In this article, we propose zero-knowledge named proof, a stateless replay attack prevention strategy that ensures the user’s anonymity against malicious administrators. We begin with adopting the zero-knowledge set-membership proof into an authentication setting in which users would delegate their requests to an agent that obstructs the user’s identity from the administrator. This anonymous agent carries the guarantee of authenticity, which the administrator through the set-membership proof can confirm. Next, we prevent replay attacks from other parties by binding the agent’s identity to the authentication proof verifiable by the administrators. By leveraging these properties, a scalable blockchain-based authentication scheme is then built. We quantitatively evaluate the security and measure the time and monetary cost of our scheme under both ideal and realistic environments. On top of it, we provide a third-party authorization scheme derived from our authentication framework to demonstrate its real-world applicability.

The rapid evolution of digital identity verification demands solutions that balance security, privacy, and efficiency. The electronic know your customer (eKYC) is a technological integration for client identification. It automates the process, reducing costs related to traditional know your customer (KYC). This includes eliminating paper-based document management, reducing manpower needs, and minimizing human errors. This systematic literature review (SLR) uses the preferred reporting items for systematic reviews and meta-analyses (PRISMA) model to investigate the revolutionary potential of blockchain-based electronic KYC (eKYC), focusing on self-sovereign identity (SSI) and Decentralized Identifiers (DID). The evaluation summarizes the current state by critically assessing 44 selected research works from an initial pool of 367. Our findings show that decentralized eKYC improves security with tamper-proof credentials and cryptographic verification. SSI and DID give users control over their data and selective disclosure. However, there are key limitations: 1) a focus on financial applications, ignoring Internet of Things (IoT) integration; 2) a lack of comprehensive technical analysis on scalability and interoperability; and 3) limited real-world case studies on regulatory compliance and challenges. This work combines insights from research and industry, highlighting the need for regulatory collaboration, hybrid architectures for scalability, and user-centric design. In addition, most identity management solutions are based on Ethereum (33%), followed by Hyperledger (18%). Around 51% of solutions use smart contracts, with banking (23%) and the financial industries (19%) being the primary adopters. It emphasizes the importance of standardized eKYC protocols, technical evaluations, and interdisciplinary collaboration for practical adoption across sectors.

Millimeter-wave (mmWave) communications are highly promising to improve the capacity of modern wireless networks, while the physical layer security (PLS) techniques hold great potential to enhance the critical secrecy performance therein. By carefully exploiting the significant signal difference between the Non-Light-of-Sight (NLoS) and Line-of-Sight (LoS) mmWave links, this paper proposes a Sight-based Cooperative Jamming (SCJ) scheme to improve the PLS performance of mmWave ad hoc communications. In this scheme, each potential jammer that has no LoS link to its nearest receiver but may have LoS links to eavesdroppers is selected with a certain probability to generate artificial noise such that channel advantages at legitimate receivers can be achieved. For performance modeling of the new jamming scheme, novel and efficient theoretical approximation approaches are firstly developed to enable the challenging issue of interference distribution modeling to be tackled, and then a theoretical framework based on stochastic geometry is proposed to capture the secrecy transmission capacity behavior under the SCJ scheme. Finally, extensive numerical results are provided to illustrate the SCJ scheme under various network scenarios.

Blockchain-based access control (BBAC) has been highly promising to prevent unauthorized resource access in the Internet of Things (IoT). However, maintaining BBAC can be potentially expensive due to the storage cost of the blockchain. To address this issue, we propose a layered BBAC architecture by combining blockchain with blockchain oracle and tamper-proof decentralized storage (e.g., IOTA). The proposed architecture consists of three main layers: a blockchain layer, which provides distributed and trustworthy access control, a storage layer, which stores meta data (e.g., subject/object attributes and policies) used in the access control of the blockchain layer, and an oracle layer, which works as a bridge to help transfer data between the blockchain and decentralized storage. This architecture achieves robust, auditable, and cost-efficient access control by migrating the meta data from the blockchain to the decentralized storage while keeping the fascinating tamper-proof feature of the blockchain. We implement and evaluate this architecture in terms of time and monetary cost to demonstrate its feasibility and superiority over existing ones.

Efficient and reliable access control in smart cities is critical for the protection of various resources for decision making and task execution. Existing centralized access control schemes suffer from the limitations of single point of failure, low reliability, and poor scalability. This article, therefore, proposes a distributed and reliable access control framework for smart cities by combining the blockchain smart contract technology and the attribute-based access control (ABAC) model. The framework consists of one policy management contract (PMC) for managing the ABAC policies, one subject attribute management contract (SAMC) for managing the attributes of subjects (i.e., entities accessing resources), one object attribute management contract (OAMC) for managing the attributes of objects (i.e., resources being accessed), and one access control contract (ACC) for performing the access control. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to evaluate the monetary cost as well as to compare the proposed framework with an existing access control list (ACL)-based scheme. The experimental results show that although the proposed scheme consumes more money than the ACL-based scheme at the deployment stage, it introduces less monetary cost during the system running especially for large-scale smart cities.

Periodic update of software is one of preventive measures against malicious attacks. When the software is used by many users, e.g., Operating System (OS), the distribution server for update tends to be a bottleneck. To tackle this problem, several systems, e.g., Windows update, recently apply Peer-to-Peer (P2P) file distribution where clients called peers upload retrieved fragments of the whole content, i.e., pieces, to other peers. However, some peers will not be willing to upload pieces to others, which are called free riders, due to communication overhead. Tit-for-Tat (TFT) strategy in game theory can alleviate such free riding behavior by encouraging equivalent exchange of pieces among each pair of peers. In recent years, the optimality of P2P file distribution under strict TFT constraint has been analyzed. In this paper, considering the fact that the communication overhead inside a group, e.g., LAN or AS, is much less than that between different groups, we consider the locality-aware TFT-based P2P file distribution where the TFT constraint is relaxed for intra-group communication. We find that the minimization of average file download time in the relaxed TFT-based P2P file distribution can also be modeled as Integer Linear Programming (ILP), as in the existing work. Through numerical results, we show that the relaxed TFT model contributes to shortening the average file download time among peers by about 18.3% compared with the strict TFT-based model.

The large-scale and trustless nature of the Internet of Things (IoT) calls for distributed and trustworthy access control schemes to prevent unauthorized resource access. This paper proposes a Capability-Based Access Control (CapBAC) scheme by applying the emerging Ethereum blockchain technology. This scheme uses Ethereum smart contracts, i.e., executable codes residing in the blockchain, to store and manage the capability tokens, i.e., special data structures that maintain the allowed actions of a user (i.e., subject) on a certain resource (i.e., object). To provide more fine-grained access control and more flexible token management, this scheme defines capability tokens in units of actions, i.e., by dividing a conventional capability token containing multiple actions into multiple ones with each being associated with a certain action. In addition, this scheme uses a delegation graph instead of the delegation tree in existing smart contract-based CapBAC schemes to store the token delegation relationship among the subjects. By storing the tokens and the delegation graph in smart contracts, this scheme allows object owners to verify the ownership and validity of the capability tokens of the subjects. To demonstrate the feasibility of the scheme, we constructed a local Ethereum blockchain network and conducted extensive experiments.

Access control has been recognized as a critical issue for preventing unauthorized access to the resources in Internet of Things (IoT) systems. This paper proposes an Attribute-Based Access Control (ABAC) framework for IoT systems by using the emerging Ethereum smart contract technology. The framework consists of one Policy Management Contract (PMC), one Subject Attribute Management Contract (SAMC), one Object Attribute Management Contract (OAMC) and one Access Control Contract (ACC). The PMC, SAMC and OAMC are responsible for storing and managing the ABAC policies, the attributes of subjects (i.e., entities accessing resources) and the attributes of objects (i.e., resources being accessed), respectively. When receiving access requests, the ACC retrieves the subject attributes and object attributes as well as the corresponding policy from the SAMC, OAMC and PMC to perform the access control. Combining the ABAC model and the blockchain technology, this framework is expected to achieve distributed, trustworthy and fine-grained access control for IoT systems. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to test the monetary and time cost.

This paper investigates a critical access control issue in the Internet of Things (IoT). In particular, we propose a smart contract-based framework, which consists of multiple access control contracts (ACCs), one judge contract (JC), and one register contract (RC), to achieve distributed and trustworthy access control for IoT systems. Each ACC provides one access control method for a subject-object pair, and implements both static access right validation based on predefined policies and dynamic access right validation by checking the behavior of the subject. The JC implements a misbehavior-judging method to facilitate the dynamic validation of the ACCs by receiving misbehavior reports from the ACCs, judging the misbehavior and returning the corresponding penalty. The RC registers the information of the access control and misbehavior-judging methods as well as their smart contracts, and also provides functions (e.g., register, update, and delete) to manage these methods. To demonstrate the application of the framework, we provide a case study in an IoT system with one desktop computer, one laptop and two Raspberry Pi single-board computers, where the ACCs, JC, and RC are implemented based on the Ethereum smart contract platform to achieve the access control.

This paper investigates the fundamental issues of mode selection and spectrum partition in cellular networks with in-band device-to-device (D2D) communication from the physical-layer security (PLS) perspective. We consider a mode selection scheme allowing each D2D pair to probabilistically switch between the underlay and overlay modes, and also a spectrum partition scheme where the system spectrum is orthogonally partitioned between cellular and overlay D2D communications. We first develop a general theoretical framework to model the secrecy outage and secrecy capacity performance of cellular users as well as the outage and capacity performance of D2D pairs. Optimization problems are also solved to identify the optimal mode selection and spectrum partition for secrecy capacity maximization and secrecy outage probability minimization. A case study is then provided to demonstrate the application of our theoretical framework for performance modeling and optimization, and also to illustrate the impacts of mode selection and spectrum partition on the PLS performances of in-band D2D communications.

Partitioning a graph into balanced components is important for several applications. For multi-objective problems, it is useful not only to find one solution but also to enumerate all the solutions with good values of objectives. However, there are a vast number of graph partitions in a graph, and thus it is difficult to enumerate desired graph partitions efficiently. In this paper, an algorithm to enumerate all the graph partitions such that all the weights of the connected components are at least a specified value is proposed. To deal with a large search space, we use zero-suppressed binary decision diagrams (ZDDs) to represent sets of graph partitions and we design a new algorithm based on frontier-based search, which is a framework to directly construct a ZDD. Our algorithm utilizes not only ZDDs but also ternary decision diagrams (TDDs) and realizes an operation which seems difficult to be designed only by ZDDs. Experimental results show that the proposed algorithm runs up to tens of times faster than an existing state-of-the-art algorithm.

In this paper, we consider a data-flow management mechanism for data center networks, in which a centralized controller called arbiter manages data flows. We propose a simple algorithm for the arbiter to distribute flows over different time points and paths, in a preemptive scheduling and traffic load-balancing manner. The proposed algorithm is based on table-driven resource reservation, in which states of all the links in a data-center network are registered in a single table, and its information is updated whenever a new flow-request arrives at the arbiter. We evaluate the performance of the proposed algorithm through simulation experiments, investigating bit allocation rate and flow allocation rate, under different flow-size distributions. Numerical results show that the proposed algorithm can achieve high bit allocation rate without collisions. It is also shown that the proposed algorithm can allocate many flows within a small time interval even when the variance of flow-size is large.

IEEE 802.11-based multihop wireless networks have attracted considerable attention for next-generation networks since it can extend the service coverage area without difficulty. However, it is well known that the effective end-to-end throughput (E2ET) degrades due to the overhead caused by the distributed coordination function (DCF) scheme of IEEE 802.11 MAC protocol. To improve this issue, the transmission opportunity (TXOP) mechanism is defined in the IEEE 802.11e standard, with which a wireless node can transmit multiple frames consecutively for a maximum channel occupancy time, called TXOPlimit. This paper considers the performance of the TXOP mechanism for multihop wireless networks. Focusing on a three-node chain topology, we model it as a tandem queueing network with two nodes. The E2ET is derived and the analysis is validated by simulation. Numerical results show that the TXOP mechanism works well for multihop wireless networks. It is also shown that adjusting TXOPlimit is significantly important in order to increase the overall throughput.

This paper considers the characteristics of consecutive block loss for streaming services in which a block for a streaming service consists of original data packets and redundant ones generated by forward error correction (FEC). We consider a single-server queueing system with two input processes: a general renewal input process and a Poisson one. The former represents a streaming-packet flow, while the latter is for background traffic multiplexed at the queue. We investigate the dynamics of the system state during the interval from the arrival epoch of the first packet of the block to that of the last one, deriving the block-loss run distribution, i.e., the probability distribution of the number of consecutive block losses. The analytical model is validated by trace-driven simulation experiments. Numerical examples show that the moments of the distribution are significantly affected by the volume of background traffic and the FEC redundancy, rather than the system capacity.

Network coding is expected to improve throughput performance of multihop wireless networks. However, the throughput performance is significantly affected by the coding overhead at intermediate nodes. In this paper, we consider the trade-off between the throughput and coding overhead. Focusing on an intermediate node of a three-node chain topology, we model it as a single-server queueing system with two buffers. The per-flow throughput is analyzed with a continuous-time Markov chain, and the analysis is validated by simulation. Numerical results show that the analytical results agree fairly well with simulation when the offered loads of the flows are the same. It is also shown that a long processing time for coding causes a significant reduction in throughput.

In this paper, we propose a dynamic lightpath establishment method for service differentiation in all-optical WDM networks with the capability of full-range wavelength conversion. In the proposed method, first, the optimal lightpath establishment policy for the service differentiation is derived based on Markov decision process (MDP). The optimal policy considered here is to provide the service differentiation for the lightpath establishment, keeping the probability that the lightpath establishment fails small. Then, each node processes signaling messages according to this optimal policy. In this method, each node is required to store additional information about the number of established lightpaths and the action for the lightpath establishment. In numerical examples, we show that our proposed method can provide the service differentiation for the blocking probability that the lightpath establishment fails, decreasing the overall blocking probability. We also show the effectiveness of the proposed method in a uni-directional ring network.

In order both to solve the unfairness of the burst loss probability in terms of the number of hops and to decrease the overall burst loss probability, we propose the hop-based burst cluster transmission. In this method, bursts with different numbers of hops are assembled simultaneously, and a hop-based burst cluster is generated so that the bursts in the cluster are arranged in order from the smallest number of hops to the largest one. Then the hop-based burst cluster is transmitted along with multiple control packets according to the burst transmission scheduling. Here, a burst with a small number of hops in the cluster is transmitted before the transmission of a burst with a large number of hops in the same cluster. We evaluate the performance of the burst-cluster transmission for a unidirectional ring network by simulation. Numerical examples show that the proposed method not only improves the fairness of the burst loss probability but also decreases the overall burst loss probability significantly.

Currently, grid computing and CD/DVD delivery are considered as applications in OBS networks. For these applications, multiple bursts are required to be transmitted simultaneously to any node in contrast with the conventional burst transmission. Moreover, the reliable transmission has to be provided for the multiple bursts. In this paper, we propose a consecutive burst transmission with burst loss recovery based on forward error correction (FEC) for the multiple-bursts transmission. In the proposed method, redundant data is generated from multiple bursts with FEC, and a redundant burst is assembled with the redundant data. Then, the multiple bursts and the redundant burst are transmitted consecutively. If a burst among the bursts is lost at some intermediate node, the lost burst is recovered with the redundant burst at the destination. We evaluate by simulation the proposed method in a uni-directional ring network and compare the performance of the proposed method with the extra-offset time scheme. Numerical examples show that the proposed method can provide a more reliable transmission than the extra-offset time scheme for the OBS network where the burst size and the maximum number of hops are large.

In this paper, we propose a new preemptive scheme with release message for optical burst switching networks. In the proposed scheme, when a low priority burst is preempted at some intermediate node, two release messages are sent immediately from the intermediate node to both source and destination nodes (two-way transmission), and the release messages release the corresponding wavelengths for the preempted burst. We consider five wavelength selection rules for the preemption and evaluate the performance of the selection rules with simulation. In numerical examples, we show that with our method, the wavelengths are utilized effectively and that our proposed method with the optimal selection rule can decrease the burst loss probability in a large-scale DWDM network.

In this paper, we propose a round-robin burst assembly and constant burst transmission for optical burst switching (OBS) network. In the proposed method, ingress edge node has multiple buffers where IP packets are stored depending on their egress edge nodes, and bursts are assembled at the buffers in round-robin manner. Moreover, bursts are transmitted at fixed intervals with scheduler. To evaluate the performance of the proposed method, we construct a loss model with deterministic and Poisson arrivals, and explicitly derive burst loss probability, burst throughput, and data throughput. In numerical examples, we show the effectiveness of our analysis and compare the performance of the proposed method with Erlang loss system.