Decentralized identifiers for securing device registration and software updates

A method comprising:

• receiving, by a data store and from a software publisher, a verifiable credential for a software update published by the software publisher, wherein the verifiable credential for the software update comprises a Decentralized Identifier (DID) of the software publisher and a location to obtain the software update;
• receiving, by the data store and from a device, a request for the software update, wherein the request for the software update includes a verifiable credential for the device, and wherein the verifiable credential for the device includes a DID of the device and;
• verifying, by the data store, the request based on the DID of the device, wherein verifying the request based on the DID of the device comprises:
• resolving, by the data store, the DID of the device to an associated DID document of the device,
• verifying, by the data store, the request using a key from the DID document of the device, and
• in response to verifying the request using the key from the DID document of the device, performing, by the data store, a lookup of the verifiable credential for the software update;
• and
• in response to verifying the request, returning, by the data store and to the device, the verifiable credential for the software update.

A device comprising:

• a memory;
• and
• processing circuitry in communication with the memory, the processing circuitry being configured to:
• send, to a data store, a request for a software update published by a software publisher, wherein the request includes a verifiable credential for the device, and
• wherein the verifiable credential for the device includes a Decentralized Identifier (DID) of the device;
• receive, from the data store, a verifiable credential for the software update, wherein the verifiable credential for the software update includes a DID of the software publisher;
• determine whether the software update is newer than a current software on the device;
• obtain the software update from the software publisher from a location specified by the verifiable credential for the software update, wherein, to obtain the software update from the software publisher, the processing circuitry is further configured to:
• resolve the DID of the software publisher to an associated DID document of the software publisher, wherein the DID of the software publisher is included in the verifiable credential for the software update,
• verify the verifiable credential for the software update using one or more keys specified in the DID document of the software publisher, and
• in response to verifying the verifiable credential for the software update, obtain the software update from the software publisher;
• verify the software update based on the verifiable credential for the software update;
• and
• in response to verifying the software update based on the verifiable credential for the software update, install the software update.