# Siberia: A Self-Sovereign Identity and Multi-Factor Authentication Framework for Industrial Access
## 2 Materials and Methods
### SSI Module
It allows external entities to initiate the credential request process required to become recognized issuers. * Token Issuance API: This API handles the secure issuance of authorization tokens required to perform sensitive actions within the system, such as schema registration or issuer onboarding. Tokens issued through this API serve as access control mechanisms, ensuring that only authenticated and authorized entities can perform critical operations. * SIBERIA API: This API enables direct interaction with the private blockchain and the VDRs. It supports a wide range of functions, including issuer registration, schema registration, querying trusted issuers and schemas, and credential sharing, among others. These API layers are fundamental for ensuring modularity, security, and scalability within the SIBERIA architecture. By separating roles and scopes, the system enforces principle-based access control, ensuring that each actor interacts only with components relevant to their responsibilities. The identity wallet plays a pivotal role in managing digital identities for natural persons, serving as the primary interface for holders within the SSI framework. Designed exclusively for Android devices and strictly scoped to the private SIBERIA ecosystem, the wallet adheres to the core principles of SSI: user control, privacy, security, and portability. After completing the registration process with a username and password, the holder is automatically provisioned with a did:key identifier, a corresponding cryptographic key pair, and an associated DID document. In line with SSI principles, all identity-related data--keys, identifiers, credentials, and metadata--are generated and stored locally on the user's device, ensuring full user control without any form of external synchronization or centralized storage. Additionally, the wallet integrates biometric authentication, allowing users to link fingerprint-based access for enhanced security and convenience. Regarding credential management, the wallet provides functionality to receive VCs and to store and manage them locally on the device. The wallet also supports the generation of VPs, allowing the holder to selectively disclose one or more credentials. Each VP is constructed in compliance with the appropriate schema registered in the blockchain-based TSR, ensuring both structural and semantic validity. Once generated, the presentation is signed with the holder's private key, providing cryptographic proof of authenticity and integrity before it is securely shared with the verifier. To support device migration, the wallet allows exporting all user identity data (DID, keys, and credentials) in a secure JavaScript Object Notation (JSON) format. These data can then be imported into a new device, ensuring full user data portability. In addition to the components described above, the SIBERIA SSI architecture incorporates two databases, each serving distinct critical functions:  
* A database managed by the verifier that stores users' email addresses and passwords. This enables secure authentication and efficient account management. * A database managed by the issuer that maintains the status of credentials issued to holders, indicating whether a credential is active, suspended, or revoked. Importantly, this database stores only credential status, not the credential data itself. To facilitate efficient and privacy-preserving status verification, the issuer registers a proxy service within the TSR. This proxy acts as an intermediary, enabling verifiers to remotely query credential status stored in the issuer's database without communicating directly with the issuer. This design optimizes operational efficiency and enhances privacy by decoupling credential status checks from direct issuer interactions. This module--including the API and databases--integrates seamlessly with the overall SIBERIA SSI framework, complementing the blockchain-based verifiable data registries and the identity wallet to deliver a comprehensive, secure, and scalable SSI system.