Secure Ownership Management and Transfer of Consumer Internet of Things Devices with Self-sovereign Identity

TL;DR

This paper introduces a blockchain-based Self-sovereign Identity system for secure, user-centric ownership management and transfer of consumer IoT devices, addressing existing identity and ownership issues.

Contribution

It proposes a novel SSI framework leveraging blockchain, DIDs, and verifiable credentials for IoT ownership transfer, with a detailed architecture, protocol, and security analysis.

Findings

Successfully implemented a Proof-of-Concept system

Security verified using ProVerif tool

Demonstrated effective ownership transfer protocols

Abstract

The popularity of the Internet of Things (IoT) has driven its usage in our homes and industries over the past 10-12 years. However, there have been some major issues related to identity management and ownership transfer involving IoT devices, particularly for consumer IoT devices, e. g. smart appliances such as smart TVs, smart refrigerators, and so on. There have been a few attempts to address this issue; however, user-centric and effective ownership and identity management of IoT devices have not been very successful so far. Recently, blockchain technology has been used to address these issues with limited success. This article presents a Self-sovereign Identity (SSI) based system that facilitates a secure and user-centric ownership management and transfer of consumer IoT devices. The system leverages a number of emerging technologies, such as blockchain and decentralized identifiers (DID), verifiable credentials (VC), under the umbrella of SSI. We present the architecture of the system based on a threat model and requirement analysis, discuss the implementation of a Proof-of-Concept based on the proposed system and illustrate a number of use-cases with their detailed protocol flows. Furthermore, we analyse its security using ProVerif, a state-of-the art protocol verification tool and examine its performance.