Committee-based consensus (CBC) is a promising technology to enhance the scalability of blockchain systems. However, the fair and secure selection of a committee in an open, non-permissioned chain remains a pressing challenge. Moreover, most existing CBC protocols still incorporate traditional Byzantine fault-tolerant algorithms for consensus, which have high communication complexity and low consensus efficiency. To address these problems, we present RVRE (a secure and efficient committee-based consensus protocol leveraging reputation power). RVRE focuses on committee selection and committee consensus. Regarding committee selection, we present Diversity Voting Power (DVP). Based on a reputation mechanism comprehensively reflecting node capabilities, DVP forms committees by extracting users' Unit Reputation Power, introducing lottery element to prevent high centralization and effectively combating Sybil attacks. Moreover, during the extraction process, DVP fully utilize the heterogeneity among users to achieve better security with a smaller committee size. Regarding consensus within the committee, we enhance the HotStuff algorithm with reputation mechanism, resulting the Repu-HotStuff. Repu-HotStuff frees the three-stage paradigm of HotStuff from permission-based chain to more widely used non-permission-based chain, allowing it to overcome the complexities and dynamism of open environments. Moreover, the reputation mechanism improves the original efficiency of HotStuff by accurately reflecting the influence of capable nodes in consensus decisions and eliminating low-quality validations.

The rapid evolution of Internet of Things (IoT) demands secure and lightweight authentication schemes for resource-asymmetric environments, where gateways are powerful but user and device sides are constrained. Existing authentication and key agreement (AKA) protocols often fail to provide dynamic anonymity, resist malicious gateways, and support low-entropy passwords. To address these limitations, we propose a certificateless AKA scheme that combines a one-time password algorithm based on hash chains (HOTP) with fuzzy extractors for multi-factor authentication. The scheme ensures full dynamic anonymity, resists replay and impersonation attacks, and eliminates reliance on time synchronization. We formally verify its security using ProVerif and provide informal analysis. Performance comparisons demonstrate that the proposed scheme significantly reduces computational overhead while enhancing security, outperforming existing methods. These results confirm its suitability for secure, scalable IoT applications.

Recently, cloud-edge-device IoT systems are widely used in industrial IoT, smart healthcare, sports and vehicle networking, fostering Sports-IoT development. However, the architecture’s open communication channels and limited capabilities of wearable devices expose user privacy data to interception, tampering, deletion and blocking. Constructing a lightweight and secure authentication and key agreement (AKA) protocol for dy-namic sports scenarios is challenging. To address this, we propose SLAKA-WS, a secure and lightweight AKA scheme for sports wearables, based on lightweight symmetric encryption algorithm ASCON and multi-factor authentication. It achieves mutual authentication, session key agreement, TA-independent dynamic identity and parameter updates, and resists desynchronization attacks. Its security is verified via formal analyses including Real-Or-Random (ROR) Oracle. Comparative studies show SLAKA-WS outperforms other related schemes in communication and computational costs.

Physical Unclonable Functions (PUFs) are widely employed in IoT authentication and key agreement (AKA) to address the challenges of secure key storage. However, PUF-based AKA schemes remain vulnerable to strong physical adversaries. In addition, although existing schemes attempt to reuse challenge-response pairs (CRPs) through various hiding or encryption techniques to mitigate the limitations of weak PUFs, they generally fail to consider the extreme scenario in which a weak PUF supports only a single CRP, and they also cannot guarantee the complete anonymity of IoT devices. To address these limitations, we propose an improved dynamic anonymous authentication scheme tailored for resource-constrained IoT devices suitable for weak PUFs, which mainly employs cryptographic techniques such as Hash, PUF, ECC, AES and Pedersen commitment. By leveraging Pedersen commitments and a single CRP, the scheme enables zero-knowledge proof of the response, ensuring the secure reuse of response R, thereby overcoming the limitations of weak PUFs. Moreover, the challenge C is symmetrically encrypted with a key derived from elliptic curve Diffie-Hellman (ECDH), effectively defending against adversaries with full physical access. To enhance user anonymity and unlinkability, both the Pedersen commitment and the device pseudonym are dynamically updated after each authentication session. Security is formally verified using BAN logic, the Real-or-Random (ROR) model, the ProVerif tool and the Scyther tool. The comparison results demonstrate that our scheme achieves the best performance in terms of computational overhead, storage overhead, energy consumption, and latency, with acceptable communication overhead. The simulation results via OMNeT++ demonstrate the feasibility and scalability of the proposed scheme.

Vehicular Ad Hoc Networks (VANETs) serve as a core enabling technology for intelligent transportation systems, yet existing security protocols face significant challenges. Traditional batch verification mechanisms adopt an "all-or-nothing" strategy, where a single invalid signature triggers the rejection of the entire batch, causing substantial communication latency and amplifying denial-of-service attacks. Moreover, many post-quantum authentication schemes lack standardized deterministic randomness generation, rendering them vulnerable to side-channel attacks. To address these issues, we propose LBSP, a lattice-based batch signature protocol integrated with an efficient malicious signature localization algorithm. A novel error localization mechanism is introduced to rapidly isolate faulty signatures upon batch verification failure, delivering a 3 & times; to 4 & times; performance improvement over conventional binary-tree approaches under typical fault rates. Formal security analysis under the random oracle model demonstrates that LBSP achieves existential unforgeability against adaptive chosen-message attacks (EUF-CMA) under the MLWE assumption, with proven resistance to public key replacement and collusion attacks. Automated verification using the Scyther tool further confirms its robustness against identity spoofing and privacy leakage. Experimental results demonstrate that LBSP achieves the lowest single-signature verification cost among comparable post-quantum constructions. In batch verification scenarios with 128 signatures, LBSP further reduces processing latency by 8%-44% relative to state-of-the-art alternatives. With communication overhead on par with leading post-quantum alternatives, the absolute size remains within VANET transmission constraints, making LBSP a practical, quantum-resistant solution for secure and efficient VANET communications.

The data-centric paradigm promoted by Industry 4.0 is accelerating Industrial Internet of Things (IIoT), resulting in increasingly frequent inter-departmental data interaction. Secure and efficient sharing therefore depends on reliable authentication among smart devices. Current schemes, however, do not jointly satisfy dynamic anonymity, traceability, and low overhead. Consequently, pseudonym management is cumbersome, revocation mechanisms are inflexible and costly. Therefore, we propose a Fibonacci-assisted lightweight anonymous revocable authentication (FLAR) scheme. By integrating a Fibonacci sequence with a hash chain, the scheme enables rapid signature verification. We design a dual parameter derivation algorithm to support swift pseudonym generation while maintaining data traceability and facilitating flexible revocation. Security is rigorously proven: existential unforgeability under chosen-message attacks (EU-CMA) is established in Random-Oracle Model (ROM), and Burrows-Abadi-Needham (BAN) logic plus ProVerif analyses confirm that all specified security properties hold. Performance evaluation shows that, FLAR markedly lowers than the other related schemes both computational and communication overhead, better fulfilling the lightweight and real-time demands of IIoT environments.

Sharding has become one of the key technologies for improve the performance of blockchain systems. However, the imbalance of transaction load between shards caused by extremely hot accounts leads to an imbalance in the utilization of system resources as well as the increase of cross-shard transactions with the number of shards limits the expansion of sharding systems, and sharding systems do not achieve the desired performance improvement. We propose a new blockchain sharding system called D-Chain. D-Chain splits and distributes the state of extremely hot accounts into multiple shards, allowing transactions for an account can be processed in multiple shards, thus balancing the load between shards and reducing the number of cross-shard transactions. We have implemented a prototype of D-Chain, and evaluated its performance using real-world Ethereum transactions. Experimental results show that the proposed system achieves a more balanced shard load and outperforms other baselines in terms of throughput, transaction latency, and cross-shard transaction ratio.

The Internet of Vehicles (IoV) enables real-time sharing of traffic data and collaborative safety management through vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications, where dynamic anonymous authentication is crucial for security and privacy. However, existing schemes achieving dynamic anonymity often suffer from high storage overhead, reliance on online updates. or security vulnerabilities. To address these problems, this paper introduces an efficient and secure dynamic anonymous authentication scheme for IoV based on the Fibonacci sequence, termed FSMAKA. FSMAKA generates one-time pseudonyms using Fibonacci recursion, significantly reducing vehicle storage while ensuring anonymity. It also integrates Certificate-Based Aggregate Signature (CBAS) with Elliptic Curve Cryptography (ECC) to minimize computational and communication costs in multi-vehicle scenarios. Formal security verification is conducted using the Real-Or-Random (ROR) model and ProVerif tool. The verification results confirm the scheme can resist various potential attacks. Performance analysis shows that, compared to existing state-of-the-art AKA schemes, FSMAKA reduces average computational, communication, and storage overheads during authentication by 28.26%, 3.44%, and 76.65%, respectively. With batch authentication, the reduction in average communication overhead can reach approximately 30.49% as the number of communication rounds increases. Simulation results indicate that FSMAKA outperforms existing Authentication and Key Agreement (AKA) schemes in, making it more suitable for deployment in IoV.

In mobile edge computing (MEC), many identity-based authentication schemes rely on an unrealistic prior-knowledge assumption about edge server identities, which limits their applicability in highly dynamic MEC environments. On the other hand, although certificateless schemes alleviate the computational overhead introduced by bilinear pairings in ID-based schemes, they face new challenges regarding secure key storage and the achievement of full user anonymity. To simultaneously address these issues, this paper proposes a new certificateless dynamic anonymous authentication scheme based on physical unclonable functions (PUFs) and elliptic curve cryptography (ECC), tailored for authentication and key agreement between mobile users and edge servers in dynamic MEC environment. By leveraging PUFs, the scheme resolves the key storage issue commonly found in traditional certificateless authentication approaches. Additionally, the scheme supports dynamic anonymity and frequent updates of public-private key pairs, thereby enhancing system security and providing user with full anonymity and unlinkability. The proposed scheme is rigorously evaluated through both informal and formal security analyses, including BAN logic, the Real-Or-Random (ROR) model, and automated verification via ProVerif. Comparative results demonstrate that our scheme achieves stronger computational efficiency, lower energy consumption, lower average message delay, and acceptable communication and storage overhead, while maintaining robust security guarantees compared with recent state-of-the-art approaches in this field.

Sharding technology significantly enhances blockchain performance by dividing nodes into multiple groups to propose blocks in parallel. However, cross-shard transactions require timely communication between shards to ensure information consistency, which has a great impact on the performance of sharded blockchains. To address this challenge, we propose ControlShard, which builds shards specifically for cross-shard transactions and allows users to have different account status in different shards, further reducing communication overhead. ControlShard allows multiple blocks to be committed in a single consensus round and employs a congestion control strategy to determine the maximum number of blocks suitable for the current network conditions. Additionally, ControlShard employs a pipelining strategy to further enhance parallel processing capabilities. We implemented a system prototype and evaluated its performance using real Ethereum transactions. Under the experimental conditions specified in this paper, ControlShard outperforms existing advanced solutions in terms of throughput and transaction confirmation latency, achieving a throughput up to 2.2 times that of BrokerChain and 4.1 times that of Monoxide.

Sharding is a widely adopted technique for enhancing blockchain scalability by partitioning the network into multiple sub-shards, thereby distributing the workload. However, traditional dynamic sharding schemes often suffer from delayed adjustments to the shard count, hindering rapid convergence to an optimal workload distribution in practical deployments and limiting overall scalability. Furthermore, the dynamic participation of nodes is frequently overlooked. To address these challenges, this paper proposes PolyembryonyChain (PE-Chain), a novel and efficient hierarchical sharding architecture designed for environments with dynamically participating nodes, with the goal of achieving elastic scalability. Its core innovations are twofold. First, it introduces a dynamic threshold sharding algorithm that adaptively adjusts the number of shards and optimizes the network topology to enable elastic expansion. Second, it incorporates a validator assignment and reconfiguration scheme, specifically tailored for dynamic hierarchical environments, to ensure system security. A comprehensive security analysis and simulation results demonstrate that PE-Chain significantly outperforms state-of-the-art baselines, achieving approximately 28% higher throughput while maintaining low latency, which underscores its superior scalability and practical value.

identity-based multiproxy signature (IBMPS) enables legitimate signature delegation by forming a proxy group when the original signer is unavailable. In drone networks, this signature method holds considerable promise, particularly in scenarios, such as emergency rescue and military operations. Drones can communicate directly with the execution office on behalf of ground control station, effectively reducing intermediaries in the information transmission. Recently, numerous communication schemes based on IBMPS have been proposed. However, they still exhibit certain limitations. These schemes often overlook situations where drones may malfunction or be captured, resulting in their inability to properly participate in the collaboration process. Moreover, most existing schemes fail to adequately address the protection of drone anonymity and the mitigation of security threats, such as replay attacks. To tackle these challenges, this article proposes a novel cluster-based and synergistically-assisted scheme built on IBMPS. The scheme leverages bilinear pairings and effectively reduces the communication and computational burden on leader nodes. It also employs a token-based mechanism to dynamically delegate communication initiation rights to the leader nodes. A reputation mechanism is adopted to exclude malicious drones dynamically. Finally, an analysis will be conducted to evaluate the security, communication, and computational costs of the scheme. The performance of the proposed protocol is evaluated using the OMNeT++ simulator, focusing on metrics, such as energy consumption, packet loss rate, and end-to-end delay. Experimental results indicate that this scheme has significant advantages in terms of security, with relatively low computational and time costs, and reasonable communication costs.

As smart cities emerge, Vehicular Ad-hoc Networks (VANETs) are rapidly growing in scale and advancing in development. With more vehicles connecting to the Internet of Vehicles (IoV), the demand for robust security and privacy protection becomes critical. Multiple authentication schemes have been proposed in VANETs research to tackle these challenges. Despite extensive research, existing solutions still face fundamental security challenges, such as privacy leaks and modelling attacks, and there is an urgent need to find a breakthrough between security and efficiency. Physical Unclonable Functions (PUFs) are the most promising solution to physical attack problems, leveraging the inherent non-replicability of their physical structure and clever system design to resist physical attacks. However, with the development of artificial intelligence technology, existing authentication schemes using PUF technology are susceptible to machine learning-based modelling attacks. We propose a hybrid PUF-based scheme that disrupts mapping relationships by employing obfuscated challenge-response pairs (CRPs), making it difficult for attackers to establish a stable model even if they obtain partial CRP data. We formally prove its security within the Real-Or-Random (ROR) model, and compared to other schemes, our approach simultaneously satisfies both security and efficiency requirements.

The rapid development of mobile Internet technology has made users’ requirements for quality of service (QoS) continuously improve. The task unloading process of mobile edge computing has the problem that it is impossible to balance delay and energy consumption for task unloading under the condition of fluctuating network bandwidth. To address this issue, this paper proposes a task offloading scheme based on the Proximal Policy Optimization (PPO) algorithm. On the basis of traditional cloud edge collaborative architecture, the collaborative computing mechanism between edge node devices is further integrated, and the concept of service caching is introduced to reduce duplicate data transmission, reduce communication latency and network load, and improve overall system performance. Firstly, this article constructs an energy efficiency function with a certain weight ratio of energy consumption and latency as the core optimization objective. Then, the task offloading process of mobile terminal devices is modeled as a Markov Decision Process (MDP). Finally, the deep reinforcement learning PPO algorithm is used for training and learning, and the model is solved. The simulation results show that the proposed scheme has significant advantages in reducing energy consumption and latency compared to the comparative scheme.

In Industrial Internet of Vehicles (IIoV), vehicles enable efficient cross-domain industrial collaboration through real-time communication with other nodes (infrastructure and other vehicles). Due to the openness of wireless communication in IIoV, a secure authentication protocol is needed to protect vehicle anonymity and communication privacy. However, existing protocols do not address inter-domain Vehicle-to-Vehicle (V2V) communication and suffer from security risks such as key escrow issue, message leakage, and high overhead performance issues. Therefore, we propose a provable privacy-preserving authentication protocol for V2V communication that can guarantee the anonymity security of vehicle identities and the integrity confidentiality of communication messages in V2V communication (including intra-RSU domain V2V communication and inter-RSU domain V2V communication). For privacy-sensitive IIoV scenarios, the proposed protocol supports batch signature authentication of messages and shared responsibility revocation of malicious vehicle identities, which can solve the problems of limited system resources and security risks. The proposed protocol is robust. It is shown to be resistant to multiple malicious attacks through a formal security analysis under the Real-or-Random (ROR) model. In addition, We have simulated the proposed protocol using SUMO, OMNET++. Compared with the existing protocols, we find that the proposed protocol satisfies more security properties and has an excellent performance with low computation cost, communication cost, storage cost, packet loss rate and delay.

mobile edge computing (MEC), as a core infrastructure in the evolution of 5G networks, offers distributed computing power support for low-latency sensitive services. However, the existing authentication mechanism faces multiple challenges: the Denial-of-Service (DoS) attacks, the overload of edge servers due to high-intensity concurrent authentication requests, and fail to protect user's privacy. To address these issues, We have proposed a three-party authentication protocol with conditional anonymity, which reduces the computational cost by 52% in average while ensuring security. Unlike existing schemes, we construct the batch authentication and key agreement protocol based on collaboration between gNBs and mobile edge servers, effectively mitigating the computing and communication overhead pressure on mobile edge servers. Second, we employ temporary public key mechanism and sparse Merkle tree multiproof algorithm to achieve user's unlinkability and resist DoS attacks, respectively. Experiments demonstrate that our protocol significantly exceeds existing protocols in aspects of security attributes, computing overhead, and communication overhead, providing a theoretical basis and methodological support for the secure deployment of large-scale MEC services.

Mobile Edge Computing (MEC), as a new computing paradigm, provides high-quality and low-latency services for mobile users and also reduces the load on cloud servers. However, MEC faces some security threats, such as data leakage, privacy leakage, and unauthorized access. To cope with these threats, many researchers have designed a series of identity-based authentication and key negotiation (ID-AKA) schemes for MEC environments. However, these schemes have some drawbacks, such as key escrow issues, lack of unlinkability and full anonymity, use of time-consuming bilinear pairing operations and insufficiently secure static public-private key pairs. To compensate for these drawbacks, we propose a certificateless anonymous authentication scheme for MEC with enhanced security and high computational efficiency. The scheme achieves unlinkability and full anonymity by using one-time pseudonyms generated by a tamper-proof device (TPD). The scheme also solves the key escrow problem and uses one-time public-private key pairs for authentication, thus enhancing the key security and communication security. In addition, the scheme eliminates bilinear pairing operations and precomputes some time-consuming operations in the TPD each time, thus optimizing the computational efficiency. Finally, we perform the security analysis and performance evaluation of the scheme. The results show that the scheme has the optimal computational efficiency and moderate communication costs, as well as significant advantages in terms of security, as compared to other competing schemes.

The rapid popularization of the Internet of Things has enabled the edge environment to obtain massive data resources. Usually, these data resources need to be further utilized with the help of cloud servers. But this will bring huge communication overhead and privacy security issues. In order to meet this challenge, we propose a safe and efficient data processing scheme based on cloud-edge-end collaboration for federated learning, which can use edge data resources for model training while ensuring low communication overhead and a reliable privacy and security environment. This scheme builds blockchains in sub-regions in the edge environment to ensure the safety and reliability of federated learning end devices. In addition, the solution adopts a layered computing strategy to parallelize the cloud-edge network and the edge-end network. At the same time, the cache pool mechanism is used to alleviate the communication congestion of asynchronous federated learning and the problem of outdated parameter versions, which improves the overall efficiency of the system. Finally, simulation experiments show that our scheme is very suitable for the cloud-edge-end environment, tolerates the heterogeneity and unreliability of terminal devices, and improves the efficiency of global model construction.

Federated learning (FL) has become increasingly popular as a privacy-preserving, distributed training approach. However, recent studies have demonstrated that sensitive information can still be inferred from FL frameworks through certain attacks. Local differential privacy (LDP) provides privacy guarantees for FL and can help reduce potential privacy breaches. Despite this, current LDP-FL frameworks suffer from utility loss because the noise injected is directly proportional to the parameter dimension. To minimize noise, recent studies have employed private selection of the Top-k dimensions of the gradient vector. Yet, these methods are limited by their perturbations to individual data points and fail to address the dimensional dependency issue inherent in LDP. To overcome this challenge, we propose a novel joint perturbation method for sparse gradients, which is divided into two stages: perturbation of the gradient index vector and assignment of gradient values. Our method perturbs high-dimensional sparse gradient vectors as a whole, rather than individual gradients, thus reducing the noise injected into model gradients while preserving the necessary level of privacy. Moreover, to counteract the impact of the randomness introduced by perturbation on model performance, we integrate the Central Limit Theorem (CLT) into the gradient aggregation process, which we call CLT-Agg. We have validated our framework using public datasets, and our findings show a significant improvement over state-of-the-art methods. Extensive experiments have confirmed the effectiveness and efficiency of our proposed framework.

As an important part of the Internet of Things, the Internet of Vehicles (IoV) has achieved efficient interconnection and collaboration between vehicles and road infrastructure, and between vehicles through advanced information and communication technologies. However, the high-speed movement of vehicles has generated a large number of cross-domain behaviors, which has greatly increased the number of authentications. Existing authentication protocols face challenges such as high cost, high computational overhead, and easy eavesdropping, interception, or tampering. To this end, this paper proposes an ECC-based IoV secure and efficient handover authentication protocol. The protocol adopts a “non-full key escrow” mechanism. The private key of the vehicle is jointly generated by the Trusted Authority (TA) and the vehicle. The TA only holds part of the private key. Even if the TA is malicious, the security of the vehicle’s private key can be ensured. At the same time, the proposed protocol uses the time tree technology in trusted computing to share part of the vehicle’s private data, which not only ensures the security of authentication, but also improves the efficiency of authentication, and solves the high-latency problem caused by the use of blockchain in previous protocols. When the vehicle moves across domains, there is no need to re-register and authenticate, which reduces the authentication overhead. Compared with existing protocols, this protocol is lightweight in both computational and communication overheads, effectively solving the problem of excessive cost.