# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 3 Results
### Issuer Onboarding  
The onboarding process for a new TI within SIBERIA involves a structured sequence of steps designed to ensure the authenticity and authorization of the entity to issue VCs. In this use case, typically, the entity in charge of issuing credentials is the Secure SASV Module, but the registration of additional issuers that can issue credentials within the SIBERIA ecosystem is supported.  
First, the entity must create its identity as an issuer. This is performed via the SIBERIA API, which generates a DID of type legal entity, a cryptographic key pair (public and private), and a DID document that defines the decentralized identity of the entity.  
Once the identity is created, it must be registered in the DID Registry. Following EBSI guidelines, the entity must request a credential from the TAO known as the Verifiable Authentication Onboard via the TAO API. This credential serves as proof that the entity has been evaluated and accredited by the TAO to operate as an issuer within the SIBERIA ecosystem.  
With this credential, the entity requests a token from the Token Issuance API to register its identity in the DID Registry. Upon validation of the credential, a token is issued, permitting the entity to register its DID document using the SIBERIA API.  
This registration process within the DID Registry is illustrated in Figure 5.  
Following successful registration in the DID Registry, the entity may proceed to be recognized as a TI. At this stage, two scenarios are considered: the entity may either adhere to the existing schemas registered in the system or it may require additional or custom schemas. It is important to emphasize that adherence to the general SIBERIA Verifiable Attestation schema is mandatory for all TIs, as it serves as the foundational structure for all issued credentials.  
If new schemas are necessary, they must first be registered in the TSR. This process involves the entity requesting a token via the Token Issuance API, followed by submitting the schema registration through the SIBERIA API.  
Once all required schemas are registered, the entity can proceed with its registration in the TIR. As illustrated in Figure 6, the entity must request a new credential from the TAO, known as Verifiable Accreditation to Attest, again through the TAO API. This credential certifies the entity's authorization to act as a TI and specifies the schemas it is permitted to use. Concurrently, the TAO reserves a corresponding entry in the TIR for the entity.  
Subsequently, the entity presents this credential to the Token Issuance API, which, upon successful validation, issues a token for TIR registration. Using this token, the  
Figure 5: Registration in DID registry.  
Figure 6: Registration in TIR.  
entity completes the onboarding process by submitting its registration request through the SIBERIA API. The TIR is updated in the reserved entry with the TAO-issued credential, which is made publicly accessible to ensure transparency within the ecosystem.  
Optionally, if the issuer supports the SIBERIA StatusList2021 Credential schema, it may register a status list proxy that allows verifiers to query the real-time status of credentials it has issued, e.g., whether they are revoked, suspended, or valid. This involves requesting a token from the Token Issuance API, followed by proxy registration via the SIBERIA API, specifying the endpoint for accessing the status list. This proxy is then linked to the issuer's public profile in the TIR. Upon completion of these procedures, the entity is fully onboarded as a TI and is authorized to issue VCs under the approved schemas within the SIBERIA ecosystem.