# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 1 Introduction
### Self-Sovereign Identities  
SSI is a user-centric digital identity model that shifts authority from centralized issuers and identity providers to the individual [4; 5]. Based on principles of autonomy, privacy, and security, SSI enables individuals to create, hold, and present VCs without relying on a single intermediary. In practice, this decentralization streamlines identity workflows and reduces single points of failure. It also limits large-scale data collection and lowers exposure to breaches and identity theft. Users decide what data to disclose and can revoke compromised credentials. Meanwhile, issuers and verifiers maintain transparency through signed issuance and revocation records. By combining cryptographic assurances with decentralized network infrastructure, SSI offers a resilient, privacy-enhancing alternative to conventional identity management approaches. It aligns with evolving expectations for individual control in the digital age [6]. A core element of SSI architectures is the Decentralized Identifier (DID), a unique and persistent identifier that represents entities--such as individuals, organizations, or devices--without reliance on a central authority. The World Wide Web Consortium (W3C) defines the syntax, structure, and usage of DIDs to promote interoperability and trust across platforms [7]. A DID has the following standardized format:  
\[\text{did}:\langle\textit{method}\rangle:\langle\textit{identifier}\rangle \tag{1}\]  
The DID contains metadata necessary to verify control over the identifier. This includes public cryptographic keys, authentication methods, and service endpoints. These records are stored in a Verifiable Data Registry (VDR), typically implemented using blockchain or distributed ledger technologies. This allows verifiers to resolve a DID, retrieve its associated document, and authenticate the entity it represents [8]. Several key actors support the issuance, storage, and verification of VCs. Each plays a distinct role within the SSI architecture:  
* Holders: Individuals or devices that manage their digital identities within the ecosystem. They store credentials in a secure digital wallet, which acts as the container for their VCs. Holders retain full control over their data and decide when and with whom to share their credentials. * Issuers: Authorized entities that generate VCs based on the holder's identity. Issuers validate the information and issue credentials, which are registered on the blockchain to ensure authenticity. * Verifiers: Entities that must validate credentials before granting access to a service. They ensure that the credentials presented by holders are legitimate and have not been revoked, using the blockchain as a source of verification. In addition to these three actors, the VDR provides the trusted infrastructure for resolving identifiers, retrieving issuer keys, and verifying credential status. All identity-related operations--including registration, issuance, storage, and verification of VCs--are immutably recorded on a blockchain or distributed ledger. This guarantees data integrity, transparency, and resistance to tampering, enabling verifiers to detect any unauthorized changes to the trust framework. Figure 1 provides a visual overview of the actors involved in the SSI ecosystem and the interactions between them. Within SSI systems, digital identity data is exchanged through two core structures: VCs and Verifiable Presentations (VPs) [9]. A VC is a digitally signed assertion issued by a trusted entity, containing claims about an individual or organization. These credentials may represent identity documents, diplomas, licenses, or attestations of attributes. Unlike traditional credentials, VCs can be cryptographically verified and selectively disclosed bythe holder. When information needs to be shared with a third party, the holder generates a VP, which packages one or more VCs--or selected claims from them--and attaches a cryptographic proof demonstrating control over the disclosed data.