The document discusses using decentralized identifiers (DIDs) and verifiable credentials to enable trust and interoperability in the Internet of Things (IoT). It describes how traditional IoT systems face challenges with identity, authentication, authorization, and interoperability due to fragmented identification schemes. The presentation introduces DIDs as a new type of identifier that allows entities to prove control over digital identities. It also discusses how verifiable credentials and decentralized key management can improve trustworthiness for IoT devices and systems. The goal is to establish a common foundation for identity to simplify development of autonomous systems using connected devices and machines.

1. MACHINE IDENTITY
Decentralized Identifiers & Verifiable Credentials for
Trust & Interoperability in the Internet of Things
Mrinal Wadhwa
CTO @ Ockam
@mrinal
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
SSIMeetup.org

2. 1. Empower global SSI communities
2. Open to everyone interested in SSI
3. All content is shared with CC BY SA
SSIMeetup.org
Alex Preukschat @SSIMeetup @AlexPreukschat
Coordinating Node SSIMeetup.org
https://creativecommons.org/licenses/by-sa/4.0/
SSIMeetup objectives

3. I’m passionate about building systems where connected machines come together with intelligent algorithms to improve our lives.
AUTONOMOUS SYSTEMS
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

4. PLUMBING
But I spend most of my days doing what is best described as - digital plumbing.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

5. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
To illustrate, let’s think about how we may build this extremely simple autonomous system.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

6. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
How do we identify a person?
How do we authenticate them?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

7. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
How do we know they entered?
With a device?
How do we identify the device?
How do we authenticate the device?
Can we trust it?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

8. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
How do we identify a room?
Which people are authorized to
change this room’s temperature?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

9. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
How do we change temperature?
With a device?
How do we identify the device?
How do we authenticate the device?
Can we trust it?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

10. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE. What is room temperature?
Is it called temp, temperature or T?
Is it set in °C, °F or some other unit?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

11. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
How do we know their preferred temperature?
Is it called temp, temperature or T?
Is it set in °C, °F or some other unit?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

12. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
How do we identify a person?
How do we authenticate them?
How do we know they entered?
With a device?
How do we identify the device?
How do we authenticate the device?
Can we trust it?
How do we identify a room?
Which people are authorized to
change this room’s temperature?
How do we change temperature?
With a device?
How do we identify the device?
How do we authenticate the device?
Can we trust it?
How do we know their preferred temperature?
Is it called temp, temperature or T?
Is it set in °C, °F or some other unit?
What is room temperature?
Is it called temp, temperature or T?
Is it set in °C, °F or some other unit?
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

13. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
This seems hard, surely someone else has already built it.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

14. Found one with a quick google search, but it only works with Nest and IFFTT, our hardware is different :(.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

15. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
1000s of People Identity Systems
Google, Facebook, Apple, Active Directory,
Custom Apps etc.
1000s of phones, motion sensors, RFID reader etc.
100s of IoT platforms, proprietary systems etc.
100s of building management
systems and custom apps etc.
1000s of HVAC systems, Thermostats etc.
1000s of custom apps.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

16. IF A PERSON ENTERS A ROOM
CHANGE ROOM TEMPERATURE
TO THEIR PREFERENCE.
Also, this problem statement isn’t general enough, we like to write reusable code.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

17. IF A SHIPMENT ENTERS A CONTAINER
CHANGE CONTAINER TEMPERATURE TO
IDEAL TEMPERATURE OF SHIPMENT.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

18. IF AN ENTITY THAT HAS PREFERENCES,
IS DETECTED AS HAVING ENTERED AN AREA THAT CAN APPLY PREFERENCES
APPLY ALL ENTITY PREFERENCES THAT THE AREA CAN APPLY
THAT THIS ENTITY IS AUTHORIZED TO APPLY TO THIS AREA.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

19. PLUMBING
Most IoT developers spend most of their time dealing with this complicated plumbing, the magic is rare.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

20. SCALABILITY
SECURITY
PRIVACY
TRUST
RELIABILITY
All this plumbing complexity manifests as weaknesses in other key architectural requirements.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

21. BUILDING BLOCKS
Decentralized Identifiers (DIDs)
Knowledge Graphs
Semantic, Linked Data
Linked Data Signatures
Linked Data Proofs
Cryptography
DID Documents Verifiable Claims/Credentials
Authorization/Object CapabilitiesAuthentication
Shared Schemas & Ontologies
Blockchains
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

22. SCHEME
DECENTRALIZED IDENTIFIERS
did:ockam:2QyqWz4xWB5o4Pr9G9fcZjXTE2ej5
METHOD
METHOD SPECIFIC UNIQUE STRING
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

23. This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

24. If you have a DID string, you can resolve it to its DID Document via its Method.
We did not have this property of global uniqueness/resolvability across systems with older ID schemes.
This breaks silos.
GLOBALLY RESOLVABLE
ACCESS CONTROL ALGORITHM
did:ockam:2QyqWz4xWB5o4Pr9G9fcZjXTE2ej5 did:sov:2wJPyULfLLnYTEFYzByfUR
Device Identity People Identity
did:v1:nym:4jWHwNdrG9-6jd9..
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

25. DID DOCUMENTS
DID Documents are Linked Data documents that describe the DID, they contain the public keys of the DID, authentication methods, services etc…
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

26. CRYPTOGRAPHICALLY PROVABLE
If a device possess the corresponding private key, a device can cryptographically prove its identity.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

27. DECENTRALIZED KEY MANAGEMENT
DEVICE BACKEND
Backend public
Device secret
Backend secret
Device public
Sensed Data, Acknowledgements etc.
Control Instructions, Firmware &
Configuration updates etc.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

28. SERVICE DISCOVERY
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

29. SEMANTIC & LINKED DATA
The progress made by the open web community around Linked Data can be applied to IoT.
This brings semantic meaning and relationships to IoT data …
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

30. Instead of describing temperature as a key of my choosing “temperature”, “temp” or “T” …
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

31. Let’s describe it with well defined semantics.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

32. Now, two developers who have never met or coordinated can independently build a
temperature sensor and a controller that can work with each other.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

33. Now this data is about an entity (room) described by the above DID.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

34. VERIFIABLE CLAIMS
VALUESUBJECT
PROPERTY
SIGNED BY ISSUER
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

35. TEMPERATURE
VERIFIABLE CLAIMS
70ROOM
SIGNED BY ISSUER
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

36. VERIFIABLE CLAIMS
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

37. This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

38. WEB OF TRUST
CLAIM:BOM PLM System
CLAIM:Audit Security Auditor
REGISTERED
CLAIM:Firmware-V1 Software Update Service
did:ockam:2QyqWz4xWB5o4Pr9G9fcZjXTE2ej5
CLAIM:Firmware-V2 Software Update Service
CLAIM:Deployed On boarding Service
Key Rotated Device
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

39. ○ Was the device made by a reputable manufacturer?
○ Does the device have hardware based cryptography and secure key storage?
○ Does the device have unique identity and cryptographic keys?
○ Has the device been audited by a security auditing firm?
○ Is there a signed audit proof?
○ Are there any known vulnerabilities for the device hardware/software?
○ Does the device produce signed data and signed firmware
acknowledgements?
○ Does the device have the latest firmware?
○ Who installed the device? Who provisioned the device?
etc.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

40. TRUST ARCHITECTURE
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

41. AUTHENTICATION
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

42. This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

43. AUTHORIZATION
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

44. https://github.com/ockam-network/ockam
Decentralized Identifiers (DIDs)
Knowledge Graphs
Semantic, Linked Data
Linked Data Signatures
Linked Data Proofs
Cryptography
DID Documents Verifiable Claims/Credentials
Authorization/Object CapabilitiesAuthentication
Shared Schemas & Ontologies
Blockchains
Ockam is an open-source collection of tools that makes it simple to build connected solutions with these building blocks.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

45. Decentralized Identifiers (DIDs)
Knowledge Graphs
Semantic, Linked Data
Linked Data Signatures
Linked Data Proofs
Cryptography
DID Documents Verifiable Claims/Credentials
Authorization/Object CapabilitiesAuthentication
Shared Schemas & Ontologies
Blockchains
Hardware Key Storage & Cryptography Blockchains Light ClientsBattery Efficient Messaging & Transports
Zero Knowledge Proofs Private InteractionsSecure Zero Touch Onboarding
Bidirectional Signed/Encrypted DataSigned Firmware & Config Updates Service & Data format discovery
https://github.com/ockam-network/ockam
We’re also building open tools for several other related capabilities for IoT systems
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

46. https://github.com/ockam-network/did
We open sourced a Golang parser for DIDs, give it a try.
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).

47. MACHINE IDENTITY
Decentralized Identifiers & Verifiable Credentials for
Trust & Interoperability in the Internet of Things
Mrinal Wadhwa
CTO @ Ockam
@mrinal
This presentation is released under a Creative Commons license. (CC BY-SA 4.0).
SSIMeetup.org
@ockam_io
https://ockam.io

48. ● Robot by Vectors Market from the Noun Project
● pipes by Aleksandr Vector from the Noun Project
● valve by Ben Davis from the Noun Project
Attributions for images used in this deck: