THREE-TIER CONCEPTUAL MODEL OF A DISTRIBUTED IOT EVENT LOGGING SUBSYSTEM WITH HASH-CHAIN INTEGRITY

Abstract

The rapid growth of IoT devices in mission-critical infrastructures demands new approaches to event logging that centralized SIEM platforms fail to deliver in geographically distributed, resource-constrained environments. This paper presents a conceptual model of a distributed IoT event logging subsystem formalized as a tuple LS = (G, E, F, I), where the infrastructure is a weighted directed graph with semantic node decomposition into IoT devices, edge nodes and server components. A three-tier architecture is proposed (collection with local buffering; edge aggregation and filtering; STORE-tier replication out of scope); log immutability is guaranteed by per-device SHA-256 hash chains and Merkle trees. Comparative analysis against ELK Stack, Fluentd and blockchain-based logging shows that none of them simultaneously delivers low end-to-end latency, cryptographic integrity and support for resource-constrained nodes. The model was validated on a hardware testbed of 7×ESP32-S3 devices, a Raspberry Pi 3B edge node and a cloud server communicating over MQTT 5.0 (QoS 1 (at-least-once delivery)). Across 8 scenarios and 350 valid runs the testbed confirmed feasibility: three-tier latency 51–85 ms at message frequency 20 Hz; edge-buffer loss 0.6% during a 30 s WAN partition.