Identity Management: Cornerstone to Confidential Communication
Neither Trust Zones, Software-Defined Networking, nor blockchain-based access management fully solve two challenges: the configuration effort for device APIs and communication protocols, and how to securely identify and authenticate devices.
Pre-Shared Keys
With pre-shared keys, devices come with a unique identifier, ideally hard-coded on a secure module. The controller shares a symmetric key for encrypted communication. However, the system doesn't scale easily as each new device must be provisioned.
Public-Key Infrastructure
A widespread and more secure alternative is public-key cryptography. Trusted authorities issue certificates to devices, guaranteeing identity and integrity. However, this requires operating your own PKI with certificate authority, registration authority, and more.
Self-Sovereign Identity
Instead of a PKI, identity infrastructure can be decentralized. Each identity holder receives a wallet with a Decentralized Identifier (DID). Thanks to asymmetric cryptography, proving ownership is extremely easy.
The key advantage: trust can be granted at a more granular level and issued and revoked in a more lightweight fashion. SSI functions as a generalization of a PKI – a "system of systems."
Where We Stand Today
SSI is an exciting architecture for identity-based access management, but technological maturity remains the greatest barrier. IoT device security has been neglected for too long, forcing manufacturers and administrators to focus on resilience and contingency planning.
Still, SSI- and blockchain-based access management can provide enhanced security for capable devices and enable deep business model innovation.