Smart contracts, self-executing agreements written in code, are increasingly prevalent in decentralized applications (dApps). However, their immutable nature and complex logic make them vulnerable to security breaches, leading to significant financial losses and reputational damage. Traditional security auditing methods, relying heavily on manual code review and fuzzing, are often insufficient in uncovering subtle vulnerabilities. This paper proposes a novel approach to smart contract security auditing utilizing formal verification. We represent smart contracts as formal specifications and employ formal verification tools to rigorously analyze their behavior and detect potential security flaws. The core claim is that leveraging formal verification techniques significantly enhances the security and reliability of smart contracts. The core mechanism involves translating the contract's logic into a formal language, allowing automated verification against predefined security properties. This approach addresses the limitations of traditional auditing, providing a more comprehensive and reliable assessment of smart contract security. The research contributes to a proactive security strategy for smart contract development, reducing the risk of vulnerabilities and fostering greater trust in decentralized systems.
Blockchain technology has garnered significant attention for its potential to revolutionize various industries. A critical component of blockchain is its consensus mechanism, which ensures the integrity and reliability of the distributed ledger. However, current blockchain consensus protocols are frequently characterized by their complexity, making formal verification challenging. This paper addresses this challenge by presenting a formal model of a blockchain consensus protocol using process calculi. Specifically, we utilize the Temporal Temporal Calculus (TCC) formalism to represent the protocol's state transitions and interactions. This approach allows for a rigorous analysis of the protocol's correctness, security, and efficiency. The model captures key aspects such as node participation, transaction validation, and block creation. The use of process calculi offers a precise and unambiguous description of the protocol, facilitating the identification and mitigation of potential vulnerabilities. This work contributes to a foundational understanding of blockchain consensus and paves the way for improved protocol design and enhanced security assurances.
The increasing prevalence of smart contracts in decentralized applications necessitates robust methods for ensuring their correctness and security. Smart contracts, due to their inherent complexity and potential for subtle errors, pose a significant challenge for traditional verification techniques. This paper proposes a novel approach combining symbolic execution with constraint solving and temporal logic verification for the systematic analysis of smart contracts. The core idea is to systematically explore the execution paths of a smart contract using symbolic execution, identifying potential vulnerabilities and execution scenarios. Subsequently, temporal logic is applied to formally verify that the contract's behavior aligns with its intended specifications over time, capturing temporal constraints such as safety and liveness properties. This integrated framework provides a more comprehensive and reliable method for verifying smart contracts compared to relying solely on symbolic execution or temporal logic alone. The approach offers a structured methodology for detecting and mitigating risks associated with smart contract development.
Blockchain technology has garnered significant attention as a revolutionary distributed ledger system. However, the security and efficiency of blockchain consensus protocols – the mechanisms that ensure agreement among nodes – remain a critical concern. These protocols are often characterized by intricate designs and complex interactions, making traditional testing methods insufficient to guarantee their robustness. This paper proposes a novel approach to formally model and verify blockchain consensus protocols using symbolic execution. Symbolic execution allows us to systematically explore all possible execution paths of a protocol, identifying potential vulnerabilities, inefficiencies, and deviations from the intended behavior. By representing variables with symbolic values rather than concrete values, we can create a comprehensive model that captures the protocol's logic without being constrained by specific data. This approach offers a rigorous and automated method for assessing the security and performance of blockchain consensus protocols, ultimately contributing to the development of more trustworthy and reliable decentralized systems.
Blockchain technology relies fundamentally on consensus mechanisms to ensure data integrity and prevent fraud. However, the inherent complexity of these mechanisms often leads to subtle vulnerabilities that can be exploited. This paper presents a novel approach to blockchain security by developing a formal specification language and accompanying verification tools. We aim to rigorously analyze and verify the security and performance of various blockchain consensus protocols, including Proof-of-Work (PoW) and Proof-of-Stake (PoS). The methodology employs mathematical modeling and logical reasoning to identify potential weaknesses and assess protocol robustness. The developed tools facilitate a systematic examination of protocol behavior under various conditions, ultimately leading to the design of more secure and reliable decentralized systems. This work offers a significant advancement in the field by providing a concrete framework for formal verification, moving beyond anecdotal evidence and subjective assessments. The core claim of this paper is that blockchain consensus mechanisms are complex and prone to vulnerabilities, and the proposed approach provides a mechanism to address this issue.
Authentication in Web 3.0 faces a structural conflict. Systems that offer full anonymity leave no lawful way to identify a malicious actor. Systems built for accountability expose a persistent wallet address to blockchain-graph analysis, or fall back on centralized key recovery. Existing designs solve one side of this conflict at the cost of the other. This paper presents PEUAP-W3, a Privacy-Enhanced and User-centric Authentication Protocol. Its contribution is the integration of five established components into a single deployed and formally analyzed system. A Circom 2 circuit of 1579 Groth16 constraints proves four facts in a single 192-byte on-chain proof: knowledge of an opening of the session credential commitment, an SpO2 value inside an 85–100% band, single-use nonce binding, and HMAC integrity. Shamir (k = 2, n = 3) sharing distributes the identity payload across three independent relays. The coordinator reconstructs an identity only after a threshold vote has been recorded on chain. Credentials are issued as W3C Verifiable Credentials 2.0 in did:key form. Four Solidity contracts verify the proof on Ethereum Sepolia. Verification costs about 241,000 gas and takes roughly 3 ms. ProVerif and Scyther find no attack under the Dolev–Yao model. A concurrency sweep to 500 simultaneous requests completes 1191 requests with zero failures at about 15.4 requests per second. A behavioral gate screens commodity abuse as a supplementary control; it is not treated as a security boundary. Against a nine-property framework, PEUAP-W3 satisfies six properties. Three remain conditional and are not verified in the current deployment: biological-origin assurance and digital replay prevention, both of which need an attested sensor; and GDPR erasure equivalence. Here, formally verified refers to the protocol models and theorems, not to the complete deployed software.
Centralised cloud authentication and authorisation commonly rely on a trusted server for identity, policy enforcement, and audit logging, which can increase the impact of compromise and complicate tamper-evident accountability. This paper presents a decentralised biometric authentication and authorisation framework that integrates fingerprint minutiae verification with Ethereum smart contracts and IPFS-based off-chain storage. Biometric templates are processed off-chain using a NIST NBIS-based pipeline ( MINDTCT minutiae extraction and Bozorth3 matching) and protected via SHA-256 hashing, zlib compression, and authenticated encryption (Fernet), while the blockchain stores only integrity metadata (hashes and IPFS content identifiers) and authorisation state. To mitigate replay attacks without introducing additional session-creation transactions, the framework uses a domain-separated request-binding hash ( tokenHash ) over the caller, nonce, timestamp, chain id, and contract address, validated on-chain together with one-time nonce consumption. A prototype was implemented using Solidity on a local Ethereum-compatible test network (Ganache), with Python/Web3 tooling and an IPFS-compatible content-addressed storage interface. Biometric performance is reported using standard metrics (FAR/FRR/EER and ROC/DET curves) on SOCOFing and FVC2002/FVC2004 benchmarks. In the core blockchain experiment, the proposed single-call attendance workflow required 74,773 gas while adding nonce-based replay protection and auditable authorisation checks on top of CID/hash anchoring (the separate literature benchmark reports end-to-end call-path gas under a shared harness). Compression reduces encrypted-template storage by approximately 76–84% across tested dataset sizes. Security analysis and attack simulation show that replay attempts (nonce/token reuse), unauthorised access, and off-chain payload tampering are rejected under the stated threat model.
Banik and Kumar (Journal of Information Security and Applications 2023) proposed a blockchain-based public key encryption with keyword search for medical data sharing in cloud environments. In this comment paper, we show that the Banik-Kumar scheme leaks keyword information from both ciphertexts and trapdoors.
This paper proposes a Non-Fungible Token (NFT) soft pairing framework for Bluetooth service access control. Unlike conventional Bluetooth systems where pairing implicitly grants persistent service access, the proposed approach decouples native Bluetooth pairing from authorization without modifying the underlying protocol stack. The framework introduces a three-layer architecture consisting of a Bluetooth layer for connectivity, a blockchain layer for trusted execution and on-chain state verification, and an application layer where NFT soft pairing defines the authorization logic. In this design, Non-Fungible Bluetooth Tokens (NFBTs) represent user-side access credentials, while Non-Fungible Device Tokens (NFDTs) represent device identities. Their bidirectional on-chain binding forms a revocable and verifiable NFT soft pairing relationship. During access, users prove ownership of valid NFBTs through challenge-response signatures, and devices verify the corresponding on-chain state before granting service access. A prototype implemented with MetaMask and Ethereum demonstrates secure authentication, dynamic revocation, acceptable latency, and gas-efficient credential issuance based on ERC1155.
The Internet of Things (IoT) is expected to interconnect more than 75 billion devices worldwide, yet device authenticity remains one of the most pressing unsolved security challenges in the IoT space. Typical IoT nodes have limited computing power, memory, and battery capacity, making traditional public-key-based authentication difficult to implement without compromising either security or resource conservation. This paper presents a structured narrative review and quantitative comparison of lightweight authentication protocols for IoT environments published between 2024 and 2026, spanning seven families: Elliptic Curve Cryptography (ECC)-based, ECC for Radio Frequency Identification (RFID), hash-based, Physical Unclonable Function (PUF)-based, biometric and behavioural, blockchain-assisted, and machine-learning-augmented protocols. The review adds message-level protocol-flow comparisons for representative ECC- and PUF-based schemes, a benchmarking table of published latency, message-size, and energy indicators, and five sector-specific case studies. Reported findings include dynamic-credential ECC schemes reducing communication and computational overhead by more than 37% over prior ECC schemes; PUF-based techniques using machine learning to improve modelling-attack resistance by more than 35% over earlier techniques; blockchain-assisted authentication for fog-enabled IoT; and multi-sector schemes such as SELAP, reducing computation and communication cost to 422 ms and 960 bits respectively, against 548 ms and 2048 bits for the earlier ELWSCAS protocol. Protocols are also examined against ephemeral information leakage, modelling attacks on PUFs, node cloning, and physical tampering. No protocol category is universally optimal; selection depends on a deployment's constraints, threat model, and sector. Research is converging on hybrid designs combining hardware-rooted trust, efficient public-key primitives, decentralised trust, and intelligent anomaly detection.
Open access
2 source records
Physical Unclonable Functions (PUFs) and Hardware Security
Sunday Yunisa, A. Ajah Ifeyinwa, Eturpa Salami Emmanuel
Internet of Medical Things (IoMT) devices, due to their resource constraints, require specialized security solutions that can operate efficiently without compromising performance and maintaining data confidentiality and integrity while minimizing computational overhead. This review examines various IoMT-based security frameworks designed to secure healthcare records in the cloud, emphasizing their effectiveness, challenges, and best practices. The study was conducted using the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) method. 100 studies were identified published between 2020to 2025 and 50 papersthat were relevant to the study was carefully selected through a structured screening process. The papers were obtained from major academic databases such as PubMed, Scopus, IEEE Xplore, SpringerLink, Wiley, and Google Scholar. A systematic review protocol was developed before the literature search to establish clear criteria for inclusion and exclusion, ensuring transparency and reproducibility. The review showed that despite the progress made in safeguarding IoMT cloud-based health records, numerous prevailing frameworks predominantly emphasize either encryption or blockchain technology in a singular context, thereby neglecting to exploit the synergistic advantages inherent in the integration of both methodologies. Also, the encryption techniques currently employed for the protection of records within IoMT cloud environments frequently fail to achieve the essential equilibrium between security and operational performance which is characterized by limited resources. The study recommends the formulation of a framework that integrates several encryption schemes and blockchain technology to address the prevailing security problems.
The advancement in smart mobility communication technology enables intelligent vehicles to interconnect and communicate with each other, improving traffic safety and efficiency. However, the highly dynamic nature of the smart mobility network and vehicle behaviour creates the requirement for effective authentication systems to establish secure and reliable communication between vehicles. The implementation of a reputation system has been proposed to establish trust among untrusted vehicles, where the reliability of a propagated message is assessed based on the reputation of the sender vehicle. Thus, it prevents malicious vehicles from potentially broadcasting misleading messages that can cause accidents or disrupt the network. This paper proposes a novel decentralised and dynamic reputation management and computation model based on a consortium blockchain and a multi-signature smart contract. The implementation of blockchain and a smart contract provides a secure and transparent framework for registering vehicles, submitting events, voting feedback, evaluating reputation, and blocking malicious vehicles. To demonstrate the feasibility of the proposed model, we conducted security and performance analyses. The results show how our model can provide resistance against various system and reputation manipulation attacks, such as data tampering, message forging, self-promotion, vote duplication, bad-mouth, on-off, time-dependent, and collusion attacks. Additionally, the smart contract performance illustrates execution time within a millisecond or less, which demonstrates the practicality of our design for the smart mobility applications.
The growing adoption of digital medical health care systems makes it necessary to build efficient, secure, and interoperable medical information exchange services. Nevertheless, existing traditional healthcare systems are centralized, inefficient in communication, vulnerable in terms of the integrity of data, and lack transparency. In this study, a novel blockchain-based secure framework is proposed with the integration of Ethereum smart contracts, CBOR compression, AES-256 GCM encryption, and SHA-256 validation. A multispecialty hospital dataset including patients’ information, laboratory information, prescriptions, and billing details is used in testing. A study obtained a compression rate of 7.22, validation speed of 0.0039 ms, encryption in 0.36 ms, average API latency of 98.47 ms, and throughput capacity of 52.9 TPS with a blockchain-based proposed system. Security analysis proved that this system provides security in terms of encryption, tamper resistance, access control, and immutability. The study also contributes a new model of communication within the health sector, which is both lightweight and secure, and increases blockchain performance and security.
The ubiquity of lightweight resource-constrained Internet-of-Things (IoT) devices in 5G smart environments necessitates authentication protocols with the conflicting goals of being lightweight, highly secure, and having a decentralised credential management structure. Existing schemes use trusted third-party key distributors or heavyweight cryptographic primitives infeasible to IoT embedded hardware; they also fail to anchor device credentials on a permissioned blockchain ledger for tamper-evident credential revocation. In this work, we introduce BLAP-IoT: a Blockchain-Assisted Lightweight Authentication Protocol over live Hyperledger Fabric 2.5.9 that leverages elliptic-curve Diffie–Hellman over P-256 curve, keyed MACs, and a three-message challenge-response protocol to provide injective mutual authentication with device key confirmation. Device credential commitments are stored on-chain to facilitate decentralised and efficient device revocation without revealing secrets on-chain. A formal security verification of the protocol in ProVerif 2.05 shows session-key secrecy, injective mutual authentication, and perfect forward secrecy in the presence of the Dolev-Yao attacker. The empirical evaluation of BLAP-IoT on measured P-256 primitives reports that the scheme achieves a total computation cost of 0.303 ms on constrained devices — up to 52% less than compared schemes, 1920-bit two-way communication overhead, and 0.218 mJ device energy consumption. The underlying blockchain layer sustains up to 277 transactions per second (TPS) in peak throughput, with end-to-end authentication latency less than 13 ms at 1000 concurrent devices.
W. C. Yang, J. F. Qiao, J. F. Hu, Jie Wang · 5 authors
This study presents a multi-level verification system for secure communication protocols in energy billing infrastructures. The proposed framework integrates device attestation, network integrity verification, privacy-preserving aggregation, billing validation, and immutable auditing to address security vulnerabilities across Advanced Metering Infrastructure (AMI) communication chains. A Hybrid Secure-Efficient Protocol (HSEP) combining elliptic curve cryptography, homomorphic encryption, and zero-knowledge proofs is developed to provide secure authentication, privacy protection, and verifiable data integrity while maintaining low computational overhead. Experimental evaluation using a large-scale AMI testbed demonstrates that the proposed system significantly improves tampering detection capability, achieving an intrusion detection AUC of 0.94 while maintaining an average energy consumption of 1.55 J per transaction and acceptable communication latency for large-scale deployment. The architecture exhibits strong scalability, robustness, and rapid dispute-resolution performance under multiple attack scenarios. The proposed framework is particularly applicable to wireless smart metering networks and antenna-enabled AMI communication infrastructures, where reliable data transmission, secure protocol verification, and resilience against communication-layer attacks are essential for trustworthy energy billing and grid operation. This work provides an effective engineering solution for secure, privacy-preserving, and verifiable communication in modern intelligent energy systems.
In the last few years, the Internet of Things (IoT) has grown significantly due to technological advancements. However, until recently, there has been no universal set of rules applicable to IoT security. This has opened an area for researchers. The IoT environment enables various smart devices to connect and exchange information; thus, ensuring the authenticity of devices in the IoT network is crucial. We have classified the diverse methods used to authenticate IoT devices to access the data they generate. This study conducted a systematic literature review to identify research gaps, recurring patterns, and potential future directions in IoT authentication, with particular attention to the architectures employed. This review analyzed different authentication techniques and presented their advantages and disadvantages using several criteria for categorization. This survey provides researchers and practitioners with a consolidated understanding of the current state of authentication mechanisms in the IoT. Furthermore, the survey examines emerging authentication paradigms, including blockchain-enabled authentication frameworks, machine-learning-augmented authentication models, and lightweight authentication schemes tailored for resource-constrained IoT devices. The goal of this survey is to aid in creating more robust and secure authentication solutions for the developing IoT by highlighting strengths, limitations, and emerging trends.
User Authentication and Security Systems
Advanced Authentication Protocols Security
Physical Unclonable Functions (PUFs) and Hardware Security
Stateful cryptographic schemes—exemplified by the hash-based signatures XMSS (RFC 8391) and LMS (RFC 8554)—require the signer to advance a local state monotonically; any rollback is catastrophic, yet a verifier has no way to check it. IETF guidance on state and backup management for hash-based signatures states explicitly that the verifier must simply trust the signer not to have reused state. We define verifiable monotone chains (VMC), a primitive that makes such state discipline cryptographically verifiable: state evolves along a finite poset (S, ⪯) under inflationary monotone operators, every transition carries a zero-knowledge proof, and a public commitment to the state provides an audit trail. We formalize two security notions: monotone-unforgeability (MU), which captures that an external adversary cannot certify an illegal or rolled-back transition, and auditability (AUD), which captures that signer rollback cannot be hidden from a public root history. Both notions reduce, with explicit advantage bounds, to position binding of the underlying vector commitment and knowledge soundness of the proof system. We instantiate VMC as RSEP-XMSS, in which each XMSS signature carries a proof that the signed leaf advanced along the chain FRESH ≺ USED ≺ SPENT in a Poseidon-based state Merkle tree, and we give a complete algorithmic specification with a concrete circuit design (~6041 R1CS constraints estimated, Groth16 proving time estimated at 5–15 ms, signature overhead of about 1–3 KB). RSEP-XMSS is one-way compatible with standard XMSS: legacy verifiers verify the core signature, while enhanced verifiers reject unprotected signatures, preventing downgrade attacks.
The disclosure duty of arbitrators does not carry a big stick: the consequence attached to its breach is near to none. The duty is carried out through a black-box judgment call; no reasoning for how the arbitrators weed out what not to disclose is made available to the parties. There may be circumstances falling under a grey area but have ended up undisclosed due to, for instance, confidentiality obligations. Exhaustive disclosure and minimum revelation of sensitive information would serve the greatest benefit of all stakeholders. Zero-knowledge proofs (ZKP) – a class of cryptographic protocols – may make this possible.
Biometric authentication offers enhanced usability for digital payments, but traditional centralized architectures suffer from single points of failure. While blockchain integration promises decentralized trust, existing solutions often store biometric helper data (e.g., fuzzy commitments) directly on-chain. We demonstrate that such transparency, even in permissioned settings, exposes low-entropy biometric inputs to offline brute-force attacks and identity-linkage risks if the immutable ledger is accessed by malicious nodes. To resolve this transparency–privacy paradox, we propose a threshold-based decentralized authentication framework. Unlike prior works, our protocol keeps all sensitive Biometric-Enhanced Key Derivation (BEKD) tokens entirely off-chain, using the blockchain solely for freshness enforcement. We provide a game-based security analysis of brute-force resistance, unforgeability, and unlinkability. Our experimental results demonstrate that our scheme’s gas cost is acceptable, offering a robust solution for self-sovereign biometric identity.
Cryptographic protocols are evaluated not only by the security properties they achieve, but also by the resources required to execute them. Unlike conventional algorithm analysis, where a single running-time function may be sufficient, protocol analysis usually separates computational complexity, bit complexity, communication complexity, storage complexity, and round complexity. This article develops a systematic methodology for such analysis through three representative case studies: the Schnorr zero-knowledge proof of knowledge, a Diffie–Hellman-based one-out-of-two oblivious-transfer protocol, and Regev-style public-key encryption based on the Learning With Errors problem. For each construction, the protocol is stated formally, correctness is derived, and the dominant computational, communication, and memory costs are calculated step by step. The examples illustrate three qualitatively different bottlenecks: group exponentiation in discrete-logarithm protocols, amortized public-key cost in oblivious transfer, and dense matrix–vector arithmetic in lattice-based cryptography.