Blockchain and Certificate-Based Cross-Domain Authentication and Key Agreement Protocol for the Internet of Things
With the deep integration and widespread application of Internet of Things (IoT) technology across multiple fields, the security of cross-domain communication between intelligent terminal devices has become increasingly critical. Blockchain-based authentication and key agreement (AKA) protocols are a core solution for securing cross-domain communication in IoT. However, existing cross-domain AKA protocols suffer from shortcomings such as a lack of anonymity, an absence of perfect forward secrecy, and insufficient resistance to Ephemeral secret leakage (ESL) attacks. More importantly, most schemes record registration materials into the blockchain ledger without verifying their legitimacy, which may lead to impersonation attacks and privacy leakage risks. Meanwhile, when the blockchain is used only as a storage layer and does not participate in authentication, terminal devices may still suffer from high computational and communication overhead. To address these issues, this article proposes a blockchain- and certificate-based cross-domain AKA protocol for IoT. This protocol leverages elliptic curve cryptography (ECC) to achieve anonymity and resistance to key compromise impersonation (KCI) attacks. A two-stage smart contract for registration and authentication is designed to validate registration information on-chain and support identity authentication, thereby reducing overhead. Furthermore, the protocol combines ephemeral keys and long-term keys to generate session keys, ensuring perfect forward secrecy and resistance to ESL attacks. The proposed protocol satisfies the required security properties, which are verified through formal proof and ProVerif-based validation. Experimental and performance analyses show that the protocol has reduced total computation overhead, communication overhead, and energy consumption by at least 23.4%, 10.0%, and 10.0%, respectively. Additionally, the deployment and execution overheads of the smart contract are 472664 Gas and 32446 Gas, respectively. In a multidevice concurrent scenario, system latency remains stable between 335–355 ms, and the throughput is approximately 4.9 txn/s, demonstrating good system stability and scalability. Furthermore, high-concurrence tests on the Huawei Cloud ECS–Raspberry Pi 5 cloud–edge testbed show that the protocol verification process has a complexity close to $\mathcal {O}(1)$ . The protocol is suitable for resource-constrained and large-scale IoT cross-domain scenarios.