The IoT Exchange

TL;DR

The paper proposes the IoT Exchange, a decentralized platform for secure, flexible, and privacy-preserving data sharing and device management in the IoT ecosystem, inspired by early Internet exchange concepts.

Contribution

It introduces the IoT Exchange architecture utilizing decentralized identifiers and verifiable credentials for enhanced security, privacy, and interoperability in IoT data and device management.

Findings

Decentralized identifiers improve identity management.

Verifiable credentials enable privacy-preserving access control.

The system facilitates cross-platform IoT data exchange.

Abstract

The IoT ecosystem suffers from a variety of problems around security, identity, access control, data flow and data storage that introduce friction into interactions between various parties. In many respects, the situation is similar to the early days of the Internet, where, prior to the establishment of Internet Exchanges, routing between different BGP autonomous systems was often point to point. We propose a similar solution, the IoT Exchange, where IoT device owners can register their devices and offer data for sale or can upload data into the IoT services of any of the big hyperscale cloud platforms for further processing. The goal of the IoT Exchange is to break down the silos within which device wireless connectivity types and cloud provider IoT systems constrain users to operate. In addition, if the device owner needs to maintain the data close to the edge to reduce access latency, the MillenniumDB service running in an edge data center with minimal latency to the edge device, provides a database with a variety of schema engines (SQL, noSQL, etc). The IoT exchange uses decentralized identifiers for identity management and verifiable credentials for authorizing software updates and to control access to the devices, to avoid dependence on certificate authorities and other centralized identity and authorization management systems. In addition, verifiable credentials provide a way whereby privacy preserving processing can be applied to traffic between a device and an end data or control customer, if some risk of privacy compromise exists.