PaperlayerView exact revision on arXiv

Source-linked AI summary

A Threshold Homomorphic Blockchain Architecture for Secure and Scalable IoT Sensor Data Aggregation

Narendra Kumar Dewangan, Mounira Msahli

arXiv:2608.23396v1cs.CRcs.NI

TL;DR

Existing homomorphic-encryption blockchain systems for IoT aggregation rarely integrate formal security with topology-aware liveness and performance analysis. This paper introduces Φ-PHE-BC, combining threshold Paillier aggregation with validator-graph analysis, and reports lower latency than the selected classical baseline in Hyperledger Fabric tests while preserving distributed threshold trust.

  • Problem

    Existing IoT PHE-blockchain systems rarely provide joint formal security, topology-aware liveness and throughput guarantees, and connectivity-based fault-tolerance analysis.

  • Method

    Φ-PHE-BC combines on-chain Paillier aggregation, threshold decryption, signature integrity, and graph-parameterized liveness, throughput, and communication-cost analysis.

  • Results

    Hyperledger Fabric implementation results suggest lower latency than the selected classical baseline while preserving threshold-based distributed trust in tested configurations.

  • Takeaways & Limitations

    The tested design is practical for secure, privacy-preserving, topology-aware IoT data aggregation under the paper’s stated configurations and assumptions.

  • Takeaways & Limitations

    The architecture does not claim general post-quantum security, and reported findings rely on emulated conditions, selected topologies and validator sizes, and an optional TEE bridge.

Abstract

from arXiv · show

Homomorphic-encryption blockchain frameworks for IoT sensor aggregation generally rely on classical cryptographic hardness assumptions and seldom account for network topology in liveness and performance analysis. This work introduces Phi-PHE-BC, a topology-aware homomorphic blockchain architecture for secure and privacy-preserving IoT sensor data aggregation. The framework combines threshold Paillier decryption with graph-parameterized security and performance analysis, linking protocol behavior to the validator graph. On-chain Paillier ciphertexts support homomorphic aggregation while providing IND-CPA confidentiality under the Decisional Composite Residuosity assumption, and authentication signatures provide EUF-CMA transaction integrity. Threshold partial-decryption shares are protected by a noise-flooding wrapper that provides information-theoretic privacy under the configured statistical-hiding condition. Under partial synchrony and Byzantine fault-tolerance assumptions, liveness requires validator connectivity kappa(Gv) >= f+1. We derive topology-dependent throughput bounds for tree, star, mesh, and scale-free networks, together with a per-block communication-cost model. A game-theoretic analysis shows that honest validator participation is a dominant strategy under the stated utility model, yielding an all-honest Nash equilibrium. Experiments on Hyperledger Fabric 2.5 show lower end-to-end latency than the selected traditional PHE-blockchain baseline while maintaining controllable threshold-decryption overhead. Results across topology scaling, validator sensitivity, threshold decryption, and Byzantine-load experiments indicate that Phi-PHE-BC is a practical architecture for secure, privacy-preserving, and topology-aware IoT sensor aggregation.

1 Introduction

IoT blockchain aggregation must reconcile the utility of combining sensitive sensor data with confidentiality, while existing approaches insufficiently connect cryptographic security to validator-network topology. Φ-PHE-BC addresses this gap through threshold homomorphic aggregation, topology-parameterized analysis, formal security results, and Hyperledger Fabric evaluation.

  • IoT deployments generate sensitive operational data whose utility depends on aggregation while individual readings must remain confidential.
  • Existing PHE-blockchain systems insufficiently address topology-dependent effects on communication, consensus delay, fault propagation, and resilience.
  • Φ-PHE-BC combines on-chain Paillier aggregation, threshold decryption, signature-based integrity, and liveness, throughput, and communication-cost analysis parameterized by deployment topology.
  • κ(Gv) ≥ f + 1 characterizes protocol liveness under a Byzantine adversary across tree, star, mesh, and scale-free topology classes.
  • The protocol provides IND-CPA confidentiality under DCR, information-theoretic protection for flooded threshold shares, and EUF-CMA transaction integrity.
  • Hyperledger Fabric evaluation measures throughput, end-to-end latency, and threshold-decryption overhead against selected classical PHE-blockchain baselines.

2 Literature Review

Prior work demonstrates blockchain–HE feasibility across IoT, healthcare, federated learning, and related settings, but rarely derives formal validator-topology guarantees or jointly analyzes incentives and network structure. Φ-PHE-BC targets these gaps while retaining explicit scope boundaries for dynamic membership and post-quantum security.

  • Blockchain–HE research spans federated learning, healthcare, IoT, transportation, cross-chain access control, and collaborative analytics.
  • Existing studies typically do not connect validator-network graph structure to formal liveness and throughput guarantees.
  • The proposed architecture uses Paillier for lower-cost additive aggregation while treating a TEE-assisted Paillier–BFV bridge as optional.
  • Prior IoT and vehicular schemes do not derive a necessary-and-sufficient validator-connectivity condition, while dynamic membership and mobility-aware rekeying remain outside the formal model.
  • An optional Fiat–Shamir proof addresses ciphertext validity for capable devices without claiming constant-time correctness proofs for the complete workflow.
  • Incentive alignment and network topology are rarely analyzed jointly in HE-enabled blockchain systems.
  • The architecture does not claim general post-quantum security; migration primitives are identified only as future-work candidates.

3 System Model

The system model represents the IoT blockchain as a weighted graph with distinct device, validator, and peer nodes, authenticated channels, and latency-weighted links. Its analysis uses validator connectivity and algebraic connectivity alongside topology classes, device capabilities, and a partially synchronous Byzantine adversary model.

  • Network Graph Model: The IoT blockchain network is modeled as a weighted undirected graph with device, validator, and peer node sets, authenticated channels, and link propagation latencies.
  • Network Graph Model: The validator subgraph governs fault tolerance through vertex connectivity κ(Gv) and information-spread speed through algebraic connectivity λ2(Gv).
  • Topology Classes: The model covers hierarchical tree, hub-and-spoke star, regular mesh, and Barabási–Albert scale-free topology classes.
  • Topology Classes: Star and tree validator subgraphs have κ(Gv) = 1 and therefore require independent validator-subgraph augmentation to satisfy the liveness condition.
  • Device Capability Classes: Device classes D_I, D_II, and D_III are distinguished by CPU and memory capabilities that determine supported cryptographic operations.
  • Adversary Model: The Byzantine adversary may control up to f validators, query encryption and random oracles, and eavesdrop, replay, delay, or inject channel messages.

4 Framework Design

Φ-PHE-BC parameterizes its cryptographic layers and protocol behavior by device capability, aggregation function, cryptographic settings, Byzantine threshold, and network graph. It combines Paillier aggregation, optional BFV bridging, noise-flooded threshold decryption, authenticated transactions, and Fabric-based consensus.

  • Framework Parameterization: A framework instance combines a network graph, device capability class, aggregation function, cryptographic parameters, and protocol parameters.Protocol parameters specify the Byzantine threshold, required threshold shares, block size, and nonce time-to-live.
  • Cryptographic Primitives: Paillier provides ciphertext homomorphic addition and scalar multiplication, with confidentiality based on the Decisional Composite Residuosity assumption.For ciphertext c, decryption of c^k mod n^2 yields the plaintext product km.
  • Cryptographic Primitives: Noise flooding protects threshold-decryption shares through an information-theoretic statistical-hiding condition parameterized by εnf.The condition must be justified for the concrete flooding construction rather than inferred universally from a Gaussian width alone.
  • Adaptive Cryptographic Layering: LAYERSELECT chooses the minimal cryptographic layer set from device class and aggregation function, adding BFV, CKKS, signatures, or zero-knowledge proofs when required.This design targets both missing protections and unnecessary cryptographic overhead.
  • Adaptive Cryptographic Layering: The BFV bridge is necessary for some polynomial aggregation functions because Paillier alone does not support ciphertext–ciphertext multiplication.Bridge security is conditional on uncompromised TEE integrity and attestation, while side-channel, physical fault-injection, and rollback attacks remain outside the guarantee.
  • Protocol Phases: The protocol registers devices, encrypts sensor readings, validates certificates, nonces, and timestamps, aggregates ciphertexts on-chain, and commits blocks through PBFT-style consensus.Individual plaintext sensor readings are not stored in the blockchain world state.

5 Security Analysis

The security analysis separates classical computational guarantees for Paillier confidentiality and signatures from information-theoretic protection for noise-flooded threshold shares. It combines these components into an end-to-end confidentiality argument for the aggregation path.

  • Classical confidentiality: Paillier ciphertexts and aggregates achieve IND-CPA confidentiality against classical polynomial-time adversaries under the DCR assumption.The guarantee covers individual ciphertexts cti and the aggregate ciphertext ctagg.
  • Threshold-share privacy: Noise-flooded threshold-share transcripts receive information-theoretic privacy under the configured statistical-hiding condition.This protection is expressed through statistical distance and does not depend on computational limits such as DCR or EUF-CMA security.
  • End-to-end guarantee: The end-to-end aggregation path satisfies the stated classical confidentiality bound when the DCR assumption and flooding-layer statistical-hiding condition hold.The proof replaces challenge ciphertexts through hybrid games and accounts for published validator shares using a union bound.
  • Transaction integrity: Transaction integrity relies on EUF-CMA-secure signatures that bind device identity, ciphertext, and freshness to each transaction.Timestamp validation and certificate verification additionally prevent replay and bind public keys to registered device identities.

6 Network Resilience and Performance Analysis

The analysis links liveness, latency, throughput, and communication cost to validator-graph properties while distinguishing the device topology from the validator overlay. Byzantine liveness requires sufficient validator connectivity, and topology-dependent diameter shapes performance.

  • Network resilience: A device-layer tree, star, mesh, or scale-free topology does not by itself determine consensus liveness because the validator subgraph can be independently connected.The connectivity condition is determined exclusively by Gv, not by the IoT device-layer topology.
  • Network resilience: κ(Gv) ≥ f + 1 is necessary and sufficient for protocol liveness under the stated authenticated-path and partial-synchrony model.The condition ensures that removing up to f Byzantine validators leaves honest validators connected and able to form a BFT quorum.
  • Performance model: Block latency combines communication delay, homomorphic aggregation time, and threshold-decryption latency, with aggregation cost depending on ciphertext operations and Paillier modulus size.The threshold-decryption term remains explicit because its implementation cost depends on threshold parameters and arithmetic implementation.
  • Performance model: Validator-network diameter parameterizes throughput bounds across the considered topology classes, while star-shaped validator networks minimize the communication component of latency.A star topology must still satisfy the validator-connectivity condition required for Byzantine fault tolerance.
  • Communication cost: Per-block communication includes device transactions, BFT votes, noise-flooded partial-decryption messages, and block metadata.The adopted PBFT-style broadcast introduces O(n_v^2) vote transmissions, which remain the dominant communication term in general.
  • Scope boundary: The analysis establishes topology-dependent guarantees but does not claim a separate closed-form resilience metric based on λ2(Gv) or Δ(Gv).Such a metric is reserved for a future theorem with a formal definition and proof.

7 Game-Theoretic Stability

The game-theoretic model evaluates validator participation under rewards, computational costs, deviation gains, and penalties. Within this utility model, honest participation is dominant and its condition is independent of common cryptographic-cost scaling.

  • Utility model: The utility model assigns honest validators a block reward minus computational cost and deviators an expected gain minus cost and a detection penalty.The parameters include Ri, Ci, α, Gi, and Pi as defined for validator Vi.
  • Equilibrium result: Honest participation is the dominant strategy for every validator under the stated reward-and-penalty condition.The condition follows from comparing honest and deviation utilities in the strategic-form game.
  • Equilibrium result: The cryptographic-cost multiplier α cancels from the utility comparison, so common per-block cryptographic overhead does not alter the equilibrium condition.This result assumes the additional cryptographic cost is incurred symmetrically by honest and deviating strategies.
  • Network position: Higher validator degree can increase effective processing opportunity and reduce the minimum penalty required for honest participation under the reward-allocation model.Dense validator connectivity also benefits liveness independently because κ(Gv) ≥ f + 1 is required.

8 Implementation and Evaluation

The evaluation uses an emulated Hyperledger Fabric 2.5 environment to measure cryptographic, consensus, topology, and throughput behavior under controlled benchmark configurations. The implementation evaluates the primary Paillier threshold-aggregation path with classical ECDSA-256 authentication across four topology classes.

  • Evaluation configuration: The benchmark varies validator counts over nv ∈ {4, 8, 16, 32, 64}, device counts over nd ∈ {50, 200, 500}, and mean link latency over 5 ms and 50 ms settings.Topology and throughput experiments use fixed device populations and workload configurations in addition to the reported scaling dimensions.
  • Evaluation environment: Hyperledger Fabric 2.5, Docker, CouchDB, and Python 3.11 support the emulated evaluation environment.Classical cryptographic operations use pycryptodome, while network conditions are emulated with tc netem and Linux namespaces.
  • Implementation: The implementation integrates homomorphic aggregation, threshold partial decryption, Lagrange combination, and mask cancellation into the chaincode workflow.The PHE aggregation chaincode exposes nine transaction functions corresponding to the protocol phases.
  • Evaluated protocol: The evaluated baseline uses Paillier aggregation, ECDSA-256 signatures, and ECDH key establishment.The primary benchmark path excludes optional BFV/CKKS bridge and ZKP configurations unless explicitly stated.
  • Topology emulation: Four topology classes are emulated using Linux network namespaces and per-link latency injection for topology-scaling experiments.The evaluated classes are tree, star, mesh, and scale-free networks.
  • Cryptographic performance: 7.2 ms is the reported Φ-PHE-BC encryption latency in the representative PHE comparison.Figure 3 also examines batch-size effects, ciphertext-size expansion relative to ECIES, and threshold-decryption latency as t increases.

8.2 Throughput and Latency

Measured throughput and latency follow the paper’s topology- and validator-dependent performance analysis. In the stated cross-system benchmark, Φ-PHE-BC improves throughput and end-to-end latency relative to Si et al., while threshold decryption is slower.

  • Validator sensitivity: Throughput decreases as validator population grows because the adopted BFT voting procedure includes quadratic all-to-all communication.Smaller effective validator-network diameter reduces the communication component under the intra-data-center setting τ = 5 ms.
  • Byzantine-load sensitivity: 27–31 ms consensus latency and 100% decryption success were measured for nv = 7, f = 2, and nbyz ∈ {0, 1, 2}.No empirical claim is made for nbyz > f.
  • Cross-system benchmark: Approximately 3120 TPS versus approximately 1950 TPS for Si et al. is reported under the cross-system benchmark.These are configuration-specific benchmark values.
  • Cross-system benchmark: Approximately 410 ms versus approximately 2307 ms is the corresponding end-to-end transaction-latency comparison, an approximately 82% reduction.The comparison is against Si et al. under the stated benchmark configuration.
  • Threshold-decryption trade-off: 13.8 ms versus 9.8 ms is the reported threshold-decryption comparison between Φ-PHE-BC and Si et al.Φ-PHE-BC has better reported end-to-end latency and throughput despite the higher threshold-decryption time.
  • Architecture trade-offs: The proposed threshold design distributes decryption authority at the cost of additional cryptographic and communication overhead.The comparison includes plaintext, single-key PHE, ECIES-based encrypted blockchain, and threshold-PHE configurations.

8.3 Security–Performance Comparison

The comparison presents Φ-PHE-BC as combining threshold decryption, blockchain integration, homomorphic aggregation, topology-aware analysis, and connectivity-based fault-tolerance analysis. Empirical liveness results cover only the configured fault-tolerant regime.

  • Architectural comparison: Φ-PHE-BC jointly provides threshold decryption, blockchain integration, homomorphic aggregation, topology-aware liveness and throughput analysis, and connectivity-based fault-tolerance analysis.This combination distinguishes it from the selected comparison schemes in the architectural matrix.
  • Liveness evaluation: 100% of recorded trials completed successfully for nv = 7, f = 2, and nbyz ∈ {0, 1, 2} under a fully connected validator overlay.These measurements are consistent with the sufficiency direction of Theorem 9.
  • Evaluation boundary: The empirical evaluation covers only the fault-tolerant regime and does not test validator overlays with κ(Gv) < f + 1 or partition attacks for nbyz > f.The necessity direction is supported by a constructive partition argument rather than an empirical failure-regime experiment.

8.5 Limitations and Future Work

The paper bounds its conclusions by the emulated evaluation setting, selected workloads, classical cryptographic assumptions, and unvalidated failure regimes. Future work targets post-quantum migration and broader empirical validation.

  • Scope limitations: The experiments use an emulated Hyperledger Fabric environment and modeled topologies rather than a large-scale physical IoT deployment.Reported performance is implementation-level evidence under tested configurations, not a universal deployment guarantee.
  • Optional extension: The optional Paillier–BFV bridge depends on a trusted execution environment and its associated trust and implementation assumptions.This dependency is separate from the primary Paillier aggregation path evaluated in the experiments.
  • Topology boundary: Tree and star device deployments do not themselves guarantee the validator-connectivity condition κ(Gv) ≥ f + 1.The validator overlay must be configured or augmented independently.
  • Liveness limitations: The failure regime predicted by Theorem 9 remains experimentally unvalidated for controlled vertex-cut and partition attacks.The empirical liveness study covers only nbyz ≤ f.
  • Cryptographic scope: The architecture does not claim general post-quantum security because Paillier confidentiality and ECDSA-256 integrity remain classical results.The flooded partial-decryption-share protection is statistical and information-theoretic under its modeled conditions.
  • Post-quantum migration: Promoting lattice-based aggregation to the primary path requires a new protocol design and security analysis.The optional Paillier-BFV bridge is TEE-dependent, and the current noise-flooding analysis does not transfer automatically to ring-based schemes.
  • Post-quantum migration: No ML-KEM, ML-DSA, BFV-primary aggregation, or other lattice-based post-quantum configuration is implemented or proven in the present paper.The roadmap calls for future end-to-end overhead measurements after migration.
  • Interpretation boundary: Throughput values from validator-count, cross-system, and cross-variant experiments should be compared only within their stated benchmark settings.They are not interchangeable estimates of one deployment-wide throughput constant.

9 Conclusion

Φ-PHE-BC combines encrypted aggregation, threshold-decryption share protection, transaction integrity, and topology-parameterized performance analysis. The implementation results suggest practicality under tested configurations, while the security scope and evaluation remain bounded by stated assumptions and settings.

  • Φ-PHE-BC integrates on-chain Paillier aggregation, protected threshold decryption, signature-based transaction integrity, and topology-parameterized liveness, throughput, and communication-cost analysis.
  • Validator-graph connectivity is proved to be a necessary and sufficient determinant of protocol liveness.The conclusion identifies this proof as the work’s central contribution.
  • Topology-parameterized throughput bounds cover tree, star, mesh, and scale-free deployments alongside an explicit per-block communication-cost expression.
  • Hyperledger Fabric implementation results suggest practicality for tested configurations and lower latency than the selected classical baseline while preserving threshold-based distributed trust.Interpretation is limited by emulated network conditions, selected topology classes and validator sizes, and reliance on a trusted execution environment for the optional bridge.
  • Security claims are scoped to the established classical and information-theoretic guarantees, with fully post-quantum confidentiality left as a primary future direction.
  • Future work extends evaluation to real-world deployments, broader workloads and mobility, and stronger correctness verification under less trusted execution assumptions.
Loading 2608.23396v1…