys can be easily detected.  
The remainder of this paper is organized as follows. We introduce CoAP group communication, DIDs, and VCs, and we discuss related work in Section 2. In Section 3, we detail our design. In Section 4, we present the implementation and the evaluation of our solution. Finally, we conclude our paper and we discuss future work items in Section 5.