  The emerging Self-Sovereign Identity (SSI) techniques, such as Decentralized
Identifiers (DIDs) and Verifiable Credentials (VCs), move control of digital
identity from conventional identity providers to individuals and lay down the
foundation for people, organizations, and things establishing rich digital
relationship. The existing applications of SSI mainly focus on creating
person-to-person and person-to-service relationships, whereas person-to-device
and device-to-device interactions have been largely overlooked. In this paper,
we close this gap by identifying a number of key challenges of applying SSI to
the Internet of Things (IoT) and providing a comprehensive taxonomy and usage
of VCs in the IoT context with respect to their validity period, trust and
interoperability level, and scope of usage. The life-cycle management of VCs as
well as various optimization techniques for realizing SSI in IoT environments
are also addressed in great detail. This work is a noteworthy step towards
massive adoption of SSI for securing existing and future IoT applications in
practice.
