Chapter 5: Decentralized Identity Management

The ERATOSTHENES project aims to revolutionize identity management in IoT systems by leveraging Self-Sovereign Identity (SSI) principles, which allow IoT devices to maintain control over their digital identities throughout their lifecycle. Traditional centralized identitymanagement systems often face scalability and securityissues when applied to IoT environments, which contain a vast number of inter-connected devices. By contrast, SSI offers a decentralized approach that not only enhances security and privacy but also simplifies identity management processes.

The Ledger uSelf SSI solution, a core innovation of the ERATOSTHENES project, plays a pivotal role in this decentralized framework. This solution integrates key components such as the PUF client, VDR-fabric, Advanced Data Protection (ADP) module, and the Identity Recovery Mechanism to provide a holistic identity management system. Through the creation ofDecentralized Identifiers (DIDs) and Verifiable Credentials (VC), IoT devices are empowered with unique, cryptographically secure identities that can be used for authentication and authorization. These identities are self-managed, allowing devices to independently prove their identity while maintaining privacy, reducing the risks oftracking, profiling, or identitytheft.

The importance of SSI in IoT environments lies in its ability to address the specific challenges that come with managing billions of devices, each with different hardware and software requirements. Ledger uSelf has been designed to accommodate these constraints, offering flexibility through environmental configurations that support the deployment across various devices. Furthermore, the system’s integration with advanced cryptographic techniques, such as privacyenhancing Attribute-Based Credentials (p-ABC), ensures minimal data disclosure and enhances security through zero-knowledge proofs.

By applying SSI principles, the ERATOSTHENES project not only ensures secure device onboarding, identity verification, and authorization processes but also builds a zero-trust framework that aligns with modern privacy regulations. The use of disposable identities further bolsters privacy by creating unique identifiers for specific interactions, minimizing the risk of tracking.

In conclusion, the ERATOSTHENES project demonstrates the potential of SSI in transforming identity management for IoT devices, offering a scalable, privacycentric, and secure solution that addresses the challenges of the increasingly interconnected digital landscape. The Ledger uSelf solution exemplifies the project’s commitment to advancing secure, decentralized identity management in the IoT domain.

Decentralized Identity represents a paradigm shift in how individuals, machines and IoT devices manage and control their digital identities. Traditional identity systems are typically centralized or federated, where a central authority, such as a government or large tech company, is responsible for verifying and controlling an individual’s identity. This centralized approach is vulnerable to data breaches, privacy violations, and the concentration of power in single entities, leading to concerns about trust, security, and privacy.

Since IoT environments are typically distributed and highly dynamic, decentralized identity management has emerged as a transformative solution for addressing the challenges posed by centralized identity systems. Key principles such as self-sovereignty, verifiable credentials, trustless networks, and data minimization enable IoT devices to authenticate and interact securely, without over-exposing sensitive data. In contrast to traditional systems, decentralized identity reduces the risks of data breaches, enhances user control, and scales better with the exponential growth of IoT devices, making it a vital innovation in securing the future of IoT networks.

One of the primary objectives of the ERATOSTHENES project is to implement a Decentralized Identity Management system based on the Self-Sovereign Identity (SSI) paradigm throughout the entire lifecycle of IoT devices.

The Self-Sovereign Identity (SSI) community is still in an early stage ofdefinition and implementation, and as a result, many ofits main standards are continuously evolving, adapting, and being refined. Despite these changes, there is consensus within the community regarding the core building blocks needed to design and implement solutions following the SSI paradigm. These standards are essential for ensuring interoperability and security in decentralized identity systems. This chapter out lines the main findings related to these standards and how they will be applied in the solution developed for the ERATOSTHENES project.

The building blocks for SSI can be classified into tree main groups: standards that define the format of identity information, standards that define how identity information is transmitted between different actors, stakeholders and credential standard formats.

In this category, two key standards from the World Wide Web Consortium (W3C)¹ play a crucial role:

• W3C — Decentralized Identifiers (DID)²: This standard defines a method for generating unique identifiers in a decentralized environment. DIDs are Uniform Resource Identifiers (URIs) that link a DID subject (such as a person, organization, or IoT device) with a DID Document. This DID Document contains cryptographic information, including public keys, which enable trusted interactions with the subject. The cryptographic proofs facilitate services like verification and authentication, essential for securing digital identities.

  The DID specification also introduces DID methods, which define how the DIDs are created, resolved, updated, and deactivated across various decentralized registries. The ERATOSTHENES project will implement two DID methods:

  • ○did:web⁹: This DID method, defined by W3C, uses standard web infrastructure to host DID Documents. It is particularly useful when decentralized registries are not needed, allowing DIDs to be hosted on trusted websites.

  • ○did:erat: This is an ad-hoc DID method developed specifically for the ERATOSTHENES project. It stores DID Documents within Hyperledger Fabric, a permissioned blockchain framework developed for the project. This approach ensures that identities are managed securely within a controlled, permissioned environment.

A Decentralized Identifier (DID) follows a structured format, as illustrated in the image below. It is a simple text string consisting of three main components: the DID URI scheme identifier, the identifier for the specific DID method, and the method-specific unique identifier

As mentioned before, the DID resolves to a DID Document that contains the DID and the associated cryptographic information such us public keys or verification methods, which are essential for authentication and verification processes. In the figure below shows an example of a DID Document that uses the “did:erat” method.

• W3C - Verifiable Credentials (VC)⁴: VC offer a cryptographic mechanism to express and verify claims about an entity (such as an IoT device or individual) in a privacy-preserving and machine-verifiable manner. These credentials are essential for ensuring that sensitive data, like identity or device attributes, can be shared securely across decentralized networks. VCs are structured into three main roles:

  • ○Holder: The entity possessing one or more verifiable credentials and generating verifiable presentations from them. For instance, in an IoT context, the holder could be a device carrying a certificate of authenticity. Holders include students, employees, and customers.

  • ○Issuer:The entity responsible for creating a verifiable credential by asserting claims about a subject. Examples include corporations, governments, nonprofit organizations, trade associations and individuals issuing credentials that confirm device provenance or user identity.

  • ○Verifier: The entity responsible for receiving and validating verifiable credentials, often in the context of access control or authentication. Examples include services that validate the credentials of devices before allowing them onto a secure network that might include employers, security personnel, and websites.

  • ○Verifiable Data Registry: a system that mediates the creation, verification, and revocation of credentials. It maintains public keys, credential schemas, and revocation registries to ensure that credentials are valid and trustworthy.

The following figure shows the different roles in action and how they interact with each other.

In addition to defining the format of identityinformation, the Self-Sovereign Identity (SSI) community has proposed several standards to address how identity information that is transmitted between different roles and stakeholders. Two prominent standards in this area are:

• DID Communication Messaging (DID Comm) v2.0⁵ is a communication protocol that facilitates secure and confidential messaging between stakeholders when interchanging identity information. It is designed to enable verifiable data exchange between SSIactors while maintaining privacy and security. This standard provides a robust mechanism for transmitting identity information across decentralized networks. DID Commv 2.0 defines protocols and workflows that specify how different SSI operations are executed, such as issuing credentials or presenting proof of a verifiable credential. These workflows enable the seamless exchange of identity-related information between holders, issuers, and verifiers. DIDComm also supports encryption, digital signatures, and message integrity checks, ensuring that identity information cannot be tampered with during transmission.

  Importantly, DIDComm v2.0 was specifically designed for Self-Sovereign Identity solutions, making it tailor-made for decentralized identity use cases. Major projects within the SSI community, such as Hyperledger Indy and Hyperledger Aries, utilize DIDComm to enable trusted communication between decentralized entities. By using DIDComm, decentralized identities can securely interact in a privacy-preserving way without needing intermediaries or central authorities. This communication framework allows for flexible and scalable identity management, which is essential for large-scale IoT systems, where billions of devices must interact securely.

• Self-Issued OpenID Provider (SIOP) v2.0⁶ extends the widely adopted OpenID Connect protocol by introducing the concept of a Self-Issued OpenID Provider (Self-Issued OP). Unlike traditional OpenID Providers (OPs), which are controlled by third parties, a Self-Issued OP is fully controlled by the end-user. This means that individuals or entities can self-issue ID Tokens and present self-attested claims directly to Relying Parties (such as service providers), without needing a central authority to validate those claims. This approach aligns with the principles of SSI, as it empowers users to manage their own identities while interacting with services that rely on identity verification. SIOP v2.0 provides a way to bridge SSI solutions with existing identity management systems, making it possible to integrate modern, decentralized identities into traditional federated systems.

As previously mentioned, the Self-Sovereign Identity (SSI) community is still in the early stages of defining and implementing its core concepts. Consequently, the primary standards are continuously evolving and adapting. During the ERATOSTHENES project, the W3C Verifiable Credential⁷ standard was updated to support the JSON Web Token (JWT) format, which is a significant advancement.

JWT is an open standard that provides a compact and self-contained way of securely transmitting information between parties in the form of a JSON object. The data it carries can be verified and trusted because the tokens are cryptographically signed.

By incorporating support for JWT, the W3C Verifiable Credential standard simplifies the integration of verifiable credentials with existing Identity Management systems that already utilize the JWT format. This is particularly beneficial for systems based on OpenID Connect, making it easier to incorporate SSI principles without a complete overhaul of legacy infrastructure.

The following figures illustrate an example of how to apply the JWT format to verifiable credentials. The first Figure 5.4 displays a credential in JSON format, which includes the “credentialSubject” field that is used to hold the claims associated with the subject.

Figure 5.5 illustrates the same verifiable credential as before, but this version includes the “proof ” field, which contains the cryptographic data required to verify the integrity of the credential. The proof field ensures that the claims made within the credential can be trusted by allowing verifiers to check the credential’s digital signature or other cryptographic elements. This feature has been present in earlier versions of the standard and remains a critical component for establishing trustworthiness in verifiable credentials.

Figure 5.6 presents the same credential, this time shown in its decoded JSON Web Token (JWT) format. Readers familiar with tokens used in OpenID Connect will notice significant similarities between this format and the structure used in traditional Identity Management protocols. This resemblance allows for easier integration between modern Self-Sovereign Identity systems and legacy identity frameworks.

Lastly, Figure 5.7 illustrates a verifiable credential encoded in JSON Web Token (JWT) format.

The addition of JSON Web Token (JWT) support to verifiable credentials simplifies their integration with legacy Identity Management systems by allowing credentials to be included in request headers, similar to OpenID and OAuth. The ERATOSTHENES consortium has adopted these changes to enhance their SelfSovereign Identity solution for managing the entire lifecycle of IoT devices, from onboarding to decommissioning.

Selective Disclosure JWT (SD-JWT)⁸ is an extension of the standard JWT that introduces the capability for selective disclosure of information. In SSI contexts, selective disclosure is a critical privacy feature because it allows users to share only specific pieces of their credentials with verifiers, rather than the full set of claims.

The process of issuing a Verifiable Credential with selectively hidden claims is outlined as follows. First, the Verifiable Credential (VC) is created. Then, the issuer designates specific claims as selectively disclosable by generating disclosures. These hidden claims are incorporated into the credential, producing an SD-JWT that conforms to a data model compatible with a Verifiable Credential containing concealed claims.

The process of issuing a Verifiable Credential with hidden claims is illustrated in Figure 5.8. First, a Verifiable Credential (VC) is created. After that, the issuer marks specific claims as selectively hidden, generating disclosures. These hidden claims are then embedded into the credential. The final result, known as SD-JWT, follows a data structure that ensures it is compatible with a Verifiable Credential containing concealed claims.

The following section outlines the process of issuing a credential using real data. The first step involves collecting the necessary information and formatting it in accordance with the W3C Verifiable Credentials Data Model v1.1⁹ standard. The figure below shows an example of a verifiable credential that is prepared for issuance.

The next step involves calculating the disclosure values byapplying the SHA-256 hashing method.

With the disclosed values, the Verifiable Credential is formed.

For issuing the credential, it must be in JWT format. The process is illustrated in the image below.

Figure 5.12 shows an example that includes both the signed SD-JWT and the disclosure information, which are separated by a “~” character.

The following Figure 5.13 provides a detailed view of the format used.

This standard builds upon the SD-JWT approach byincorporating specific updates from the latest W3C Verifiable Credentials Data Model 2.0, which introduces several changes from previous versions. Among these updates is the addition of new parameters, such as the “vct” parameter, which defines the type of content in a Verifiable Credential (VC). The “vct” parameter dictates rules regarding which claims can or must be included in the Unsecured Payload of the SD-JWT VC,¹⁰ and whether these claims can be selectively disclosed. While the standard does not specify preset “vct” values, it expects individual ecosystems to define them, including the corresponding semantics and rules for issuing and validating credentials.

The “vct” parameter is represented by a unique URI, such as “https://credentials.example.com/identity_credential”. For instance, this credential type specifies that certain claims, like given_name, family_name, birthdate, and address, are mandatory in the Unsecured Payload. Additionally, other claims such as email, phone_number, and private claims like is_over_18 or is_over_21 may be included. The standard also allows selective disclosure of these claims when needed.

The diagram in Figure 5.14 illustrates the ERATOSTHENES architecture, highlighting the main components and services developed by the project. The lower section of the diagram (in purple) represents the elements embedded in IoT devices, while the upper section shows the servers that host the various ERATOSTHENES framework services.

Focusing specifically on the components responsible for the project’s SelfSovereign Identity (SSI) solution, the architecture includes two key elements: the SSI Management service on the server side and the SSI Agent within the IoT devices. The SSI Management service, known as the Ledger uSelf IdM component, operates on the server, while the SSI Agent, referred to as the Ledger uSelf IoT component, is deployed directly on the IoT devices. Although not explicitly shown in the diagram, the Context-aware component has been fully integrated within the Ledger uSelf IoT, ensuring seamless functionality across the SSI solution.

The Ledger uSelf solution plays a pivotal role within the IoT device architecture, integrating several essential components that enhance both security and functionality:

• Context-Aware Component: This module enables the collection of crucial hardware and software information necessary to create a verifiable credential, which includes a unique device footprint for enhanced identification and authentication.

• PUF Client and PUF Library: These components utilize Physical Unclonable Functions (PUF), a form of hardware-based cryptography, to generate the public DID (Decentralized Identifier) associated with the device. This ensures robust device identification.

• p-ABC Module: This module provides advanced cryptographic capabilities that enable the generation of verifiable presentations and zero-knowledge proofs. This ensures that only necessary data is disclosed, protecting the privacy of the device’s credentials.

• Verifiable Data Registry Fabric (VDR-Fabric): This module is responsible for generating public DIDs by leveraging a Hyperledger Fabric network. It stores DID documents, playing a crucial role in establishing the public DID for the device during the onboarding process.

• Advanced Data Protection (ADP) Module: The ADP module is designed to securely store identity information within the device. It also acts as a bridge to the Trusted Execution Environment (TEE), ensuring that sensitive identity data is protected.

• Identity Recovery Mechanism: This feature ensures that even in cases of device loss or replacement, the continuity and security of IoT data management are maintained, allowing for smooth identity recovery.

The Context Aware component is specifically designed to assist in identifying IoT devices. While individual hardware and software characteristics alone may not be enough to distinctly identify adevice, their combined use can form a unique profile. This combination of attributes creates a signature that helps in the recognition of each IoT device.

The key goal of this component is to generate a unique identifier that can be used in Authentication and Authorization services. In alignment with the Self-Sovereign Identity (SSI) model used by the ERATOSTHENES project, the unique footprint of the device is transformed into a verifiable credential. This verifiable credential is issued, signed, and secured by a Trusted Entity during the device’s onboarding process. Once issued, this credential can be used within any SSI-compliant authentication framework.

Figure 5.16 illustrates the step-by-step process of gathering unique information from an IoT device, with access to this data dependent on the user’s permission level. Superuser or root permissions allow for broader access to device information, while users with lesser permissions have more restricted access. This feature enables the service to generate distinct device profiles for each case. In the ERATOSTHENES project, it is expected that the process will typically run with superuser permissions. However, the component is also capable of generating a device footprint even when root access is not available, ensuring a flexible approach that strengthens the security of the overall process.

The primary purpose of the Ledger uSelf IoT component is to provide identity management for IoT devices within the ERATOSTHENES project, adhering to the principles of Self-Sovereign Identity (SSI). To meet the project’s specific needs, this component has been designed as a single executable, integrating all necessary functions. This design choice simplifies the installation, management, and execution of the identity solution for IoT devices.

The final architecture of the SSI solution for the ERATOSTHENES project has been optimized to meet the project’s unique requirements. Built on the Hyperledger Aries framework, the Ledger uSelf component acts as the core of the system, integrating with other essential project modules. Enhancements have been made to boost performance, add new features, and ensure smoother integrations. The solution is initially deployed in a containerized environment, which not only enhances operational efficiency but also facilitates better performance and scalability as new features are introduced.

The key features of the Ledger uSelf solution will be outlined in the following sections.

The process of creating a Public Decentralized Identifier (DID) involves generating a unique identifier for the IoT device and developing a corresponding DID Document that adheres to the W3C DID specifications. This step is crucial for the onboarding process, as it establishes the device as a recognized participant within the system. The Identity Management component of the project plays a significant role in this functionality.

To accommodate the diverse needs ofthe ERATOSTHENES project, the system offers two methods for publishing the public DID:

• did:web This method follows established DID standards.

• did:erat A custom method specifically developed for the ERATOSTHENES project, this approach enables the DID to be published on a permissioned blockchain using Hyperledger Fabric. This ensures secure storage of decentralized identifiers while leveraging blockchain technology. The system incorporates the vdr-erat component, which includes a gRPC server and a Verifiable Data Registry (VDR), as illustrated previously in Figure 5.15.

The generation of cryptographic materials within the Ledger uSelf IoT is dynamic and involves three main sources:

1. PUF Client Library: This source produces physically unclonable cryptographic keys.

2. dP-ABC Module: This module offers cryptographic functionalities for generating derived verifiable presentations.

3. Hyperledger Aries: The framework manages its own cryptographic material generation.

This method facilitates connections with other entities using the DID Exchange Protocol 1.0 and the Out-Of-Band Protocol (OOB) 1.1, as specified by Aries. Establishing a connection is essential for implementing any of the DID Communication standards.

To initiate a connection, each participant must generate a unique DID peer, followed by the exchange of these DIDs. This exchange enables secure communication between participants, utilizing the cryptographic methods linked to their respective DIDs.

From the device’s perspective, the connection setup process is straightforward. The agent can simply invoke the connection functionality via the server-side URL, streamlining the establishment of the connection (see Figure 5.18 below).

The management of Self-Sovereign Identity (SSI) is vital for the enrollment of IoT devices, as it involves issuing verifiable credentials that authenticate and authorize device identity attributes. Enrolling devices in the ERATOSTHENES framework formally registers them as members of its ecosystem, marking the second phase of the onboarding process, which begins with creating a Decentralized Identifier (DID).

The onboarding starts when the Ledger uSelf IoT component receives an onboarding request. Two primary tasks are performed: generating a public DID and registering it in the Identity Manager (IdM). The creation of a public DID includes generating a unique identifier for the device and constructing a corresponding DID Document that complies with the W3C DID standards. This process relies on cryptographic keys generated from three distinct sources, which are specified through environmental variables during installation.

The Ledger uSelf IoT component operates with a Hyperledger Aries agent, allowing flexibility to adapt to the specific requirements of the ERATOSTHENES project. After obtaining the necessary cryptographic keys, the system generates the DID Document using one of two methods: did:web or did:erat. Once the new DID is published, the device registers with the Ledger uSelf IdM agent and generates a verifiable credential that encapsulates its unique identity attributes, requesting the trusted entity to issue this credential (see Figure 5.19 below).

The implementation of this feature adheres to the guidelines established in the Issue Credential Protocol 2.0¹¹ from Hyperledger Aries and aligns with the DID Comm Messaging¹² standards set by the Identity Foundation. This protocol recognizes that communication between the Issuer and the Holder can be asynchronous, accounting for potential delays when the end user interacts with the system through a mobile or web wallet. However, adaptations have been made for situations requiring synchronous communication with IoT devices.

The process, illustrated in Figure 5.20, begins with the IoT device establishing a secure connection with the domain agent. Once the connection is in place, the Ledger uSelfIoT agent proposes to initiate the issuance process to the Ledger uSelf IdM component, pending the issuer’s agreement. This proposal includes a unique thread ID to track the process.

With the thread ID secured, the device then requests the Ledger uSelf IdM to issue the credential, providing the necessary verifiable credential content as a parameter. Upon receiving the signed verifiable credential from the issuer, the device stores it for future use.

The Present Proof feature enables IoT devices to prove ownership of a verifiable credential by presenting it to a verifier. This functionality is implemented in accordance with Hyperledger Aries’ Present Proof Protocol 2.0¹³ and complies with the DID Communication standards established by the Decentralized Identity Foundation (DIF).

The process typically begins with the device establishing a secure connection with the verifier. Once connected, the verifier provides a thread ID and defines the criteria for the proof. The device then searches its stored credentials to find one that matches the verifier’s requirements. After identifying the appropriate credential, the device generates a verifiable presentation, demonstrating ownership of the credential. The presentation is then sent to the verifier for validation. If successful, the proof is accepted, allowing further steps in the process to proceed.

This feature allows IoT devices to create a verifiable presentation that proves their ownership and confirms their successful onboarding into the system. The process begins by retrieving the verifiable credential issued during onboarding. The device then uses this credential to generate a new verifiable presentation, which is re-signed for added security. Finally, the signed presentation is sent back to the device, confirming its authenticity and integration into the system.

Disposable identities are temporary and limited-use identifiers, making them ideal for IoT devices in Self-Sovereign Identity (SSI) systems. Their short lifespan enhances privacy by preventing tracking and reducing the risk of identity theft, as a unique identifier is created for each interaction. This approach ensures that devices retain control over their data while complying with privacy standards.

In ERATOSTHENES, the disposable identity feature can be tailored to specific project needs through the configurable variable “USELF_EXPIRATION_TIME,” which defines the identity’s validity period in minutes. Once the IoT device is onboarded, its identity is created with a set expiration time. The “present proof” function is used to confirm ifthe identityremains valid. If expired, the system signals that the “verifiable presentation” is no longer valid. Additionally, the verifiable credential includes an “expirationDate” field, indicating when the credential will expire in a standard UTC format, ensuring clear timing for all parties involved.

In recent times, significant advancements have occurred in the realm of SelfSovereign Identity (SSI), particularly within the European Union (EU). The EU has taken major steps towards establishing a unified framework for European Digital Identity. This initiative, aimed at benefiting all EU citizens, residents, and businesses, is grounded in decentralized identity management technologies. To support this, the EU has introduced a new regulation on electronic identification and trust services, known as eIDAS 2.0.¹⁴ This regulation mandates that Member States provide digital wallets that link national digital identities with various personal attributes (such as driving licenses, diplomas, and bank accounts).

While the technical details ofthe European Digital Identity framework are still being refined, an important document, the Architecture and Reference Framework (ARF),¹⁵ outlines the key elements of the system. The ARF, in its latest version, defines the use of several core standards related to Self-Sovereign Identity. These include:

• W3C Verifiable Credentials Data Model 1.1 (W3C VC-DM)¹⁶: A framework for creating verifiable credentials that allow individuals to share trustworthy, tamper-evident digital credentials.

• OpenID for Verifiable Credential Issuance (OpenID VCI)¹⁷: A protocol for issuing verifiable credentials through OpenID Connect standards.

• OpenID Connect for Verifiable Presentations (OpenID VP)¹⁸: Facilitates the presentation of verifiable credentials using OpenID Connect.

• Selective Disclosure for JWTs (SD-JWT)¹⁹: Enables users to selectively disclose information from JSON Web Tokens (JWTs), ensuring greater privacy control.

• SD-JWT-based Verifiable Credentials (SD-JWT VC)²⁰: Extends SD-JWT for verifiable credentials, allowing users to selectively disclose specific claims from their identity information.

The Ledger uSelf solution for the ERATOSTHENES project adheres to all relevant standards and integrates cutting-edge advancements in identity management technology. Its implementation includes innovations such as p-ABC (privacyAttribute-Based Credentials) cryptography.

The solution holistically addresses the challenges of IoT identity management, starting from the creation of a root of trust for device identities, followed by enrollment, identification, and ongoing participation in a zero-trust and privacypreserving framework for authorization. It supports Self-Sovereign Identity (SSI) principles for direct authentication and enables delegation of the authorization process to a Policy Decision Point (PDP) and Policy Enforcement Point (PEP) infrastructure. Furthermore, Distributed Ledger Technologies (DLTs) are employed to securely manage data, such as policies and trust scores, while preserving privacy using SSI methodologies.

An important innovation is the integration of p-ABCs with the W3C Verifiable Credentials (VC) specification. This combination allows for minimal disclosure and unlinkability, offering better privacy protection compared to other implementations like JWT-SD. This breakthrough addresses one of the previous limitations of p-ABCs, which lacked interoperability with other identity solutions, enhancing both scalability and efficiency.

Ultimately, the Ledger uSelf solution provides a flexible application of technologies, balancing security, privacy, and computational costs to cater to the diverse nature of IoT scenarios.

The ERATOSTHENES project has successfully achieved one of its core objectives: developing a decentralized identity management system grounded in SelfSovereign Identity (SSI) principles for IoT devices throughout their lifecycle. This SSI approach represents a significant leap forward, offering a decentralized, user-controlled identity management framework that contrasts with traditional centralized systems. By empowering IoT devices with autonomy over their identities, the solution greatly simplifies the complexities of device management while ensuring greater security and privacy.

In terms of technological development, the project concentrated on the integration and deployment of key components within IoT devices. The Ledger uSelf solution, in particular, serves as the central identity management component, seamlessly incorporating other essential features such as the PUF client, p-ABC cryptography, VDR-fabric, Advanced Data Protection (ADP) module, and the Identity Recovery Mechanism. These components were developed across multiple work packages, ensuring the solution meets the security, scalability, and performance needs of IoT environments.

A significant achievement in this project was the successful adaptation of these components to the specific hardware and software constraints of IoT devices, ensuring compatibility and ease of deployment. The modularity of the Ledger uSelf framework not only supports the devices used within ERATOSTHENES but also demonstrates the potential for broader application across various IoT systems. This adaptability allows for straightforward installation, execution, and management on different types of devices, offering a flexible, scalable solution that can be ported to other IoT contexts beyond the project.

In conclusion, the ERATOSTHENES project has created an innovative decentralized identity management framework that simplifies IoT device management while providing strong privacy, security, and scalability benefits, positioning it as a pioneering solution for the future of IoT identity systems.