An important cryptographic mechanism that guarantees confidentiality (the zero-disclosure property) and ensures that it is impossible to prove a false statement to the verifier is zero-disclosure proofs. A popular implementation of zero-disclosure proofs is short, noninteractive proofs that can be quickly verified and that do not require interaction between the parties after the initial setup. The main direction in the development of modern proof systems is interactive proof, which is built in two steps. The first is sending a confirmation of the polynomial of an interactive oracle proof and the second is creating correct oracles of the polynomial commitment scheme using well-defined cryptographic methods for evaluating polynomials. Verifying the use of the same coefficients in each linear combination requires checking both polynomial consistency and variable consistency. To construct general schemes of concise non-interactive zerodisclosure knowledge argument, an interactive oracle proof polynomial was proposed that models messages as polynomial oracles. All tests are proved using polynomial commitment schemes and then evaluated with zero knowledge at a point specified by the person verifying the information. The reliability and confidentiality of all tests are based on three main categories of interactive oracle proof polynomials, namely polynomial commitment schemes with conjunction, with inner product argument and with code theory. The protocols of concise noninteractive zero-disclosure knowledge arguments are implemented through high-level programs (compilers), which are converted into an intermediate representation, i.e. a scheme defined by a system of constraints. The compilers used are divided into domain-oriented languages, embedded domain-oriented languages, and zero-knowledge virtual machines. Specialized domain-oriented hardware description languages or programming languages offer an adapted syntax for efficiently expressing constraints in arithmetic schemes. Embedded domain-oriented languages are implemented as functions in general-purpose programming languages and are oriented to the overhead schemes inherited from the embedded language. Zero-knowledge virtual machines process the opcode of the fetch-decodeexecute cycle, replicating the computation trace for general programs and generating corresponding zeroknowledge proofs. They are compatible with existing high-level programming languages and can use the features of existing compilers. Compilers are evaluated for cross- or syntactic compatibility. In general, the biggest obstacle to using non-interactive proof libraries is the lack of documentation. Standardization can help developers compare important features across libraries and establish a more consistent performance baseline. Library documentation for these core features is implicit, and developers need to understand the underlying cryptographic techniques to choose an appropriate scheme. Standardization of compiler options is important, making it difficult to reuse existing tools.
Ziqiao Kong, Xia, Wanxu, Zhengwei Li, Yi Lu · 9 authors
Move is a resource-oriented programming language designed for secure and verifiable smart contract development and has been widely used in managing billions of digital assets in blockchains, such as Sui and Aptos.Move features a strong static type system and explicit resource semantics to enforce safety properties such as the prevention of data races, invalid asset transfers, and entry vulnerabilities. However, smart contracts written in Move may still contain certain vulnerabilities that are beyond the reach of its type system. It is thus essential to validate Move smart contracts. Unfortunately, due to its strong type system, existing smart contract fuzzers are ineffective in producing syntactically or semantically valid transactions to test Move smart contracts. This paper introduces the first fuzzing framework, Belobog, for Move smart contracts. Belobog is type-aware and ensures that all generated and mutated transactions are well-typed. More specifically, for a target Move smart contract, Belobog first constructs a dependency graph based on Move's type system, and then generates or mutates a transaction based on the graph trace derived from the dependency graph. In order to overcome the complex checks in Move smart contracts, we further design and implement a concolic executor in Belobog. We evaluated Belobog on 109 real-world Move smart contract projects. The experimental results show that Belobog is able to detect 100% critical and 79% major vulnerabilities manually audited by human experts. We further selected two recent notorious incidents in the Move ecosystem, i.e., Cetus and Nemo. Belobog successfully reproduced full exploits for both of them, without any prior knowledge. Moreover, we applied Belobog on three ongoing auditing projects and found 2 critical, 2 major, and 3 medium new vulnerabilities, all acknowledged by the project developers.
In the contemporary global job market, the secure and efficient verification of a candidate’s academic qualifications presents a significant challenge, particularly across international boundaries. Conventional techniques frequently necessitate physical documents or PDF scans, rendering them inefficient, susceptible to falsification, and hazardous about privacy. This study presents a contemporary, scalable framework that integrates Zero-Knowledge Proofs (ZKPs), blockchain technology, and decentralized storage (IPFS) to establish a secure, privacy-oriented method for candidate verification. In this proposed system, candidates submit their academic documents, which are digitally signed by the issuing universities using cryptographic methods. The signed files are preserved on IPFS, guaranteeing their integrity and accessibility. The hash of each document is then stored on a blockchain, either Ethereum or Polygon, offering a public and immutable reference. Zero-Knowledge Proofs enable candidates to validate the legitimacy of their credentials while safeguarding sensitive information. Human Resources teams can authenticate these documents in real time, validating their integrity against the blockchain hash while preserving the candidate’s confidentiality. The evaluation results demonstrate that Ethereum offers robust decentralization and trust; nevertheless, Polygon proved to be more pragmatic because to its reduced gas price and expedited transaction times, making it suitable for high-volume recruitment. This proposed initiative addresses weaknesses in digital recruitment by guaranteeing trust, privacy, and automated credential verification procedure. It provides a customized approach for present recruitment requirements, particularly for organizations engaged in cross-border hiring, where security, scalability and protection of candidate information are paramount.
The growth of cloud computing in the healthcare field has led to significant developments, but ensuring the confidentiality and protection of medical records such as electronic health records (EHRs) remains a major concern for healthcare service applications. In cloud computing, the basic authentication provided by most service providers is insufficient to ensure secure access to critical or sensitive resources. Moreover, most of the existing healthcare management systems are ineffective in handling a number of patient data, which leads to single points of failure. To address these issues, elliptic curve cryptography (ECC) with Curve25519 is utilized to enhance security in cloud storage, particularly within healthcare management systems. The ECC with Curve25519 is optimized for efficient and fast scalar multiplication, which reduces computational overhead and enhances performance. The curve parameters are selected to prevent vulnerabilities and ensure security against known attacks. Moreover, it is efficient in maintaining the integrity of patient records, which reduces storage and bandwidth requirements. The ECC with Curve25519 achieves lower Key-Gen, prove, verify, proving key size, and verification key size of 13.7 s, 48 s, 0.608 s, 13.27 Mb, and 123.70 Kb, respectively, in comparison with proxy re-encryption algorithm with zero-knowledge proof (ZKP).
Chi Zhang, Fenhua Bai, Xiaohui Zhang, Jinhua Wan · 6 authors
As a middleware technology in distributed computer systems, blockchain systems represent a paradigm for achieving node interconnectivity. Despite this, technical differences between various blockchain networks have led to the emergence of a phenomenon known as multi-chain, where inter-chain communication has become a trust barrier. Cross-chain technology is a powerful tool that allows data to flow between different blockchain networks, breaking down data barriers and enabling seamless data transfer. However, cross-chain identification may lead to potential risks such as the exposure of private information and data loss or tampering. In this brief, we propose Universal Cross-Chain Permissioned Blockchain (UCCPB) architecture, which connects single permissioned chains into a multi-chain system. Based on this, the Cross-Chain Anonymous Identity Authentication (CCAIA) model is proposed, which implements privacy-preserving chain identity registration and verification through zero-knowledge proof without a trusted setup. Furthermore, we propose the Proof of Cross-Chain Invocation (PoCI) mechanism of UCCPB, which consists of a node election and consensus on the invocation result. This mechanism ensures the correctness of the cross-chain invocation results and incentivizes nodes to participate in UCCPB. Our experiments show that the proposed UCCPB achieves a balance between performance and privacy while improving the security of cross-chain invocations.
Blockchain technology offers an immutable record of verified information, which enables its participants to exchange data in a trustless environment. However, providing at once the properties of integrity, verifiability, availability raises challenges in scenarios where data confidentiality must be preserved. While techniques such as data anchoring, zero-knowledge proofs, or homomorphic encryption have been proposed to address these challenges, formalizing their uses in the context of blockchains, into accessible design patterns for non-expert audiences remains underexplored. This paper proposes a comprehensive collection of blockchain patterns addressing confidentiality-related use cases. The patterns are organized into three families: (1) patterns for confidential data sharing; (2) patterns for claim management—including proof issuance and verification—originally introduced in a previous paper and revised herein; and (3) patterns for secure computation over private inputs. This collection provides a conceptual framework that structures and unifies emerging approaches in this fast-evolving area, laying the groundwork for future standardization and implementation efforts. It offers actionable insights for practitioners, combining best practices with architectural guidance for safeguarding data within blockchain systems.
Applies the Evidence-Based Subjective Logic (EBSL) framework to zero-knowledge reputation systems and decentralised identity. Demonstrates how reputation opinions that are provably correct can be published without revealing the underlying evidence graph, using the EZKL zkML framework for proof generation.
Extends the EQBSL (Evidence-Quality Bayesian Subjective Logic) framework with zero-knowledge proof constraints. Allows a prover to demonstrate that their trust opinion was computed correctly from private evidence, without revealing the evidence itself. Bridges cryptographic privacy guarantees with the epistemic trust formalism of EQBSL.
Andrei Brînzea, Răzvan-Andrei Leancă, Iulian Aciobăniţei, Florin Pop
Traditional Time-Stamping Authorities provide reliable temporal evidence. However, they operate as single points of trust and do not supply a tamper-evident record of event ordering. This paper presents a standards-compliant extension that anchors each issued timestamp token to a blockchain ledger while preserving full compatibility with existing TSA clients. Our proposal is compliant with RFC 3161. The implementation uses an identifier in the token that is also included in the distributed ledger. Experiments were conducted on the Ethereum and Hyperledger Fabric networks. Our design allows for external verification of the existence and relative ordering of tokens without modifying the RFC-defined validation process. Experimental evaluation compares issuance latency, anchoring time, and transaction cost across both networks. Our work presents a practical and viable approach to enhancing trust in digital signature infrastructures by combining the regulatory reliability of qualified TSAs with the auditability and persistence of distributed ledgers.
A proof-carrying trust framework where every EQBSL trust claim ships with a zero-knowledge validity certificate verifiable by any third party without re-running the computation. Establishes the formal link between evidence-based subjective logic opinions and zero-knowledge proof systems, enabling trustless trust attestation in decentralised networks.
Zero-knowledge proofs (ZKPs) enable a prover to convince a verifier of knowledge of a secret without revealing it. The ZKP for the square-root problem has many applications in network and cloud security, such as user authentication and privacy-preserving cloud storage auditing. Classical protocols for the quadratic residuosity (square-root) relation require multiple iterations to reach negligible soundness error, incurring latency and communication costs that are critical in cloud settings. This paper proposes a new single-round zero-knowledge proof (SR-ZKP) for the square-root problem that achieves the same soundness as iterative schemes by increasing the challenge length. The protocol requires only one execution of a 4-message protocol (request, commit, challenge, response) and can be transformed into a one-message non-interactive ZKP via the Fiat–Shamir heuristic. The completeness, soundness, and zero-knowledge properties of the proposed scheme are formally proven. The results of this study show that the proposed protocol can achieve approximately \(97\%\) reduction in communication overhead and latency, when compared to an 80-round iterative ZKPs with RSA modulus n of size 2048 bits. This provides a substantial advantage for cloud applications.
The maritime sector is undergoing a profound digital transformation (e.g., e-Navigation) but currently operates in a complex environment without a defined trust model, creating a strong need for secure communication. Current technical efforts, such as the Maritime Connectivity Platform (MCP), rely on traditional, centralized PKIs. This approach introduces single points of trust and failure and utilizes revocation mechanisms (like CRLs and OCSP) that are inadequate, especially in offline maritime scenarios. This thesis proposes a "privacy-aware" Distributed PKI (DPKI) architecture built on a Permissioned Distributed Ledger (PDL) to overcome these limitations. The solution employs a "Dual-Chain" model to logically separate information: an Identity channel stores PII (Personally Identifiable Information) with access restricted to Ports and Maritime Authorities, while a Certificate channel stores anonymous (pseudonymous) X.509 certificates, accessible to all members. In this decentralized model, actors (Ocean Carriers, Ports, Authorities) maintain independence by managing their own nodes; carriers can even deploy nodes on ships. This eliminates the single point of trust and failure. A Proof of Concept using Hyperledger Fabric was developed to validate the architecture. The primary innovation is the ability to enable offline certificate verification (e.g., Ship-to-Ship scenarios) by leveraging the local copy of the ledger. The "Dual-Chain" model provides selective privacy, balancing operational anonymity with controlled "linkability" by authorities. The use of standard X.509 certificates ensures native interoperability with existing protocols like TLS and SECOM while the PDL guarantees data integrity, non-repudiation, and auditability.
Zero-knowledge proofs (ZKPs) have evolved from foundational interactive proof systems to highly efficient, scalable, and trusted-setup-free constructions powering today’s privacy-preserving and blockchain applications. The field began with the seminal works of Goldwasser, Micali, and Rackoff (GMR) and Goldreich, Micali, Wigderson (GMW) in the 1980s, which introduced interactive proofs, knowledge complexity, and showed that all NP languages admit zero-knowledge proofs. The 1990s brought non-interactive ZK (NIZK) via the CRS model (Blum–Feldman–Micali) and practical sigma-protocols like Schnorr proofs, establishing foundational tools still used today. From the 2000s through early 2010s, research integrated pairings, PCPs, and cryptographic soundness, culminating in pairing-based NIZKs and early succinct argument systems. The SNARK revolution accelerated with QAP-based zk-SNARKs (Gennaro–Gentry–Parno), practical implementations like Pinocchio and libsnark, and the highly efficient Groth16 proving system that became a blockchain standard. Since 2018, the field has shifted toward transparent, universal, and post-quantum-secure systems. Innovations include Bulletproofs (short proofs without trusted setup), zk-STARKs (scalable and PQ-secure), PLONK (universal/updatable setup), and Halo/Halo2 enabling recursive proofs without trusted setup. These advances underpin modern Zcash deployments, zk-rollups, and privacy-preserving scaling systems across Web3. Overall, the ZKP landscape has progressed from theoretical constructs to practical, scalable, and secure systems central to modern cryptography and decentralized computation.
P. Prakash, Faheema Kattakath Sanil, Jeffrey Tom Shaji, Saravanan Palani · 5 authors
The adoption of privacy-preserving techniques in healthcare is significant, especially while handling sensitive medical information. Traditional machine learning approaches raise significant concern regarding privacy, regulations, and data protection. Federated learning has emerged as an effective machine learning approach that enables a group of local models to collaboratively train the global model by sharing their updates instead of sharing the sensitive medical data. Nevertheless, a significant issue with federated learning is its vulnerability to various attacks, including model corruption and data tampering. The authors propose a methodology for developing a secure and privacy-safeguarded collaborative learning model by integrating zero knowledge proof (ZKP) with federated learning (FL). The proposed RS-ZKP methodology utilizes Pedersen commitments within ZKP to verify feature importance, ensuring that they fall within specified bounds without disclosing the actual values. The methodology is validated on two benchmark datasets using metrics accuracy, precision, recall, and F1 score.
Jiaxi Liu, Lin Sun, Tianyu Kang, Di Wu · 7 authors
Federated Learning (FL) enables model training on distributed devices while preserving data privacy. However, malicious clients can submit fabricated model updates to fraudulently obtain training rewards, a behavior known as free-rider attacks. Existing detection-based solutions analyze anomalies in model updates but lack direct evidence of local training, making it fail to fully prevent free-riders. To address this limitation, we propose zkVFL, a verifiable FL framework leveraging Zero-Knowledge Proofs (ZKP) to ensure the integrity of local training while preserving privacy. To reduce the computational overhead of proof generation in ZKP, zkVFL introduces two novel techniques: (i) anomaly-aware client sampling to selectively perform ZKP verification and (ii) A recursive ZKP protocol (ReMPoT), incorporating a pruning-based layer selection technique, reduces proof generation costs. Experimental results demonstrate that zkVFL improves the accuracy and convergence of FL training under free-rider attacks while significantly reducing the computational and memory overhead of proof generation on resource-constrained devices.
Denis Wapukha Walumbe, Gabriel Kamau, Jane Wanjiru Njuki
With the rising integration of blockchain in critical domains such as healthcare, designing efficient, lightweight, and privacy-preserving consensus mechanisms remain a significant challenge.Existing Proof-of-Stake (PoS) implementations often incur high computational and communication overhead, making them unsuitable for telemedicine systems.This study proposed LightweightPoS, a novel voting mechanism designed for this environment.The proposed mechanism incorporates a cluster-based voting to minimize message complexity, Byzantine Agreement protocol for robust fault tolerance and cryptographic sortition to ensure fairness and privacy.This implementation slashes global communication, reducing message complexity by over 95% compared to traditional PoS models.The study evaluated the proposed and baseline mechanisms through simulations using real-time telemedicine data sensors.The results demonstrated that the proposed mechanism consistently achieved sub-10ms latency, high transaction throughput (up to 2400 TPS) and low energy consumption (~0.002kWh per round).It significantly outperformed baseline mechanism like Algorand and Ouroboros.Furthermore, the system included an effective Byzantine node detection, ensuring reliability under adversarial conditions.This work contributes a practical consensus voting mechanism that balances privacy and regulatory compliance.It provides a robust foundation for deploying blockchain technology in privacy-sensitive telemedicine applications.
Hessah A. Alsalamah, Saeed Alqahtani, Ghazlan Al-Arifi, Jana Al-Sadhan · 8 authors
Assisted Reproductive Technology (ART), particularly In Vitro Fertilization (IVF), generates highly sensitive medical data classified as Protected Health Information (PHI) under international privacy and data protection laws. Ensuring the secure, transparent, and ethically governed management of this data is both essential and legally mandated. However, conventional Electronic Medical Record (EMR) systems often present significant challenges, including data-integrity risks, unauthorized access, and limited patient control—issues that become especially critical in contexts such as fertility preservation for cancer patients. EmbryoTrust introduces a blockchain-based framework designed to ensure the confidentiality, integrity, and availability of IVF-related information through a private, permissioned network integrated with role-based access control (RBAC). Smart contracts, implemented in Solidity on the Ethereum platform, verify spousal identities and enforce data immutability in compliance with religious legislation and ethical regulations. Off-chain data are stored in MongoDB for scalable, privacy-preserving management, while on-chain summaries provide tamper-evident traceability and verifiable auditability. The system was deployed and validated on the Ethereum Holešky testnet using Solidity 0.8.21 and Node.js 18.17, achieving an average transaction-confirmation time of 2.8 s, 99.9% uptime and a 95% user-satisfaction rate. Functional, integration, and usability testing confirmed secure and efficient data handling with minimal computational overhead. Comparative analysis demonstrated that the hybrid on-/off-chain architecture reduces latency and gas costs while maintaining automated compliance enforcement. The modular design enables adaptation to other jurisdictions by reconfiguring ethical and regulatory parameters within the smart-contract layer, ensuring flexibility for global deployment. Overall, the EmbryoTrust framework illustrates how blockchain logic can technically enforce medical and ethical rules in real time, providing a reproducible model for secure, culturally compliant, and privacy-preserving digital-health information management. Its alignment with Saudi Vision 2030 and the Wold Health Organization (WHO) Global Strategy on Digital Health 2020–2025 highlights its potential as a scalable solution for next-generation ART information systems.
Byzantine Fault Tolerance (BFT) protocols are fundamental to achieving consensus in distributed systems where some nodes may behave maliciously. However, traditional BFT mechanisms often rely on strong trust assumptions in a majority of honest participants or incur significant communication overhead for extensive verification, thereby limiting scalability and introducing explicit points of trust. This paper proposes a novel approach to verifiable Byzantine agreement that leverages the power of Zero-Knowledge Proofs (ZKPs) to enhance trustlessness and verifiability. By integrating ZKPs into the consensus process, participants can cryptographically prove the correctness of their protocol actions and proposed states without revealing the underlying sensitive information or requiring every other node to re-execute complex computations. This paradigm shift enables a new class of BFT protocols where agreement is not merely reached but is {em verifiably} correct by any observer, reducing implicit trust and increasing transparency. We outline a conceptual framework for such a ZKP-enhanced BFT protocol, discussing the key integration points for zero-knowledge proofs, the expected benefits in terms of security and scalability, and the challenges associated with its implementation. Our approach aims to pave the way for more robust, scalable, and genuinely trustless decentralized systems.
Smart contracts enable programmatic agreements but face two persistent problems: high on-chain cost (throughput/latency) and weak privacy (public ledger exposes transaction semantics). We propose a hybrid on-chain/off-chain commitment scheme (HOC-C) that combines lightweight on-chain commitments, verifiable off-chain computation, and succinct zero-knowledge proofs to deliver privacy-preserving contract execution at scale. In HOC-C, sensitive inputs and heavy computations are executed off-chain by a consortium of replicated verifiers; the verifiers publish a succinct zk-SNARK proof of correct execution plus a small state commitment on-chain. The on-chain contract verifies the proof and updates state atomically. To prevent malicious collusion among verifiers, HOC-C integrates an economic incentive layer and challenge windows where anyone can publish refutation proofs; the refutation burden is designed to be less than the honest-verifier cost. We implement HOC-C using a prototype that plugs into an EVM-compatible chain (Ethereum testnet) and evaluate performance for representative workloads (private auctions, confidential supply-chain workflows, private token-transfer batching). The system reduces gas cost by an order of magnitude compared to naive on-chain execution while preserving end-to-end confidentiality for user inputs. We analyze security properties (soundness, liveness, and economic incentive compatibility) and discuss trade-offs: proof generation latency vs. throughput, verifier decentralization vs. amortized cost. HOC-C offers a practical roadmap for adopting private, inexpensive smart contracts on mainstream blockchains.
To address the issues of privacy-utility imbalance, insufficient incentives, and lack of verifiable computation in current medical data sharing, this paper proposes a blockchain-based fair verification and adaptive differential privacy mechanism. The mechanism adopts an integrated design that systematically tackles three core challenges: privacy protection, fair incentives, and verifiability. Instead of using a traditional fixed privacy budget allocation, it introduces a reputation-aware adaptive strategy that dynamically adjusts the privacy budget based on the contributors’ historical behavior and data quality, thereby improving aggregation performance under the same privacy constraints. Meanwhile, a fair incentive verification layer is established via smart contracts to quantify and confirm data contributions on-chain, automatically executing reciprocal rewards and mitigating the trust and motivation deficiencies in collaboration. To ensure enforceable privacy guarantees, the mechanism integrates lightweight zero-knowledge proof (zk-SNARK) technology to publicly verify off-chain differential privacy computations, proving correctness without revealing private data and achieving auditable privacy protection. Experimental results on multiple real-world medical datasets demonstrate that the proposed mechanism significantly improves analytical accuracy and fairness in budget allocation compared with baseline approaches, while maintaining controllable system overhead. The innovation lies in the organic integration of adaptive differential privacy, blockchain, fair incentives, and zero-knowledge proofs, establishing a trustworthy, efficient, and fair framework for medical data sharing.
Recent advances in artificial intelligence (AI), particularly deep learning, have led to widespread adoption across various applications. Yet, a fundamental challenge persists: how can we verify the correctness of AI model inference when model owners cannot (or will not) reveal their parameters? These parameters represent enormous training costs and valuable intellectual property, making transparent verification difficult. In this paper, we introduce a zero-knowledge framework capable of verifying deep learning inference without exposing model internal parameters. Built on recursively composed zero-knowledge proofs and requiring no trusted setup, our framework supports both linear and nonlinear neural network layers, including matrix multiplication, normalization, softmax, and SiLU. Leveraging the Fiat-Shamir heuristic, we obtain a succinct non-interactive argument of knowledge (zkSNARK) with constant-size proofs. To demonstrate the practicality of our approach, we translate the DeepSeek model into a fully SNARK-verifiable version named ZK-DeepSeek and show experimentally that our framework delivers both efficiency and flexibility in real-world AI verification workloads.
Pedro F. F. Abreu, Maria R. F. M. Ferreira, Luis H. O. Mendes, Geraldo A. Sarmento Neto · 8 authors
The proliferation of Internet of Things (IoT) devices necessitates secure, scalable, and cost-effective access control mechanisms. While blockchain and Non-Fungible Tokens (NFTs) offer a decentralized paradigm for managing permissions, they remain vulnerable to off-chain resource exhaustion attacks and present practical implementation challenges for low-cost devices. This paper proposes a novel hybrid architecture that enhances NFT-based access control with an off-chain gateway acting as both a Smart Reputation System (SRS) and a delegated signer. This hybrid model combines fast, off-chain pre-validation with authoritative on-chain verification. The SRS serves as a security firewall, mitigating high-frequency invalid requests by dynamically managing the reputation of each device and imposing temporary bans on malicious actors. By delegating cryptographic signing to the gateway, low-cost IoT devices are absolved of managing private keys, significantly reducing their complexity and cost. An experimental evaluation of the implemented system was conducted to assess its resilience against Denial-of-Service attacks. The findings indicate that the system successfully neutralizes threats in under 3 seconds. During this process, a stable end-to-end latency of approximately 626 ms is maintained for legitimate users, with the gateway’s reputation logic introducing a negligible performance overhead of less than 1%. This hybrid approach proves to be a practical and effective solution for deploying secure and resilient access control in real-world IoT environments.