# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 1 Introduction
### Self-Sovereign Identities
In the European context, EBSI represents an official implementation of SSI principles and standards. Developed by the European Commission and the European Blockchain Partnership, EBSI operates as a decentralized, cross-border network for digital services aligned with EU regulations and the core values of SSI. Its goal is to provide a trusted and interoperable digital identity framework for EU citizens, organizations, and institutions, supporting use cases such as diploma issuance, identity verification, and access to public services [10]. In the EBSI ecosystem, DIDs are alphanumeric strings that uniquely identify a subject without disclosing any personal information. A distinction is made between DIDs assigned to natural persons and those associated with legal entities. The guidelines and components defined by EBSI serve as a key technical reference for developing solutions aligned with SSI principles, a foundation upon which SIBERIA is built. For natural persons, the decentralized identifier follows the syntax did:key:<method-specific-identifier>. The method-specific identifier (MSI) must be unique and case-sensitive. It is derived from the subject's public key, encrypted and encoded using Base58 BTC, and always preceded by the letter \"z\". In the case of legal entities, the syntax used by EBSI is did:<network>:<method-specific-identifier>, where <network> is set to \"ebsi\". In this case, the MSI must also be unique and case-sensitive, similarly encoded in Base58 BTC, and starting with the character \"z\". However, unlike in the case of natural persons, the MSI is not derived from an encrypted public key but consists of 16 random bytes. To ensure trust, interoperability, and security within its SSI network, EBSI relies on several core registries that form the backbone of its decentralized identity system. Each registry plays a vital role in maintaining the integrity, functionality, and immutable management of decentralized identities, trusted issuers, and credential schemes within the ecosystem. * DID Registry: This is the registry where DIDs are created, managed, and resolved. It ensures that entities within the EBSI ecosystem, such as individuals or organizations, can be uniquely identified in a decentralized manner. This registry is crucial for the resolution of DID documents, which contain the necessary information for authentication and verification. * Trusted Issuers Registry (TIR): This registry lists the trusted issuers authorized to issue VCs within the EBSI network. By maintaining a registry of trusted issuers,  
Figure 1: Architecture of the SSI system. EBSI ensures that only authorized entities can participate in the issuance of VCs, thereby establishing trust and authenticity in the credentials that are shared across the ecosystem. Issuers in the TIR are categorized into three types:  
* Root Trusted Accreditation Organisation (Root TAO): A root entity capable of self-accrediting and accrediting other organisations. * Trusted Accreditation Organisation (TAO): Organisations that accredit third parties to issue VCs. * Trusted Issuer (TI): Issuers authorized to create and transmit credentials linked to a specific subject. * Trusted Schema Registry (TSR): This registry is responsible for defining and maintaining the trusted schemas for the VCs issued within the system. These schemas establish standardized formats and structures for different types of credentials, ensuring consistency and compatibility across different issuers and verifiers. A key component for user interaction within SSI systems is the Digital Wallet. This concept refers to software applications that enable holders to securely store, manage, and present their VCs. Serving as the primary interface for identity control, the wallet allows users to decide when, how, and with whom to share personal information. Depending on the architecture, digital wallets can be implemented as mobile apps, browser extensions, desktop clients, or cloud-based services.