BLOCKCHAIN-BASED ARCHITECTURE FOR DECENTRALIZED IDENTITY AND ACCESS MANAGEMENT IN INTERNET OF THINGS SYSTEMS

Abstract

The rapid expansion of Internet of Things (IoT) devices poses significant challenges for traditional centralized identity and access management (IdM) systems, which suffer from scalability limitations, single points of failure, and notable privacy risks. Although blockchain technology presents a promising decentralized solution, its direct adoption is often constrained by limited transaction throughput, high operational costs, and the computational constraints of IoT devices. To address these issues, this study proposes and rigorously evaluates HybID-AC, a novel hybrid architecture for decentralized identity and access management, specifically designed for large-scale, heterogeneous IoT ecosystems. HybID-AC employs a dual-layer design that separates global trust anchoring from local execution. A highly scalable, feeless Directed Acyclic Graph (DAG)-based distributed ledger functions as a public anchor layer, registering W3C-standard Decentralized Identifiers (DIDs) and access policy hashes. High-frequency access control operations are handled off-chain at the edge layer, leveraging the DIDComm v2 peer-to-peer protocol, Attribute-Based Access Control (ABAC) for fine-grained policy enforcement, and Zero-Knowledge Proofs (ZKP) to preserve attribute privacy. Analytical results demonstrate that the HybID-AC architecture significantly improves latency and cost-efficiency compared to fully on-chain approaches, maintaining stable performance even as network scale increases. Additionally, a novel probabilistic model is introduced to provide a quantitative measure of the integral security risk of ABAC policies under potential attribute compromise. Overall, the study concludes that this hybrid architecture effectively addresses the inherent trade-offs of blockchain in IoT systems, delivering a secure, scalable, and interoperable framework that empowers devices with self-sovereign identity while ensuring privacy and security by design.