Practical and Secure NFT Access Control for Low-Cost IoT Devices via a Delegated Reputation Gateway

Abstract

The proliferation of Internet of Things (IoT) devices necessitates secure, scalable, and cost-effective access control mechanisms. While blockchain and Non-Fungible Tokens (NFTs) offer a decentralized paradigm for managing permissions, they remain vulnerable to off-chain resource exhaustion attacks and present practical implementation challenges for low-cost devices. This paper proposes a novel hybrid architecture that enhances NFT-based access control with an off-chain gateway acting as both a Smart Reputation System (SRS) and a delegated signer. This hybrid model combines fast, off-chain pre-validation with authoritative on-chain verification. The SRS serves as a security firewall, mitigating high-frequency invalid requests by dynamically managing the reputation of each device and imposing temporary bans on malicious actors. By delegating cryptographic signing to the gateway, low-cost IoT devices are absolved of managing private keys, significantly reducing their complexity and cost. An experimental evaluation of the implemented system was conducted to assess its resilience against Denial-of-Service attacks. The findings indicate that the system successfully neutralizes threats in under 3 seconds. During this process, a stable end-to-end latency of approximately 626 ms is maintained for legitimate users, with the gateway’s reputation logic introducing a negligible performance overhead of less than 1%. This hybrid approach proves to be a practical and effective solution for deploying secure and resilient access control in real-world IoT environments.