The Internet of Things (IoT) demands robust mechanisms for secure communication and trust establishment among connected devices. Traditional Public Key Infrastructure (PKI) solutions face limitations in scalability, centralization and single points of failure. These limitations hinder their effectiveness in dynamic IoT environments. To address these challenges, this paper introduces a new decentralized authentication protocol for secure identity management and data exchange in IoT, called ISIF (IOTA-Assisted Self-Sovereign Identity Framework). This framework is based on Self-Sovereign Identity (SSI) principles and leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to enable mutual authentication without relying on centralized authorities. DIDs ensure decentralized identity management and VCs provide verifiable context-specific claims. This dual-layer approach enables robust and attribute-based authentication, which reduces the risk of unauthorized access and improving interoperability in decentralized IoT environments. ISIF employs the IOTA Tangle as a distributed ledger to manage and verify DIDs and VCs. This offers a decentralized, immutable record that supports efficient and tamper-resistant identity management. ISIF ensures that all interactions within the IoT network are securely authenticated and resilient to tampering. The experimental results show that the framework maintains efficient DID generation and VC issuance times even as network size scales, overcoming the bottlenecks inherent in PKI-based systems. Experimental results demonstrate that ISIF maintains efficient DID generation and VC issuance, even as network size scales. Experimental results show that DID generation time increases from 1.85 ms (for 50 nodes) to 10.81 ms (for 250 nodes), while VC issuance time ranges from 2.66 ms to 13.21 ms. Similarly, VC verification time increases from 3.54 ms to 22.27 ms as the network scales. Despite these increases, the overall end-to-end (E2E) delay remains low (0.16–0.33 ms), ensuring efficient real-time authentication. These findings confirm ISIF’s feasibility for large-scale IoT authentication without performance degradation. Furthermore, the IOTA Tangle’s performance in handling varied payload sizes affirms its suitability for managing block generation and retrieval in IoT, ensuring practical processing times that uphold security and decentralization.
An important cryptographic mechanism that guarantees confidentiality (the zero-disclosure property) and ensures that it is impossible to prove a false statement to the verifier is zero-disclosure proofs. A popular implementation of zero-disclosure proofs is short, noninteractive proofs that can be quickly verified and that do not require interaction between the parties after the initial setup. The main direction in the development of modern proof systems is interactive proof, which is built in two steps. The first is sending a confirmation of the polynomial of an interactive oracle proof and the second is creating correct oracles of the polynomial commitment scheme using well-defined cryptographic methods for evaluating polynomials. Verifying the use of the same coefficients in each linear combination requires checking both polynomial consistency and variable consistency. To construct general schemes of concise non-interactive zerodisclosure knowledge argument, an interactive oracle proof polynomial was proposed that models messages as polynomial oracles. All tests are proved using polynomial commitment schemes and then evaluated with zero knowledge at a point specified by the person verifying the information. The reliability and confidentiality of all tests are based on three main categories of interactive oracle proof polynomials, namely polynomial commitment schemes with conjunction, with inner product argument and with code theory. The protocols of concise noninteractive zero-disclosure knowledge arguments are implemented through high-level programs (compilers), which are converted into an intermediate representation, i.e. a scheme defined by a system of constraints. The compilers used are divided into domain-oriented languages, embedded domain-oriented languages, and zero-knowledge virtual machines. Specialized domain-oriented hardware description languages or programming languages offer an adapted syntax for efficiently expressing constraints in arithmetic schemes. Embedded domain-oriented languages are implemented as functions in general-purpose programming languages and are oriented to the overhead schemes inherited from the embedded language. Zero-knowledge virtual machines process the opcode of the fetch-decodeexecute cycle, replicating the computation trace for general programs and generating corresponding zeroknowledge proofs. They are compatible with existing high-level programming languages and can use the features of existing compilers. Compilers are evaluated for cross- or syntactic compatibility. In general, the biggest obstacle to using non-interactive proof libraries is the lack of documentation. Standardization can help developers compare important features across libraries and establish a more consistent performance baseline. Library documentation for these core features is implicit, and developers need to understand the underlying cryptographic techniques to choose an appropriate scheme. Standardization of compiler options is important, making it difficult to reuse existing tools.
Protecting user rights and enabling cross-border interoperability require the existence of private and secure management of personal identity data in digital environments. To address this need in the context of electronic health cards for digital identification and healthcare services, this paper proposes a novel architecture that integrates self-sovereign identity (SSI), verifiable credentials (VC), and zero- knowledge proofs (ZKP). With SSI, users maintain full control over their data, storing and sharing identity credentials through digital wallets using decentralized identifiers (DIDs). VC enables trusted organizations to issue authenticated, tamper-proof digital certificates, while ZKPs allow individuals to prove identity-related claims without disclosing unnecessary personal details. The combination of these technologies enables a framework that ensures a tradeoff between user privacy and security processes. The findings of the tests achieved indicate that our framework, compared to conventional models, optimizes the interoperability and privacy of e-health card systems. Additionally, the suggested solution supports recent data protection regulations and demonstrates strong potential for global adoption.
The Internet of Vehicles (IoV) is an emerging area within intelligent transportation systems, enabling real-time communication among vehicles, infrastructure, and pedestrians. While this connectivity enhances traffic management and safety, it also introduces significant security challenges—particularly in authentication, authorization, and data integrity. To address these concerns, blockchain technology is explored to eliminate centralized points of failure and support secure, decentralized communication in IoV environments. A solution titled Blockchain-based Authentication and Authorization in IoV (BAAIoV) is proposed, utilizing smart contracts and a distributed ledger to manage vehicle identities and securely control access to network resources. A simulation environment was established using Simulation of Urban Mobility (SUMO) for traffic modeling and Hyperledger Fabric for blockchain implementation. Python-based middleware facilitated real-time interaction between the simulation and the blockchain system. The results indicate that the BAAIoV model significantly reduces authentication delays, enhances emergency vehicle recognition, and mitigates threats like spoofing and replay attacks. These improvements demonstrate the potential of blockchain to enhance the security, efficiency, and reliability of vehicular networks. This research contributes to the development of secure communication frameworks for IoV. It highlights the potential for future blockchain integration with edge computing, artificial intelligence, and post-quantum cryptography technologies. Such integrations are expected to further strengthen smart transportation infrastructures and advance the capabilities of next-generation intelligent mobility systems.
The industrial market continuously needs reliable solutions to secure autonomous systems. Especially as these systems become more complex and interconnected, reliable security solutions are becoming increasingly important. One promising solution to tackle this challenge is using smart contracts designed to meet contractual conditions, avoid malicious errors, secure exchanges, and minimize the need for reliable intermediaries. However, smart contracts are immutable. Moreover, there are different smart contract execution architectures (namely Order-Execute and Execute-Order-Validate) that have different throughputs. In this study, we developed an evaluation model for assessing the security of reliable smart contract execution. We then developed a realistic smart contract enabled IoT energy case study. Finally, we simulate the developed case study to evaluate several smart contract security vulnerabilities reported in the literature. Our results show that the Execute-Order-Validate architecture is more promising regarding reliability and security.
The increasing adoption of smart contracts on Ethereum and similar blockchain platforms has brought new security concerns, particularly regarding code-level vulnerabilities and unauthorized intrusions. This paper introduces a hybrid framework for intrusion detection in Ethereum smart contracts, leveraging cryptographic modeling and discrete mathematical structures. The framework formalizes contract behavior using graph theory and logic-based models to detect deviations from predefined secure states. Cryptographic primitives such as hash functions and digital signatures ensure data integrity and transactional authenticity. A temporal logic-based formal verification mechanism validates execution paths, while an embedded intrusion detection module enables realtime monitoring and automatic threat response. Experimental evaluation on Ethereum testnets demonstrates enhanced accuracy in identifying reentrancy attacks, access control violations, and state inconsistencies. The results affirm the effectiveness of discrete structures and cryptographic techniques in strengthening the security and reliability of decentralized applications.
Traditional identity authentication algorithms that rely on centralized trust authorities and plaintext identity verification often suffer from privacy leakage, key misuse, and single-point-of-failure risks. This study proposes a lightweight, privacy-preserving authentication algorithm based on elliptic curve and zero-knowledge proofs to address these issues. The proposed scheme introduces a random challenge and an anonymous verification mechanism during the authentication process to ensure both identity privacy and authentication security. While maintaining high levels of security and verifiability, the algorithm effectively reduces computational complexity and communication overhead. Experimental results demonstrate that the proposed method significantly outperforms traditional RSA and ECDSA in terms of authentication delay, communication cost, and security robustness. This approach is practical and scalable, offering a promising solution for secure authentication in environments with limited resource.
As network applications rapidly evolve toward mobile and ubiquitous scenarios, identity authentication protocols face heightened demands for privacy protection and computational efficiency while maintaining security.Traditional authentication schemes often struggle to achieve an effective balance between privacy preservation, computational complexity, and security during design, with performance bottlenecks becoming increasingly prominent in resource-constrained environments.To address these challenges, this study proposes an optimized algebraic curve identity authentication protocol incorporating zero-knowledge proofs.Building upon Elliptic Curve Cryptography (ECC) as its cryptographic foundation, the protocol leverages ECC's inherent advantages of shorter key lengths and higher computational efficiency for equivalent security levels.Simultaneously, it integrates zero-knowledge proof mechanisms to minimize the exposure of user identity information during authentication.Through systematic optimization of the key generation mechanism, zero-knowledge proof interaction flow, and identity verification logic, the proposed protocol effectively reduces computational and communication overhead while ensuring identity anonymity and authentication integrity.Experimental results demonstrate that compared to traditional ECC authentication protocols and classical zero-knowledge proof schemes, the optimized protocol exhibits significant advantages in key generation time, authentication response latency, and communication load.It effectively resists common security threats such as replay attacks and forgery attacks, making it suitable for resource-constrained network environments and privacy-sensitive applications.
Zero-knowledge proofs provide cryptographic guarantees of statement validity without revealing underlying secrets. However, static proofs enable linking attacks where adversaries track the same proof across multiple uses, compromising user privacy. We introduce Time-Based Re-randomization (TBR), a novel protocol that automatically transforms zero-knowledge proofs at fixed time intervals while preserving their validity. Our construction leverages cryptographic randomization combined with deterministic time-slot generation to create temporally unlinkable proofs without user interaction. We provide formal security proofs demonstrating that TBR maintains zero-knowledge and soundness properties while preventing proof-linking attacks. Performance analysis shows TBR incurs only 8-12ms overhead compared to 450-600ms for generating fresh proofs, making it practical for privacy-preserving applications including anonymous authentication, timelimited credentials, and blockchain systems.
Proof-of-Context (PoC) protocols aim to ensure fairness and integrity in smart contract execution by cryptographically binding on-chain transactions to verifiable off-chain contextual data. Traditional consensus mechanisms (e.g., Proof-of-Work, Proof-of-Stake) focus on ordering and validation of transactions but do not address whether the contextual conditions that should govern contract execution are satisfied. In this manuscript, we propose a novel PoC framework that leverages decentralized oracles, zero-knowledge proofs, and time-stamped Merkle commitments to provide verifiable evidence that all pre-specified preconditions and environmental parameters were met at execution time. We detail the design of the protocol, implement a prototype on an Ethereum testnet using Chainlink oracles and zk-SNARKs, and conduct a performance evaluation under varying network and workload conditions. Our results show that PoC incurs a modest overhead—on average 5% additional gas cost and 200 ms added latency per proof generation—while dramatically enhancing auditability and reducing the risk of context-based manipulation or dispute. We conclude that PoC protocols offer a practical mechanism for enforcing fairness in a wide range of decentralized applications, from DeFi loans conditioned on real-world data to NFT minting events gated by dynamic criteria. Finally, we discuss the scope, limitations, and future research directions for broader deployment.
We compare the total capital efficiency of secure restaking and Proof-of-Stake (PoS) protocols. First, we consider the sufficient condition for the restaking graph to be secure. The condition implies that it is always possible to transform such a restaking graph into separate secure PoS protocols. Next, we derive two main results: upper and lower bounds on the required extra stakes to add to the validators of the secure restaking graph to be able to transform it into secure PoS protocols. In particular, we show that the restaking savings compared to PoS protocols can be very large and can asymptotically grow as a square root of the number of validators. We also study a complementary question of aggregating secure PoS protocols into a secure restaking graph and provide matching lower and upper bounds on the PoS savings.
The need for robust authentication mechanisms has become paramount in an era marked by increasing concerns over data privacy and cybersecurity. Traditional methods, such as passwords and biometrics, often need to improve in providing adequate security without compromising user privacy. In response, Zero-Knowledge Proofs (ZKPs) have emerged as a solution, allowing parties to verify information […]
Abstract With the continuous development of network technology, cryptographic protocols are facing diverse and complex security challenges. Blockchain technology, as a solution incorporating decentralization, traceability, programmability, and immutability, effectively enhances the security, trustworthiness, operational efficiency, and ensures the security and integrity of data storage in traditional cryptographic protocols. Consequently, it has gradually emerged as a focal point of research in cryptographic protocols. This manuscript delves into the ongoing research concerning the application of blockchain technology in cryptographic protocols. First, this manuscript introduces the background of blockchain research in cryptographic protocols and the corresponding basic knowledge. Secondly, we delve into the main concerns of traditional cryptographic protocols, with a particular focus on security and performance. Thirdly, according to the main classification of cryptographic protocols, the latest research results of blockchain in authentication protocols, authentication and key agreement protocols, and e-commerce protocols are presented. Finally, the research directions of blockchain technology in cryptographic protocols are summarized based on the existing research, and the future development trend is also prospected.
Password-based authentication is widely applied in Internet of Things (IoT). It allows IoT devices to identify users with passwords to resist unauthorized access. However, choices of weak passwords, especially popular ones, might violate users’ privacy and lead to large-scale network attacks. Collection of popular passwords among IoT devices to establish blocklists via a service provider can prevent use of weak passwords. To protect unpopular passwords during collection, existing privacy-preserving schemes rely on expensive cryptographic primitives (e.g., garbled circuits and zero-knowledge proofs), which would impose heavy communication and computation burdens on constrained devices and hinder wide deployment of these schemes. In this paper, we propose EAGER+, an efficient privacy-preserving scheme for weak password collection in IoT against perpetual leakage. EAGER+ is mainly built on secret sharing and symmetric encryption, thereby enabling lightweight computation and communication on IoT devices. In EAGER+, we conceive a password-locked encryption with conditional decryption mechanism to efficiently identify popular passwords, where a password is essentially locked under itself in the encryption to guarantee its security, and the password can be revealed from the ciphertext by the service provider only if a sufficient number of devices exploit it. The mechanism is integrated with a servers-aided password-hardening mechanism to resist offline dictionary guessing attacks. Moreover, EAGER+ uses a key renewal mechanism to periodically update secrets for password hardening on key servers to thwart perpetual leakage towards the secrets. We formally analyze the security of EAGER+, and conduct experimental evaluations to show that EAGER+ is more efficient than existing schemes.
Mingwei Zeng, Jie Cui, Qingyang Zhang, Hong Zhong · 5 authors
The rapid evolution of the Industrial Internet of Things (IIoT) has necessitated increased device interactions across various management domains. This entails devices from different domains collaborating on the same production task. This poses significant challenges for the dynamics of cross-domain authentication schemes. Traditional cross-domain authentication schemes struggle to support seamless switching between domains and face difficulties when accommodating devices that join and leave the same domain. Moreover, these schemes suffer from intricate interactions and suboptimal efficiency. To address these issues, we propose a dynamic group signature scheme based on a dynamic accumulator and a non-interactive zero-knowledge proof. We integrated this scheme with blockchain technology to construct an efficient revocation cross-domain authentication scheme. The proposed scheme enables cross-domain anonymous authentication with simple interactions and provides an efficient revocation function for illegal devices. This approach ensures conditional privacy-preserving and enables efficient member joining and exiting through a dynamic accumulator. It effectively addresses the dynamic requirements of devices involved in IIoT production and manufacturing processes. We prove the security of the proposed scheme using a random Oracle model and conduct thorough analyses to verify its resistance against various attacks. Furthermore, the experimental results demonstrate that the proposed scheme achieves better performance in terms of computational and communication costs.
In the era of decentralized identity management within blockchain ecosystems, ensuring user privacy during authentication processes is a critical concern. This dissertation addresses the challenge of privacypreserving authentication within decentralized identity management systems, specifically on the Algorand blockchain platform. As digital identity solutions become critical in today’s interconnected world, traditional centralized models expose user data to substantial privacy and security risks, such as data breaches, identity theft, and unauthorized access. The research leverages Algorand’s pure proof of stake (PPoS) consensus mechanism, recognized for its scalability and energy efficiency, along with cryptographic techniques such as zero-knowledge proofs (ZKPs) and the Pedersen commitment scheme. The primary contribution of this dissertation is the development of a proof of concept decentralized application (DApp) designed for secure and anonymous voting, designed to balance data protection with usability within the context of Dharma Teams, a decentralized application of Yari Labs. By incorporating cryptographic primitives such as anonymous credentials and secure, decentralized authentication protocols, the DApp demonstrates how user privacy can be maintained even in open blockchain environments. The framework developed within this research not only ensures user anonymity, but also upholds the integrity and transparency of the authentication process. Furthermore, this dissertation explores the applicability of these privacy-preserving methods in various use cases, including decentralized finance, supply chain management, and verification of digital identity. Through a blend of theoretical insights and practical implementation, this work lays a pathway toward more secure and use centric digital ecosystems on Algorand and similar platforms.
The advancement of 6G wireless communication technology has facilitated the integration of Vehicular Ad-hoc Networks (VANETs). However, the messages transmitted over the public channel in the open and dynamic VANETs are vulnerable to malicious attacks. Although numerous researchers have proposed authentication schemes to enhance the security of Vehicle-to-Vehicle (V2V) communication, most existing methodologies face two significant challenges: (1) the majority of the schemes are not lightweight enough to support real-time message interaction among vehicles; (2) the sensitive information like identity and position is at risk of being compromised. To tackle these issues, we propose a lightweight dual authentication protocol for V2V communication based on Physical Unclonable Function (PUF). The proposed scheme accomplishes dual authentication between vehicles by the combination of Zero-Knowledge Proof (ZKP) and MASK function. The security analysis proves that our scheme provides both anonymous authentication and information unlinkability. Additionally, the performance analysis demonstrates that the computation overhead of our scheme is approximately reduced 23.4% compared to the state-of-the-art schemes. The practical simulation conducted in a 6G network environment demonstrates the feasibility of 6G-based VANETs and their potential for future advancements.
In the network layer of the Ethereum network, the Discv5 protocol is introduced to improve the node discovery process and enhance resistance to common P2P network attacks such as Sybil Attacks, Partition Attacks, and Eclipse Attacks. However, the practical effectiveness of the new security mechanisms introduced by the Discv5 protocol has not been evaluated through engineering assessments. In this paper, we identify inconsistencies between the design and implementation of the Discv5 protocol and propose a new attack pattern: the Leveraging Service Diversity (LSD) Attack. The LSD Attack targets networks where different services are indiscriminately mixed. Through detailed measurements of the Consensus Layer (CL) discovery network, we evaluate the impact of the LSD Attack on newly joined network nodes and on the services of honest nodes within the network. Our experiments demonstrate significant deviations between the Discv5 protocol’s current implementation and its original design, which can lead to a substantial reduction in the network’s security under the influence of service diversity. This study contributes to a deeper understanding of the security implications of the Discv5 protocol and highlights the need for further evaluation and improvement of the network layer protocols in Ethereum.
Currently, privacy protection in consortium blockchains can be categorized into two primary schemes based on their characteristics. The first is the ring signature scheme, which renders the user identity completely anonymous. The second is the group signature scheme, where the user identity can be fully traced by the trusted authority (OA) in the event of a transaction dispute. To address the imbalance between privacy and accountability in consortium blockchain transactions, this paper introduces an enhanced multi-Key Generation Center (multi-KGC) group signature scheme tailored for consortium chains. We validate the anonymity and unforgeability of the proposed scheme through a security game. The enhanced group signature algorithm employs the Groth-Sahai proof system for non-interactive zero-knowledge proofs (NIZK) and leverages elliptic curve cryptography combined with threshold cryptography for key generation. This scheme is implemented within the Hyperledger Fabric consortium chain environment, and both computational and communication overheads are thoroughly analyzed. Experimental results indicate that, while the signature generation efficiency of the proposed scheme is slightly reduced compared to existing group signature schemes, its verification efficiency aligns with similar schemes. Functionally, our scheme facilitates a tiered disclosure of signing user information based on transaction values during transaction audits in consortium blockchain transactions.
This study mainly focus on Sybil attacks with the Identity-Augmented Proof-of-Stake (IdAPoS) protocol under different network topologies, including random, scale-free, and hierarchical networks. The study finds that scale-free networks are more resistant to Sybil attacks, delaying their effects. Furthermore, the research improves the IdAPoS protocol by introducing active strategies for honest nodes, which improves the behaviours of this protocol, and by enabling them to dynamically assess and update their trusted and suspicious authority lists based on on-ledger data, which improves the completeness of this protocol.