Source-linked AI summary
Blockchain Technologies for the Internet of Things: Research Issues and Challenges
Mohamed Amine Ferrag, Makhlouf Derdour, Mithun Mukherjee, Abdelouahid Derhab, Leandros Maglaras, Helge Janicke
TL;DR
Blockchain protocols for IoT span diverse application domains and face varied security, privacy, resource, infrastructure, and compliance challenges. This paper surveys these protocols, classifies their threat models, compares state-of-the-art approaches, and identifies open research directions.
Problem
Blockchain protocols for IoT involve diverse application domains and threat models, alongside unresolved challenges in GDPR compliance, energy-efficient mining, storage, and infrastructure.
Method
The paper surveys blockchain protocols for IoT, overviews application domains, classifies threats into five categories, and provides a taxonomy and side-by-side comparison of state-of-the-art technologies.
Results
The survey classifies IoT blockchain threat models into identity-based, manipulation-based, cryptanalytic, reputation-based, and service-based attacks.
Takeaways & Limitations
The paper highlights open research challenges and discusses future directions including combined attacks, adaptable security, GDPR compliance, energy efficiency, storage, and skyline-query privacy.
Abstract
from arXiv · showhide
This paper presents a comprehensive survey of the existing blockchain protocols for the Internet of Things (IoT) networks. We start by describing the blockchains and summarizing the existing surveys that deal with blockchain technologies. Then, we provide an overview of the application domains of blockchain technologies in IoT, e.g, Internet of Vehicles, Internet of Energy, Internet of Cloud, Fog computing, etc. Moreover, we provide a classification of threat models, which are considered by blockchain protocols in IoT networks, into five main categories, namely, identity-based attacks, manipulation-based attacks, cryptanalytic attacks, reputation-based attacks, and service-based attacks. In addition, we provide a taxonomy and a side-by-side comparison of the state-of-the-art methods towards secure and privacy-preserving blockchain technologies with respect to the blockchain model, specific security goals, performance, limitations, computation complexity, and communication overhead. Based on the current survey, we highlight open research challenges and discuss possible future research directions in the blockchain technologies for IoT.
I. INTRODUCTION
IoT connects heterogeneous devices across many sectors but faces bottlenecks from device scale and data traffic. Blockchain is presented as a decentralized, cryptography-based approach intended to improve IoT resource management, robustness, and trust.
- IoT interconnects heterogeneous devices across sectors including transportation, smart cities, business, and industry.
- Blockchain provides decentralized, anonymous, and trustful transactions that can support lower operational cost and decentralized resource management in IoT.
- Blockchain is a distributed append-only public ledger using peer-to-peer data sharing, cryptography, and no centralized control or storage.
- Blockchain networks link blocks through hash values and use digitally signed transactions with public and private keys.
- Public and private blockchains differ in consensus execution, ledger maintenance, and authorization to join the peer-to-peer network.
- Consensus protocols, forks, possible 51% vulnerability in new blockchains, and power consumption remain major research issues.
A. Related Surveys and Our Contributions
The paper addresses limitations in prior blockchain surveys by organizing IoT application domains and security research into systematic classifications and comparisons. It also identifies open challenges and future directions for blockchain technologies in IoT.
- A. Related Surveys and Our Contributions: The survey covers blockchain applications across Internet of Vehicles, Internet of Energy, Internet of Cloud, and fog computing.
- A. Related Surveys and Our Contributions: It classifies 16 IoT blockchain attacks into identity-based, manipulation-based, cryptanalytic, reputation-based, and service-based categories.
- A. Related Surveys and Our Contributions: The paper reviews existing research on anonymity and privacy in Bitcoin systems.
- A. Related Surveys and Our Contributions: It compares secure and privacy-preserving blockchain methods by model, security goals, performance, limitations, computation complexity, and communication overhead.
- A. Related Surveys and Our Contributions: The survey highlights open research challenges and discusses possible future research directions in blockchain technologies for IoT.
- A. Internet of healthcare things: Blockchain-based IoT applications include healthcare systems that use distributed storage and blockchain mechanisms for data integrity and portability.
B. Internet of things in the 5G era
Blockchain applications span 5G-connected IoT, vehicles, energy systems, and related infrastructure. The surveyed approaches target privacy, decentralized management, transaction auditing, and protection against data manipulation.
- Blockchain-based schemes address privacy and data sharing in 5G heterogeneous communication environments.
- Internet of Vehicles: IoV applications use blockchain for electric-vehicle charging management, location privacy, vehicular key management, anonymous announcements, and P2P electricity trading.
- The surveyed material includes a table of major attacks on blockchain systems.
- Internet of Energy: GridMonitoring uses a sovereign blockchain with registration, metering, consensus, and data-processing layers to provide transparency, provenance, and immutability.
E. Internet of Things devices
Blockchain is applied to IoT-device security and management, including malware detection, access control, content delivery, and cloud-resource management. These approaches combine distributed architectures with privacy, scalability, or energy-related objectives.
- Malware detection: CB-MDEE uses a consortium chain for detectors and a public chain for users to improve malware-variant detection and reduce false positives.
- Access control: A blockchain-based access-control architecture supports mobility, accessibility, concurrency, lightweight adoption, scalability, and location privacy.
- Content delivery: A decentralized brokering mechanism for blockchain-based video delivery uses content-brokering, delivery-monitoring, and provisioning blockchains.
- Cloud management: Blockchain-based intelligent resource management for cloud datacenters aims to reduce total energy-consumption cost through signed and verified transactions.
I. Intrusion Detection
The surveyed IoT applications use blockchain to support collaborative security, distributed networking, fog-computation payments, P2P cooperation, and privacy-preserving crowdsensing. These mechanisms emphasize trusted exchange, incentives, accountability, and reduced reliance on central authorities.
- Intrusion detection: Blockchain secures alert exchange in collaborative intrusion-detection systems and can avoid the trusted third party used in traditional designs.
- Software-defined networking: DistBlockNet provides a scalable and flexible distributed IoT architecture without a central SDN controller.
- Fog computing: A blockchain-based fog-computing payment scheme addresses completeness, fairness, and accountability when outsourcing computations.
- P2P and crowdsensing: Blockchain incentive mechanisms target selfishness and collusion in distributed P2P IoT applications and support privacy-preserving crowdsensing with k-anonymity.
N. Data storage
The surveyed security landscape covers decentralized storage, Bitcoin privacy and identity mechanisms, and multiple blockchain threat categories. It organizes 16 attacks into five groups and links defenses to identity, reputation, availability, and transaction integrity.
- Data storage: Searchain is a decentralized private-keyword-search architecture comprising transaction nodes and an ordered blockchain, providing privacy, indistinguishability, and accountability.
- Bitcoin: Bitcoin is a pseudonymous P2P payment network built around transactions, consensus, and communication without central authorities.
- Bitcoin privacy: Bitcoin anonymity and privacy research is categorized into transaction analysis, off-network information, network information, and blockchain-data analysis.
- Bitcoin PKI: Cecoin removes the trusted third party from Bitcoin PKI while using incentives and distributed consensus for consistency, certificates, and identity assignment.
- Threat models: The survey classifies 16 blockchain attacks into identity-based, manipulation-based, cryptanalytic, reputation-based, and service-based categories.
- Identity and reputation attacks: Identity attacks include key, replay, impersonation, and Sybil attacks, while TrustChain uses temporally ordered interactions to support Sybil-resistant trustworthiness.
B. Manipulation-based attacks
Manipulation-based attacks involve unauthorized access or data tampering, including false data injection, transaction tampering, overlays, and message modification. The surveyed defenses use consensus verification, homomorphic encryption, timestamps, elliptic-curve hashing, attribute signatures, and MACs.
- Attack categories: Manipulation-based attacks target unauthorized access or tampering of data through four attack types.The categories are false data injection, tampering, overlay, and modification attacks.
- False data injection: Consensus-based voting lets nodes verify received-data integrity and accept data after positive agreement.
- Tampering attack: Homomorphic Paillier encryption and Commitment Proof checks protect signed transaction amounts against tampering.The encrypted amounts are checked by the Commitment Proof.
- Overlay attack: Transaction timestamps distinguish inputs under the same trader and detect forged encrypted amounts added to original amounts.
- Modification attack: Elliptic-curve hashing, attribute signatures, and MACs address modification of broadcast transactions or response messages.
- Related communication threat: Secure mutual authentication using elliptic-curve encryption resists attackers relaying or modifying communications between spoofed parties.
C. Cryptanalytic attacks
The section describes cryptanalytic and reputation-based threats affecting blockchain identities and agent histories. Proposed responses include lattice-based signatures and immutable, queryable interaction records, while whitewashing remains preventable only through lower priority for new identities.
- Cryptanalytic attacks: Quantum attacks target elliptic-curve discrete logarithms to derive private keys and forge unauthorized transaction signatures.
- Cryptanalytic defenses: Lattice-based signatures are proposed to address quantum attacks on elliptic-curve transaction authentication.
- Reputation-based attacks: Reputation manipulation includes hiding blocks and whitewashing attacks that selectively expose positive transactions or replace identities.
- Hiding-block defenses: TrustChain records temporally ordered interactions immutably, allowing agents to request specific records from others.Prior transactions are used as input for assessing agent trustworthiness with Sybil-resistance.
- Whitewashing limitation: Whitewashing cannot be prevented, but new identities can receive lower priority under the allocation policy.
E. Service-based attacks
Service-based attacks seek to disable services or make them deviate from specifications, including denial of service, refusal to sign, double spending, and collusion. Surveyed countermeasures combine distributed architectures, cryptography, transaction rules, and incentives.
- Attack categories: Service-based attacks aim to make blockchain services unavailable or behave differently from their specifications.
- DDoS/DoS attack: Four proposed methods address DDoS/DoS attacks using distributed SDN, decentralized mixing, ring-based ECDSA signatures, and BSeIn resilience.
- Refusal to Sign attack: Refusal-to-sign attacks cannot be prevented, but noninteraction, transaction splitting, and aborting interactions punish or limit malicious agents.
- Double-spending attack: Time stamps, Proof-of-Work, and multi-signature transactions address double spending by requiring temporal or multi-key transaction validation.
- Collusion attack: Incentive mechanisms and pricing strategies are proposed to deter colluding nodes from behaving selfishly for profit.
- Research overview: Table IV summarizes existing research on blockchain-based IoT security and privacy, including authentication and related overhead notation.
B. Privacy-preserving
Blockchain privacy research addresses private-key protection, transaction anonymity, and privacy in constrained or intermittently connected settings. Proposed approaches include HSMs, k-anonymity, cryptographic anonymity mechanisms, zk-STARKs, and layered distributed trust.
- Key protection: Private keys are the highest vulnerability in blockchain systems because wallets and storage environments can be exposed to attacks such as fault injection.
- Key protection: Hardware security modules securely generate, protect, and store keys throughout the cryptographic key lifecycle.HSMs may operate offline or be embedded in servers and hardened against tampering.
- Transaction privacy: Node cooperation verification groups K nodes to achieve k-anonymity privacy protection.
- Transaction privacy: Public-key cryptography, ring signatures, and ECDSA-based unforgeability protect transaction privacy and support anonymity.
- Private transactions: zk-STARKs combine zCash and Ethereum to support anonymous payments, blind auctions, and voting.
- Distributed trust: A two-layer architecture uses selected villagers as miners to authorize transactions under intermittent connectivity to a bank’s central system.
V. OPEN QUESTIONS AND RESEARCH CHALLENGES
The survey identifies unresolved challenges for securing blockchain-based IoT across heterogeneous devices and regulatory, resource, infrastructure, and trust requirements. It emphasizes security solutions that can address combined attacks while remaining adaptable and feasible for constrained devices.
- Resilient and adaptable security: Security solutions must withstand combined attacks while remaining feasible for low-resource IoT devices.The survey frames resilience against combined attacks and implementation feasibility as central design requirements.
- Resilient and adaptable security: Heterogeneous IoT resources require adaptive security frameworks that select services according to available capabilities and minimum user requirements.Devices range from low-power nodes to high-end servers, preventing one uniform security solution from fitting every architecture.
- Regulatory compliance: GDPR compliance remains difficult because decentralized blockchains lack accountable data processors and public ledgers replicate data, conflicting with the right to be forgotten.The survey identifies trusted hardware as one possible direction for addressing this issue.
- Resource efficiency: Energy-efficient consensus and storage approaches are needed because mining and blockchain growth increase computational, energy, and storage demands.Suggested directions include Proof-of-Space, Delegated Proof-of-Space, Proof-of-Stake, and mini-blockchains storing only recent transactions.
- Social networks and trust: Blockchain-based social networks are presented as a possible means of limiting large-scale rumor spreading and its potential social and economic damage.The survey treats fake news and rumor spreading as possible components of cyber attacks.
F. Blockchain-specific Infrastructure
Blockchain-specific infrastructure remains challenging because IoT devices may lack storage for growing ledgers and because vehicular-cloud applications require stronger privacy, authentication, and access control. The survey also identifies skyline-query processing as an unexplored blockchain direction.
- Blockchain-specific infrastructure: Storage-limited IoT devices may be unable to retain growing blockchains or data irrelevant to their own transactions.The survey calls for blockchain-specific equipment supporting decentralized storage of large blockchains.
- Vehicular cloud advertisement dissemination: Vehicular-cloud advertisement dissemination raises privacy concerns because vehicle identities, locations, and transactions may be disclosed.The survey presents these disclosures as critical security issues in vehicular-cloud settings.
- Vehicular cloud advertisement dissemination: Open problems include single-attribute blockchain access control for preserving transaction privacy during vehicular-cloud advertisement dissemination.This challenge targets privacy protection in the dissemination process.
- Vehicular cloud advertisement dissemination: Privacy-preserving secret sharing is needed to acknowledge selected vehicles’ participation in transactions, with homomorphic Paillier encryption offered as an example.The proposed direction focuses on participation privacy in vehicular transactions.
- Vehicular cloud advertisement dissemination: Low-complexity blockchain authentication remains an open problem for communications between roadside units and participating vehicles.The challenge specifically concerns advertisement dissemination processes.
- Skyline query processing: Blockchain-based skyline queries remain understudied, although the CINEMA framework demonstrates privacy-preserving skyline-query use in online medical diagnosis.CINEMA protects medical-data privacy and diagnosis confidentiality.