A method for scalable authentication and data management in a smart city network, comprises:
- registering an Internet of Things (IoT) node with a fog server by transmitting a registration request, wherein the registration request is received from the IoT node located in close proximity to the fog server;
- generating a unique smart system identifier for smart system by applying a hash function to a combination of a system name and a unique server identifier of the fog server;
- generating a unique node identifier for the IoT node and an elliptic curve key pair, including a private key and a public key for the IoT node;
- generating a digital signature for a digital certificate by applying the hash function to a combination of the unique server identifier and a unique sequential number of the IoT node;
- endowing the digital certificate to the IoT node, the digital certificate comprising at least the unique node identifier, the unique server identifier, the public key, and the digital signature;
- assessing, by the fog server, a trust value of the IoT node, wherein said assessing comprises:
- calculating a behavioral trust value for the IoT node based on at least one behavioral metric selected from the group consisting of interaction frequency, connectivity consistency, and proximity measures (PM), and
- calculating a data trust value for the IoT node based on at least one data metric selected from the group consisting of a direct trust, an indirect trust, and data timeliness;
- encrypting, by the IoT node, a data packet with a symmetric key and encrypting the symmetric key with the public key of the fog server;
- transmitting the data packet which is encrypted to the fog server;
- decrypting, by the fog server, the symmetric key using the private key of the fog server and validating the data packet by the fog server based on an assessed trust value;
- constructing a blockchain block comprising validated transaction data from the data packet and validating the blockchain block by a plurality of fog servers using a Proof-of-Work consensus mechanism;
- adding the blockchain block comprising a validated transaction data to a decentralized ledger;
- encrypting a second symmetric key using the public key of a second IoT node from a different smart system and transmitting a second encrypted data packet to a first fog server thereby validating the second encrypted data packet and constructing a new blockchain block, and allowing the second IoT node to decrypt the symmetric key using its private key after the new blockchain block has been validated by the Proof-of-Work consensus mechanism;
- generating the digital signature for a digital certificate's by applying the hash function to a concatenation of a unique identifier of the fog server and the unique sequential number of the IoT node;
- and
- verifying an integrity of the data packet and the digital certificate by comparing a generated hash of data received the digital signature, wherein encrypting the data packet includes generating within the IoT node a symmetric encryption key derived from a seed value formed by concatenating the hash function of the most recently validated blockchain block, the unique node identifier, and a session nonce, applying a lightweight symmetric encryption process to a data payload, constructing a header that includes the symmetric key encrypted with the public key of the fog server, attaching the unique node identifier, the session nonce, and the digital signature generated from private key to the header, and transmitting a composite packet through a secure transport link to the fog server;
- and wherein upon receipt of the second encrypted data packet, the fog server decrypts the encrypted symmetric key using its private key, verifies a validity of the session nonce against a stored session-identifier table to detect replayed packets, recalculates a hash over a decrypted payload combined with the symmetric key, compares a recalculated hash with a reference hash included in the header to confirm payload integrity, and, after confirmation, associates a validated data packet with a trust record corresponding to the IoT node within a fog server's memory.