Authentication Technology in Internet of Things and Privacy Security Issues in Typical Application Scenarios

Abstract

This paper mainly summarizes three aspects of information security: Internet of Things (IoT) authentication technology, Internet of Vehicles (IoV) trust management, and IoV privacy protection. Firstly, in an industrial IoT environment, when a user wants to securely access data from IoT sensors in real-time, they may face network attacks due to the data being transmitted through an open channel. In order to solve this problem, we innovatively propose a user and device authentication model integrated with cloud computing, introduce an algorithm related to protocol design, and summarize the research direction of developing a more lightweight algorithm when designing security protocols in the future. Secondly, for mobile IoT applications, such as IoV, information collection and distribution is realized by establishing a network between vehicles and infrastructure. IoV will face security threats such as information insecurity and privacy disclosure. We introduce a typical trust management model for the IoV, which solves the problem of information unreliability by storing vehicle trust values. In the future, we are committed to making the process of computing node credibility using a trust model more robust. Finally, aiming at the privacy protection of the IoV, we propose a cross-domain anonymous authentication system model based on blockchain. The user’s auxiliary authentication information is stored in the blockchain, and the auxiliary authentication information of any registered user can be obtained from the blockchain. The privacy protection of cross-domain authentication can be realized through anonymous authentication, which greatly saves the communication cost of cross-domain authentication. In the future, we will try to use deep learning or federated learning to integrate with blockchain for actual deployment.

1. Introduction

With the development of a new generation of communication technologies, the Internet of Things (IoT) is playing an indispensable role in every aspect of people’s work and life, with increasingly widespread applications in intelligent transportation, safe homes, industrial monitoring, personal health, and online intelligence gathering [1]. Specifically, sensors are embedded and equipped in railways, cars, wearables, buildings, and other objects, combining the IoT with the Internet to enable the integration of people, social and physical systems. Although the wide application of IoT technology in various fields has indeed improved the efficiency of social operation, security and privacy protection issues have also aroused people’s attention [2]. IoT authentication technology, Internet of Vehicles (IoV) trust management, and privacy protection are fundamental issues for the security of the IoT. The solution to these issues is closely related to the overall security of IoT systems. At the same time, these three directions are also closely related to key application scenarios of IoT, such as smart cities, intelligent transportation, etc. Therefore, when discussing the information security issues of IoT, these three topics are essential.

First of all, IoT sensor nodes are typically low-power, low-cost, and lightweight devices; therefore, their computing power is relatively limited, leading to their weak ability to resist malicious attacks, which exacerbates the proliferation of malicious attacks on IoT devices. Many existing security mechanisms fail to meet the needs of current high-security features. As a result, devices in various application scenarios are threatened by malicious codes or illegally controlled by rivals. Authentication mechanisms are the first line of security in IoT information security. Secondly, in the transportation IoT, also known as the IoV, the real communication between vehicles is related to social order and life safety. If some malicious vehicle nodes send false information, the consequences will be unimaginable. How to guarantee real communication between vehicles is also a focus of our research. Finally, in the authentication process of the IoT, there is often the demand for cross-domain access of users, and repeated authentication will bring heavy communication costs and expose the privacy of users. Therefore, we also designed a cross-domain anonymous authentication scheme based on blockchain to meet the above requirements. Since there are many widely used technologies in the security mechanisms of the IoT, such as cloud computing and blockchain, the following will introduce the application of these two technologies in the solution.

Since the introduction of IoT technology, application providers have urgently needed updates to and technical progress of IoT technology. The addition of cloud computing meets the needs of the rapid development of the IoT [3,4]. The new model of the IoT needs to realize automatic data processing and exchange operations, which can not only ensure the high efficiency of computing power and storage capacity but also ensure data security and significant cost advantages. Cloud computing technology can meet the above requirements, so the in-depth and effective implementation and application of IoT technology cannot be separated from cloud computing [5].

Cloud computing has advantages over traditional computing models, such as high-speed Internet connections and nearly unlimited storage and computing power [6]. Cloud computing mainly combines multiple computer entities into a powerful computing system through grid computing technology and then distributes the supercomputing power of cloud computing to the end users equally, so that applications can be processed in parallel at a very low cost. In addition to computing power, the advantage of storage capacity is also evident in cloud technology. In recent years, people have become accustomed to transferring the unstructured data they generate or the resources they use to the cloud. In order to protect the privacy of user information, a cloud storage system should have high reliability and automatic fault tolerance.

There are a large number of wireless terminal nodes in the IoT, and mobility nodes may also exist [7]. Without effective management, these nodes are likely to be maliciously invaded, causing errors in device operation analysis and even major accidents [8]. In addition, the nodes in IoT generally consist of sensors with relatively simple functions, which do not have the ability to detect the security of the system [9]. In a peer-to-peer network, when there are too many nodes and excessive network latency, the transaction sequence observed by each node in a certain period of time may not be completely consistent. Based on the above, we need to design a consensus mechanism to ensure that the order of transactions occurs in the same time. The characteristics of blockchain can provide this mechanism for ensuring the secure transmission of data between IoT devices [10,11].

Researchers have provided a series of methods of blockchain deployment in IoV. There are usually two existing entities in IoV: vehicles and roadside units (RSU). The communication styles are divided into vehicle-to-vehicle (V2V) communication and vehicle-to-infrastructure d(V2I) communication. It is common to consider blockchain as a decentralized database. Regarding the process of initial V2I authentication as a transaction, blockchain make use of its chain structure to storage the vehicles’ partial autentication information. Thanks to its chain structure, blockchain can guarantee data consistency, thus making it possible to realize cross-domain authentication. In IoV, RSUs are usually chosen as miners to commit ledgers because they are more stable and secure than vehicles. In the following V2I and V2V authentication phase, RSUs only need to search for the information of vehicles requiring authentication in the blockchain. As a consequence, there is no need for a third-party certification center to always be online. Combing blockchain and IoV enables IoV to further improve its authentication efficiency and scalability [12]. The deployment of blockchain in IoV is shown in Figure 1.

1.1. Contribution

The contributions of this paper are as follows:

• For the user authentication scenario of the IoT, we analyze the attacks faced by the three-layer structure of the IoT and summarize some methods, algorithms, and previous work of the IoT authentication. Finally, we describe the direction of our future research.
• Aiming at the requirements of vehicle security communication in the IoV, we introduce a trust management model based on blockchain, summarize some common consensus algorithms, and explore the future direction of trust management in the IoV.
• For IoT users’ cross-domain anonymous access requirements, we introduce a cross-domain anonymous authentication system model based on blockchain, summarize the previous work, and conclude and compare the performance parameters of several consensus algorithms.

1.2. Paper Outline

Section 2 introduces the problems in designing authentication protocols for the IoT, including privacy protection and false information spread by malicious nodes in the IoV. Section 3 first introduces the related technologies of security protocol design and the existing related work and schemes and then introduces the application of blockchain technology in the IoV to solve related problems. Section 4 analyzes the development trend of authentication protocol and the next research direction. The last section is the summary.

2. Challenges

2.1. Problems in Designing Security Protocols

The IoT is mainly composed of a perception layer, network layer, and application layer, as shown in Figure 2 [13]. The perception layer mainly collects and captures the state information of the external environment or items through sensors, which use radio frequency identification(RFID) and communication technologies, and transmits the information to the upper layer. Common attacks in perception layer include side channel attacks, denial of service (DoS) attacks, witch attacks, and so on [14,15]. Based on the existing Internet and mobile communication network, the network layer stores, manages and analyzes data collected by sensors through the cloud computing platform and transmits it to the application layer. Common attacks at the network layer include man-in-the-middle attack, network listening, and routing attack. The application layer provides services to users through the application layer protocols of the IoT. Common attacks include identity forging attacks, injection attacks, and replay attacks. Due to the vulnerability of the IoT network, a secure IoT authentication protocol must meet the requirements of reliability, integrity, privacy, anonymity, forward security, and non-repudiation [16].

However, the existing authentication protocol generally has the following issues: (1) Most authentication protocols are not as secure as they claim. These protocols have some security problems or functional defects to some extent. For example, some protocols lack an effective mechanism to quickly detect unauthorized logins and cannot resist the user’s fake attacks, offline password guessing attacks, and privileged internal attacks, etc. (2) Some protocols adopt encryption technologies with high complexity, such as the bilinear pairing and elliptic curve cryptography(ECC) algorithm, which will make the designed security protocols consume more computing resources [17,18,19].

2.2. Malicious Vehicles, Nodes Spread False Information

The continuous development of networking has provided great convenience for people’s transportation and information interaction. At the same time, the IoV, as an intelligent network including people, vehicles, base stations, and other elements, the security of the IoV is directly related to the information security of users and life security, and has thus received increasing attention. The relationship between nodes is complicated, which greatly threatens the safety of the IoV. Vehicles share road traffic safety information through communication. However, due to the complicated relationship between cars, the authenticity and reliability of the news are in doubt. On the one hand, vehicles acquire information through sensors, and the information acquired by vehicles may deviate from the real environment due to sensor failures and other reasons. On the other hand, there may be some malicious nodes in the network, which deliberately broadcast false messages and interfere with the normal driving of other vehicles [20].

2.3. Privacy Issues in the IoT

The security of IoT poses a serious threat to users’ privacy protection. A large number of IoT devices record a large amount of user privacy data, which magnifies the security risk coefficient and privacy scope of users. The data not only record people’s travel route, location, voice, and other information, but also include users’ health data and daily travel plans, which can easily be used by platforms and even hackers. In 2021, the discovery that the Tesla company used a camera in the car records and transmitted passenger videos or images has caused a great stir, and various similar events also emerged in in an endless fashion. The security and privacy issues of the IoT have caused problems for and hidden worries in people. Anonymous identity authentication uses cryptography knowledge as the first choice to protect the IoT security and user privacy security. Anonymous identity authentication is usually used to generate pseudonyms, which is divided into two schemes: (1) a trusted third party assigns pseudonyms to users during registration [21,22], and (2) the regular exchange of pseudonyms takes place between users [23,24]. Because both of these schemes rely on a trusted third party entity, the rapid growth of node data overloads the central entity, which may be at risk of a single point of failure. In addition, frequent access to third parties leads to high communication overhead, which is not conducive to cross-domain authentication and fails to meet the requirements of the current IoT for low latency and high reliability.

3. IoT Security Protection: Selected Approaches and Algorithms

This chapter first introduces the user and sensor device authentication scenarios and some existing related work and then introduces the common technologies and mathematical methods in the IoT authentication protocol, including Chebyshev chaotic mapping, biometric identification technology, blockchain, and other encryption technologies. Finally, some solutions to the problem of trust management and anonymous identity authentication are put forward.

At present, a large amount of literature shows an IoT authentication protocol to protect IoT information security and help users and IoT devices to authenticate each other. Different protocols use different encryption methods and authentication mechanisms. Thus, Figure 3 shows a well-structured taxonomy of technical methods.

At present, the application scenarios of user and device authentication mainly include users, gateways, wireless sensor networks, and sensors. These scenarios are sometimes accompanied by cloud servers, as shown in Figure 4. In the wireless sensor network, users can access the sensor after being authenticated by the network gateway. The gateway periodically uploads data to the cloud server, and users can access the data after mutual authentication with the cloud server. Previous studies [25,26,27] proposed a two-factor authentication protocol for wireless sensor networks based on ECC to realize mutual authentication among users, sensors and gateways. A two-factor authentication scheme of wireless sensor networks proposed by Vaidya et al. [28] only uses a simple hash function and an exclusive OR(XOR) function for encryption. Hu et al. [29] proposed a three-factor authentication scheme in the industrial IoT environment, and a cloud server can regularly process the data uploaded by the gateway. Other studies [30,31] have proposed the authentication protocol of wireless sensor networks based on smart cards to realize the mutual authentication of users and sensor nodes.

The performance evaluation of authentication schemes is usually considered from three aspects: security, computing overhead, and communication overhead. In terms of security analysis, it mainly evaluates the security of the scheme design, which is generally divided into formal security analysis and informal security analysis. Before security analysis, it is necessary to make assumptions about the attack model of the system. The most common model is the Dolev–Yao model [32]. Informal security analysis is mainly used to analyze the security of the scheme through literal description and inferencing, which is difficult to understand. However, most informal security analyses could only analyze known attacks. Formal security analysis refers to the use of existing security analysis tools to detect possible vulnerabilities in the scheme, including model detection methods, theorem-proving methods, and belief logic methods. The common model detection methods used in papers are Automated Validation of Internet Security-sensitive Protocols and Applications(AVISPA), the tool-theorem-proving methods include ProVerify, and the belief logic methods includ Burrows–Abadi–Needham(BAN) logic. Formal security analysis requires the dedicated study of different rules of distinguished tools. Compared with formal security analysis, the access threshold of informal security analysis is higher. The communication overhead refers to the total amount of data received and sent by each entity in the scheme, usually in bits or bytes. First, the length of the large prime number selected by the system is assumed. Then, the message length after the implementation of the cryptographic algorithm is estimated according to the characteristics of each cryptographic algorithm. The communication overhead of each entity is evaluated mainly by adding the message length of the cryptographic algorithm used. The calculation overhead refers to the total running time of each encryption algorithm implemented by each entity in the scheme, usually in ms [33,34,35].

In the design of an authentication protocol, the choice of cryptography related encryption algorithm is also very important for the performance of the whole protocol. Figure 5 shows the computational execution time required for different encryption primitives based on the available experimental results [29,36]. The subsequent

Table 1. Time for Various Cryptographic Operations.

Notation	Description	Approximate Computation Time (ms)
$T_h$	A one-way hash function	0.00032
$T_{ecm}$	An ECC point multiplication	0.0171
$T_{ecca}$	An ECC point addition	0.0044
$T_{e/d}$	Symmetric encryption/decryption algorithms	0.0056
$T_{me}$	A modular exponentiation operation	0.0192
$T_{mul}$	A modular multiplication operation	0.00088
$T_{cm}$	A Chebyshev chaotic map operation	0.0171
$T_{crt}$	Attain solution using CRT	0.00704
$T_{sig}$	Signature generation using elliptic curve digital signature algorithm	0.02182
$T_{ver}$	Signature verification using elliptic curve digital signature algorithm	0.03892
$T_{mac}$	Message authentication code	0.00032

is the time of various encryption operations.

3.1. Chebyshev Chaotic Mapping

At present, most security protocols rely on the ECC algorithm, which can meet the necessary security requirements, but the cost of computation and communication is relatively large. On the basis of meeting the security requirements, the Chebyshev polynomial is used to encrypt messages, but the cost of computation is only one-third of that of the ECC algorithm [37,38,39]. Thus, the following is a brief introduction to the Chebyshev polynomial algorithm.

Chebyshev’s polynomial $T_n\left(x\right)$ is a polynomial of order n in x, $T_n\left(x\right)=cos\left(n·arccosx\right),x\in \left[-1,1\right]$; when $n>1$, Chebyshev polynomials satisfy the semigroup property. Zhang et al. [40] gave the definition of the extended Chebyshev polynomial on $\left(-\infty ,+\infty \right)$ and proved that the extended Chebyshev polynomial also satisfies the semigroup property [41]. The recursive formula of the extended Chebyshev polynomial is as follows:

$$T_n\left(x\right)=\left\{\begin{array}{cc}0& \mathrm{if}\mathrm{n}=0\\ xmodp& \mathrm{if}\mathrm{n}=1\\ 2x{T}_{n-1}\left(x\right)-T_{n-2}\left(x\right)modp& \mathrm{if}\mathrm{n}\ge 2\end{array}\right.$$

where p is a large prime number. The semigroup properties of extended Chebyshev polynomials are defined as follows:

$$T_u\left(T_v\left(x\right)\right)\equiv T_v\left(T_u\left(x\right)\right)modpu,v>2.$$

Two difficult mathematical problems exist on extended Chebyshev polynomials. According to the chaotic map-based discrete logarithm problem (CMBDLP), given $T_u\left(x\right)$ and x, it is infeasible to calculate u in polynomial time.

3.2. Biometric Identification Technology

With the popularity of mobile intelligent devices and the development of biometric identification technology, fingerprint, iris, and other biometric features have become popular identity authentication methods for mobile intelligent devices. The traditional authentication mode has security risks. For example, a user’s password may be leaked, and the secret parameters of smart cards can be extracted using technologies such as energy analysis. Compared with traditional authentication methods, biometric features do not need to be memorized or carried and are difficult to forge. In order to enhance the security of authentication protocols, many schemes begin to introduce biometric features as new authentication factors. Authentication protocols based on biometric features have become a hot topic in the current research of authentication protocols [42,43,44].

Biometric identification refers to using a human’s inherent biological characteristics (such as fingerprints, facial features, iris, voice, etc.) and behavioral characteristics (such as walking posture, gait, etc.) as identification markers, which are not easy to lose and difficult to copy [45,46]. Biometric identification technology makes the authentication system overcome the difficulty of password management and improve the usability of the authentication system. Biometric hashing is a protection technology for the biometric template. The key idea of biometric hashing is to convert the original biometric to a new random space and store the converted template. The conversion function is irreversible [47].

• The original biological features were extracted and the m-bit feature vector y was obtained;
• We generated a pseudo-random matrix of $m\times n$ using a user-specific token:
  $\left\{R_i\in {\Re }^m|i=1,2,...,n\right\}$, where n is the length of the final value;
• We converted the matrix to an orthonormal matrix $\left\{R_i\in {\Re }^m|i=1,2,...,n\right\}$;
• Finally, we made a random projection of y and $Rv=〈y·R〉=R^{T}y$ through the inner product.

3.3. Blockchain Solves the Trust Management Problem

The trust management mechanism is responsible for the generation, distribution and revocation of trust certificates of vehicle nodes [48,49,50,51]. In order to solve the problem of privacy leakage caused by tracking specific trust values, according to the trust values of vehicle nodes obtained by the trust evaluation mechanism, the corresponding trust levels are divided, and the trust certificates of corresponding states are generated [52,53,54,55]. That is, the calculated trust value of vehicle nodes is fuzzified, and the trust state is used instead of the specific trust value [56,57,58,59]. Different trust levels represent different trust states, and the noise contained in them is also different, so users with low trust level cannot query the information of users with high trust levels. It also ensures the privacy of trust value data in the process of trust inquiries and certificate issuance and revocation, avoids the tracking of malicious nodes and the attack of untrusted nodes, and effectively prevents nodes from denying and tampering with trust values [60,61,62]. It can also realize privacy protection in the trust management process and effectively improve the security level of the vehicle networking management model. At the same time, in the blockchain network composed of RSU and its servers, the trust certificates of vehicle nodes are synchronized, and the vehicle nodes can obtain the relevant certificates and verify the authenticity only by querying the RSU without sending a request to a remote server, which greatly reduces the communication delay [63].

Because of the central design, there are some problems, such as a high time delay, a single point of failure, and poor expansibility, which do not meet the demands of the IoV [64]. Blockchain technology applied to the field of trust management of car networking can establish a safe and reliable distributed database and improve the security of car networking. In this mechanism, a blockchain network is constructed by vehicle nodes, RSU, and its servers, and the trust value of vehicle nodes is regarded as a transaction in the IoV, forming a new block in a manner similar to transactions based on Bitcoin. The hash values of each block are chained together in order. Among them, the vehicle nodes only communicate messages and do not participate in data calculation. RSU verifies the authenticity of the event, and its server calculates the corresponding message trust value and then selects one of the nodes for accounting according to the consensus mechanism. All the trust values in the blockchain are accumulated to form a comprehensive trust value of vehicle nodes, which is transmitted, stored, and maintained in the network. There are two kinds of data in blockchain networks: block data and status data. Among them, the block data refers to the record of every transaction in the blockchain, and the state data refers to the information of the current state of the vehicle node. The model diagram is shown in Figure 6.

After calculating the trust value, RSU stores the trust value into the blockchain through a consensus algorithm. As the core technology of blockchain, a consistency algorithm provides mechanism support and a guarantee for realizing the decentralization, openness, autonomy, unchangeable information, anonymous traceability, and other functions of blockchain and allows the efficient realization of strong consistency and final consistency in distributed systems. With the popularity of Bitcoin and the development of blockchain technology, the mainstream model of the blockchain consensus process has been gradually given. Although this model is not a general model and cannot show all consensus processes, it can reflect the core ideas of mainstream consensus algorithms. In the construction of a blockchain system on a P2P network, all nodes can be represented as “miners”, and nodes can be generally divided into those generating data or normal transaction nodes, labeled “P”, and nodes that perform mining operations on normal nodes (including validation, packaging, updates, etc.), labeled “M”. The nodes P and M can intersect. All miners participate in the consensus competition process. In a particular algorithm, miners elect representative nodes to replace their positions in the consensus process and compete for the accounting rights. The set of these representative nodes is labeled “D”. The node that obtains the accounting right is marked as “A”, and in each consensus process, the accounting node of this round is updated. The following will introduce four existing mainstream consensus algorithms [65].

• Proof-of-Work (PoW)
  A workload certificate can be simply understood as a certificate that confirms that someone have carried out a certain amount of work. The workload proof mechanism is the consensus mechanism adopted by Bitcoin. Miners obtain corresponding block rewards through hard mining.
  In a digital currency system, workload proof mainly guesses a nonce through calculation, so that the hash value of the content after it pieces together the transaction data meets a prescribed upper limit. As the hash value is obtained by the collision of the group lift method in mathematics, many calculations are needed. As long as the miners who can put forward random numbers that meet the requirements are considered to have been paid a certain amount of work, they can obtain the reward of this block.
  A hash operation is the most common workload proof mechanism. This mechanism mainly uses the complexity of hash operations through a given initial value, carries out a simple value increment operation, and uses the hash algorithm to solve it until the collision value that meets the conditions is found. The length of the collision value obtained by different hash algorithms is different, and the required workload and security performance are also different. The longer the collision value is, the more work is required. For the same hash algorithm, the number of the first N bits of the hash value can be set to 0 to adjust the operation’s difficulty. Bitcoin adjusts the mining difficulty according to this principle. The recommended miner election principle is:

  $$H\mathrm{ash}(\delta +previou{s}_{rep})<Difficult$$
  Here, Difficulty represents the hash value of the current block, and the system can adjust Difficulty by controlling the rate at which blocks are generated. The RSU responsible for generating a new block needs to compute the number $\delta$ at the fastest rate while satisfying the above inequality.
  The specific process is shown in Figure 7. The first node to find the appropriate nonce obtains the bookkeeping right. The node generates a new block and broadcasts it to other nodes, and these other nodes verify the block. If it passes the verification, it will accept the block and complete this round of consensus. Otherwise, it will reject the block and continue to search for the appropriate nonce. Thus far, it has been very difficult to find a nonce that meets the requirements, which requires nodes to consume a lot of computing power. With the continuous accumulation of effective blocks, malicious nodes need to consume a great deal of computing power to overturn the previous blocks.
• Proof-of-Stake (PoS)
  With the increasing number of people involved in Bitcoin mining, the disadvantages of PoW have been gradually exposed [66]. For example, due to the increasingly fierce competition for computing power, more energy consumption is needed to obtain tokens, which leads to the gradual concentration of accounting rights in the “mining pool” with a large amount of computing power. Based on this, researchers want to adopt a new mechanism instead of workload authentication. PoS came into being and proposed the concept of “coinage”, which is the accumulation of the product of token holding and holding time. PoS uses coin age competition instead of computing power competition to solve the problems existing in PoW.

  $$Coinag{e}_i=quantit{y}_i\times tim{e}_i$$
  PoS also needs to calculate the hash value, but unlike PoW, it does not need to find the nonce value through continuous violence calculation. The specific process is shown in Figure 8. Each node only needs to calculate a hash once in each round of consensus. The more rights and interests it has, the greater the chance it has of meeting the hash goal and obtaining bookkeeping rights.
• Delegated-Proof-of-Stake (DPoS)
  The entrusted equity proof blockchain has a voting system, and stakeholders deliver their work to a third party. In other words, they can vote for several representatives to protect the network instead of themselves. Delegates are also called witnesses, and they need to reach a consensus in the process of generating and verifying new blocks. The voting right is proportional to the number of coins held by each user. The voting system varies from project to project, but generally, each delegate gives his or her own opinion when voting. Delegates collect awards and distribute them proportionally among their respective constituents.
  The specific process is shown in Figure 9. Token holders obtain votes through pledge tokens and select a number of nodes as block producers by voting to perform the obligation of generating blocks on behalf of token holders. DPoS is similar to the system of the company’s board of directors, which allows users with coins to entrust the work of production blocks to more competent professionals, and at the same time, they can enjoy the rewards of participating in the block. The nodes with the most votes from users become out-of-block nodes, with 21 nodes represented by the enterprise operation system (EoS). In each round of consensus, one outbound node is selected in turn to generate blocks and broadcast to other outbound nodes for verification. If the node fails to complete the block out within the specified time or generates invalid blocks, it will be disqualified and replaced by voting again to select a new block-out node.
• Practical Byzantine Fault Tolerance (PBFT)
  The Byzantine problem is a classic problem in distributed computing. The problem is described as follows. Suppose several Byzantine generals lead troops to surround a city. They must unanimously decide whether to launch a siege. If some generals decide to launch a siege without the participation of other generals, then their actions will end in failure. Generals are separated from each other by a certain distance, and they must rely on information transmission to communicate. Some cryptocurrency protocols use specific versions of BFT when reaching consensus, and each version has its own advantages and disadvantages.
  PBFT: The first proposed solution to this problem is called “practical Byzantine fault tolerance”, which has been adopted by Hyperledger Fabric. PBFT uses fewer pre-selected generals, so it runs very efficiently. Its advantage is high transaction flux and throughput, but its disadvantage is that it is centralized and used for licensing networks.
  Federated Byzantine agreement (FBA): The solution to another Byzantine general problem is FBA, which has been used by tokens such as Stellar and Ripple. The general idea of FBA is that every Byzantine general is responsible for his own chain, and once the news arrives, the chain establishes the facts through sorting. In Ripple, generals (verifiers) are pre-selected by Ripple Foundation. In Stellar, anyone can be a verifier, and users need to choose which verifier to trust. FBA can provide incredible throughput, low transaction overhead, and network scalability.
  PBFT is based on the Byzantine general problem, and the guarantee of consistency can be divided into three stages: pre-prepare, prepare, and commit, as shown in Figure 10.

C is the client, 0, 1, 2 is the server, and 3 is the closed server. The specific steps of consensus algorithm are as follows:

• First, client C sends the request as the leader node.
• After receiving the request, the master node 0 assigns a sequence number to the request and broadcasts the sequence number to assign the message and the client request to all other slave nodes.
• After receiving the message from the master node, the slave node broadcasts the preparation message to other nodes.
• After each node verifies the received preparation message, they must broadcast the confirmation message, execute the request of the leader node, and then respond to the leader node.
• As long as the leader node receives an f+1 identical response, where f is the number of malicious nodes, it will consider that its request has been realized, and the PBFT consensus process is over.

3.4. Blockchain Solves the Problem of Anonymous Identity Authentication

As shown in Figure 11, blockchain technology is applied to cross-domain anonymous authentication. The system divides the large area into several small areas, namely domain A, domain B, and domain C. Each area is managed by a base station, which is responsible for building a consistent blockchain network and storing part of the user’s authentication information. When users arrive at a new area, they need to change their pseudonyms for authentication with the base station [67,68], which uses the information stored in the blockchain and the information provided by the user to authenticate their identity. Chao et al. [69] proposed a blockchain-based security mutual authentication system, namely BSeIn. The system has integrated attribute signatures, multi-receiver encryption, and message authentication code, aiming to provide privacy and security guarantees. However, in attribute-based signature verification, some attributes can be obtained, which may affect the unlinkability. Liu et al. [70] recommended an anonymous identity authentication protocol based on blockchain using homomorphic encryption, but the unlinkability of this scheme cannot resist collusion. Only the service manager can decrypt the pseudonym due to the fact that the vehicle selects an unknown random number when generating the pseudonym. However, the scheme cannot achieve traceability and non-repudiation. Li et al. [71] presented a protocol for anonymous identity authentication between vehicles, realizing traceability and non-repudiation on the basis of [70]. Yao et al. [72] first proposed a non-interactive anonymous cross-data-center authentication mechanism in their vehicular ad-hoc network(VANET), realizing conditional privacy protection while the communication delay was significantly reduced.

Feng et al. [73] adopted a novel blockchain-assisted privacy-preserving authentication system in VANET by combining blockchain features and access control encryption primitives. Blockchain is considered a mature database; thus, the registration center need not always be online. In [74], a permissioned consortium blockchain system with a smart contract was implemented in a vehicular network. The system ensures secure and conditional privacy-preserving vehicular pseudonym issuance. Smart contracts, an automatic computer protocol [75], are used in several stages, such as pseudonym revocation checks, pseudonym issuances, pseudonym revocations, and expired pseudonym deletions. Tomar et al. [76] introduced a blockchain-based certificateless authentication scheme. By adopting the PBFT consensus algorithm, the ledger keeps the partial private and public keys of vehicles in order to achieve cross-domain certification. They also designed a batch verification algorithm, which can significantly reduce the time and computation cost of multiple message signature verifications. Xue et al. [77] bestowed a scheme about roaming authentication by leveraging smart contracts. To further guarantee the unforgettable and undeniable nature of billing, they employed hash chain technology to prevent users from evading payment. Singh et al. [78] proposed a blockchain-based secure storage architecture for an intelligent IoV, namely BIIoVT. By applying blockchian and decentralized storage in the cloud, the security and privacy of vehicular networks can be guaranteed. Son et al. [79] provided a blockchain-based handover authentication protocol for VANETs. By adopting lightweight hash and XOR functions in the handover authentication phase, the protocol significantly improved efficiency and security. Pariyarath et al. [80] designed a blockchain-based privacy-preserving authentication protocol for secure communication in VANETs, which meets the requirements of higher scalability and lower fees. Subramani et al. [81] adopted fog computing architecture to design a blockchain-based anonymous authentication scheme, considering fog nodes as miners to authenticate vehicles’ identities. In the meanwhile, they also used a Merkle hash tree to ensure the real-time update of authentication data.

Compared with traditional cross-domain authentication schemes, blockchain-assisted cross-domain authentication can improve certification efficiency and resist distributed denial of service attacks. When one node fails, it may affect the entire network, resulting in the paralysis of the entire network. By applying blockchain techniques, the system can reach higher levels of stability and scalability. Typically, blockchain-assisted cross-domain authentication stores auxiliary authentication in the block by using consensus algorithms. There are a number of consensus algorithms, such as PoW, PoS, DPoS, Casper, PBFT, proof of elapsed time (PoET), and Raft [82]. Blockchain-assisted cross-domain authentication schemes utilize PBFT at most.

A comparison of consensus algorithms is shown in

Table 2. Comparison of Consensus Algorithm.

Algorithm	PoS	DPoS	Casper	PBFT	PoET	Raft
Capability	Middle	High	Middle	High	Middle	High
Decentralization	Completely	Completely	Completely	Semi	Semi	Semi
Maximum evil nodes allowed	51%	51%	51%	33%	51%	51%
Tokens	Yes	Yes	Yes	No	No	No
Scenario	Public blockchain	Public blockchain	Public blockchain	Consortium blockchain	Consortium blockchain	Private blockchain
Technical maturity	Mature	Mature	No application	Mature	No application	Mature
Special Hardware	No	No	No	No	Yes	No

. “Capability” is a symbol of the ability of consensus algorithms to reach consensus. The “decentralization” is the degree of the decentralization of consensus algorithms. The “maximum evil nodes allowed” means the maximum rate of evil nodes that the consensus algorithms can tolerate, which is equal to dividing the maximum number of evil nodes by the total number of nodes in the blockchain. Here, “tokens” means that consensus algorithms have to use dedicated currency, such as Bitcoin. The “scenario” shows the consensus algorithms applied to different blockchains, including public blockchains, private blockchains and consortium blockchains. The “technical maturity” demonstrates the maturity of the consensus algorithm application. “Special hardware” suggests whether the consensus algorithm requires special hardware to run, which may affect the widespread use of the consensus algorithm.

In the practical application of IoT, the capability of the blockchain system is particularly important to the researchers, which is usually measured by transactions per second (TPS). In order to improve the capability of the blockchain system, consensus algorithms with high capability are usually adopted. PBFT consensus mechanisms meet this requirement. Decentralization is an important indicator of blockchain technology, representing the openness of blockchain and the difficulty of not being manipulated by people. The PoS, DPoS, and Casper consensus algorithms are completely decentralized, while the PBFT, PoET and Raft consensus algorithms are semi-decentralized. According to the different open levels of blockchain, blockchain can be roughly divided into three types: public blockchain, consortium blockchain, and private blockchain [83]. Public blockchains are fully open, and anyone can participate in it with no need to obtain permission from a central authority [84]. Consortium blockchains are semi-open and have certain access requirements. They are mainly introduced between specific organizations, and only member nodes can be involved in them. Private blockchains are closed, and only individuals or companies can join in. The consensus algorithms PoS, DPoS, and Casper are mainly aimed at public blockchains, while the consensus algorithms PBFT, PoET, and Raft are applied in consortium blockchains. In the distributed algorithm, the misbehavior of nodes always exist. Consensus is achieved when all distributed nodes update their ledgers and a consistent statement is made in a copy of the ledger [85]. The consensus algorithm needs to tolerate these errors and ensure the data consistency of blocks. The maximum number of malicious nodes that the PoS, DPoS, Casper, PoET, and Raft consensus algorithms can tolerate is 51% of the total number of nodes, yet the PBFT is 33% [86]. The token refers to the currency used for circulation in the blockchain ecosystem. PoS, DPoS and Casper rely on tokens, while others do not. At present, the PoS, DPoS, PBFT, and Raft consensus algorithms have become increasingly mature and widely used. However, the rest of the consensus algorithms are still in the process of development. In particular, the PoET consensus algorithm must use specific hardware despite its low cost. Therefore, it is extremely difficult to adopt it on a large scale.

In blockchain-assisted cross-domain authentication, the block generation time of PoS is usually around 10 min, which does not meet the low-delay requirement of the IoV. As a semi-decentralized consensus algorithm, PBFT has the ability to control node access in order to guarantee a more stable network. Moreover, PBFT does not need to deploy special hardware or use tokens in the authentication phase, which means it is easier to implement.

4. Research Prospects

Currently, there are some limiting factors in the fields of IoT authentication technology, trust management in VANETs, and privacy protection in VANETs. For example, in IoT authentication technology, there are various limitations in existing IoT authentication mechanisms, such as inefficiency, low security, and vulnerability to attacks. In the aspect of trust management in VANETs, there are various limitations in existing VANETs’ trust management mechanisms, such as low scalability, low robustness, and vulnerability to Sybil attacks and node compromise attacks. Additionally, the dynamic nature of VANETs makes it challenging to establish and maintain trust relationships [87,88,89]. In the aspect of privacy protection in VANETs, there are various limitations in existing VANETs’ privacy protection mechanisms, such as high computational complexity, low accuracy, and limited scalability. Moreover, many of these mechanisms are susceptible to attacks, such as side-channel attacks and data inference attacks. To address these limitations, we have read some interesting recent works and combined these directions with information security. We also focus on studying the combination of artificial intelligence technology and information security to seek new solutions [90,91,92,93].

Both Gupta and Mawla [94,95] proposed activity-based access control models aimed at providing more flexible and secure authorization and access control for collaborative information systems and IoT applications. We consider using an activity-centric access control model to authenticate IoT devices, ensuring that only authorized devices can access the system and data, or to provide fine-grained access control for IoT devices, allowing only specific devices to access specific resources or perform specific operations. At the same time, adversarial attacks, as a new type of threat [96,97], target malicious code detection methods, allowing malicious code to deceive detectors. Therefore, researching how to improve the robustness of malicious code detectors and defend against adversarial attacks is an important research direction in the field of information security. We note that IoT devices are vulnerable to various network attacks due to limited resources. Therefore, we consider using digital twin technology to simulate the behavior and communication of IoT devices and predict possible security risks [98,99]. Simulating and evaluating IoT devices can help design more secure IoT systems.

With the development of artificial intelligence(AI), we are also considering combining AI technology with information security. For IoT authentication technology, AI can be used to improve the security and efficiency of IoT authentication protocols. For example, deep learning technology can be used to identify the behavior patterns of IoT devices and automatically trigger alarms or take other security measures when abnormal situations are detected. In addition, AI-based algorithms can be used to evaluate the credibility and trustworthiness of IoT devices, making the authentication protocol more intelligent and adaptive. In terms of trust management in a connected car network, AI-based anomaly detection technology can monitor the behavior of vehicles in the network and detect potential attacks. When any unusual behavior is detected, appropriate measures such as disconnection or triggering an alarm can be taken. In terms of privacy protection in the connected car network, vehicle identification information and personal information can be shielded or replaced using data obfuscation techniques to protect the identity information of car owners and drivers. Additionally, differential privacy models can be used to protect data privacy, where adding noise makes it impossible to infer personal privacy information from the processed data, even if it is obtained by attackers.

In summary, the development and application of IoT identity authentication technology, VANET trust management, and privacy protection face various limitations and challenges. The integration of artificial intelligence technologies and information security can provide new solutions to enhance the security, efficiency, and trustworthiness of these mechanisms. However, the progress of AI technology also brings about new changes and challenges to the information security field. Therefore, there is still a long way to go in information security research and innovation, and it is crucial to continue to pay attention to new developments and explore novel solutions and approaches.

5. Conclusions

With the expansion of the application scope of IoT devices, authentication protocols have become one of the important research directions of IoT security. First of all, this paper summarizes the typical authentication system model, common technologies, challenges, and related technical requirements when designing a security authentication protocol. Secondly, this paper also proposes the security problems and total solutions of the IoT from the perspective of privacy protection. With the help of blockchain technology, this paper provides a security management model for the IoV, a dynamic trust assessment mechanism, and a trust management mechanism that meets the privacy protection requirements for vehicle nodes. The proposed solution in this paper can also quickly and effectively implement the nodes’ dynamic trust evaluation, screen out untrusted nodes, and solve the problem of behavior-trusted nodes’ untrusted messages. Finally, the proposed solution solves the privacy security problems in the process of trust evaluation and certificate management of vehicle nodes, and thereby, it improves the security level of the IoV management model.

Existing mechanisms for IoT identity authentication, VANET trust management, and privacy protection have various limitations and deficiencies, such as low efficiency, poor security, susceptibility to attacks, and forgery. In future research, we will consider combining artificial intelligence technology with the field of information security to seek new solutions. Specifically, deep learning techniques can be used to improve the security and efficiency of IoT identity authentication protocols, AI-based algorithms can be utilized to evaluate the trustworthiness and trust level of VANET trust relationships, and data obfuscation techniques and differential privacy models can be employed to protect the privacy of the VANET. However, the development of artificial intelligence technology will also bring about more challenges to the field of information security. Therefore, we need to continuously monitor the new trends in the field of information security to explore new solutions.