IoTBlockSec — Blockchain-Based Secure Communication Framework for Zero-Trust IoT

The Problem

30 billion devices.
An unprotected attack surface.

By 2030, over 30 billion IoT devices will stream telemetry that drives industrial, medical and logistical decisions — yet most IoT protocols transmit sensor data in plaintext, with weak or no device authentication and no way to detect modification mid-transit.

🎭

THREAT

Identity Spoofing

Attackers extract legitimate device IDs from observed traffic and impersonate trusted nodes with forged credentials.

✂️

THREAT

Data Tampering

Intercepted telemetry is altered in transit — a 99× value spike can falsify environmental state and trigger wrong decisions.

🔁

THREAT

Replay Attacks

Stale but perfectly valid packets are retransmitted to deceive backends into acting on outdated readings.

🕵️

THREAT

MitM Interception

On-path adversaries eavesdrop and mutate ciphertext bit-by-bit — invisible without envelope integrity signatures.

Objectives

Four goals. One verifiable pipeline.

Design

A lightweight blockchain-based framework securing IoT communication end-to-end — no heavy external blockchain infrastructure.

Implement

A SHA-256 Proof-of-Work blockchain ledger providing tamper-evident, hash-chained data storage with continuous validation.

Integrate

HMAC-SHA256 device authentication and per-device payload encryption for confidentiality and identity verification.

Validate

The framework against live simulated cyberattacks — spoofing, tampering, replay, unauthorized access and MitM.

System Architecture

A five-layer, zero-trust pipeline

Every reading flows from simulated perception hardware through cryptographic fortification, PoW consensus and smart-contract access control, up to a live SOC monitoring plane.

LAYER APerception

Five virtual sensors — sinusoidal baselines + Gaussian noise V(t)=V₀+A·sin(0.1t)+𝒩(0,σ) 🌡 temp💧 humidity📊 pressure🏃 motion🌫 CO₂

↓

LAYER BSecure Channel

Triple cryptographic fortification per packet 256-bit key XOR cipher HMAC-SHA256 envelopeUUID nonce · 30s window

↓

LAYER CBlockchain Core

SHA-256 PoW consensus, difficulty D=3 H = SHA-256(I‖T‖Txns‖H₋₁‖n) H[0:3] = 000continuous validation

↓

LAYER DDevice Registry

Virtual smart contract — whitelist access control Token = HMAC(Secret, DeviceID) constant-time comparerevocation support

↓

LAYER EGateway + SOC

FastAPI REST gateway & live dark-theme SOC dashboard 20+ endpoints 5s live pollingChart.js telemetrybreach alerting

IoTBlockSec system architecture and operational algorithm flowchart

Fig. 1 — IoTBlockSec layered architecture and operational algorithm: perception → gateway → consensus → SOC, with breach-abort paths.

Interactive Demo

Watch the cryptographic pipeline
run in your browser

This is the exact worked example from the paper — a temperature reading is encoded, hashed with real SHA-256 (WebCrypto), "mined", then verified. Flip the tamper switch to see why a one-degree forgery is computationally infeasible to hide.

🔬 Worked Example — Temperature Sensor

Reading (°C) Attacker tampers in transit

1Form payload

—

2Base64 cipher

—

3SHA-256 proof

—

4Broadcast + mine

—

5Verify: recompute

—

✔ VERIFIED — recomputed hash matches on-chain proof. Telemetry accepted.

Cyberattack Simulation Lab

Five attack classes. Zero got through.

An isolated AttackSimulator launches real attack logic against the running pipeline. Every vector is detected, logged and blocked — live, in the SOC dashboard.

🎭

Device Spoofing

Forged token for a real device ID hits the registry — constant-time HMAC comparison rejects it before it touches the queue.

HMAC-SHA256 token mismatch

100%

✂️

Data Tampering

A 99× value spike is injected into a legitimate transaction — the recomputed SHA-256 integrity hash no longer matches.

SHA-256 payload hash mismatch

100%

🔁

Protocol Replay

An exact copy of an authorized packet is retransmitted — its UUID nonce is already indexed in the 30-second sliding window.

Sliding-window nonce rejection

100%

🚫

Unauthorized Access

A rogue node attempts a direct ledger write — the whitelist lookup fails before any cryptographic work executes.

Device registry whitelist check

100%

🕵️

Man-in-the-Middle

4 bytes of ciphertext are bit-flipped on-path — the envelope's HMAC signature invalidates instantly; packet dropped pre-decryption.

Envelope signature integrity drop

100%

Launch them yourself →

The SOC dashboard's Attack Lab lets you fire each vector — or the full five-attack barrage — against the live system and watch detection happen in milliseconds.

⚔ Open Attack Lab

Experimental Results

Measured. Mined. Verified.

Evaluated over extended operational polling runs — every block satisfies the PoW difficulty target, every payload round-trips the encrypt/decrypt path, and every attack is caught.

Mitigation success rate

Payloads encrypted + decrypted

Blocks mined @ difficulty 3

Tamper / replay under normal ops

Table I — Blockchain ledger metrics

Block	Nonce	Txns	Hash prefix
Genesis	0	0	0004ef48…
#1	7710	5	000fbdaf…
#2	1359	1	000ce1be…
#3	232	1	000b4267…
#4	1412	1	000efa5a…
#5	4223	1	000964d1…

Table II — Live device telemetry profiles

Device	Modality	Location	Value
TEMP-879AE4	Temperature	Factory Floor A	22.82 °C
HUMI-0E2541	Humidity	Server Room B	58.21 %
PRES-E23C37	Pressure	Warehouse C	1014.03 hPa
MOTI-5E6FF2	Motion	Office Wing D	0 (none)
CO2-2C7F9B	CO₂	Lab Section E	433.77 ppm

Table III — Cyberattack mitigation matrix

Attack modality	Detection mechanism	Rate
Device Spoofing	HMAC-SHA256 token mismatch	100%
Data Tampering	SHA-256 payload hash mismatch	100%
Protocol Replay	Sliding-window nonce rejection	100%
Unauthorized Access	Device registry whitelist check	100%
Man-in-the-Middle	Envelope signature integrity drop	100%

Implementation Gallery

From Solidity contract to live SOC

The smart-contract layer was formally validated with IoTSecure.sol on Remix IDE + Ganache (gas-profiled per transaction), while the production pipeline runs the zero-dependency Python backend.

SOC OverviewLive KPIs, hash-linked chain strip, telemetry stream and chain-integrity status.

Cryptographic Audit PipelineRaw reading → on-chain cipher → decrypted proof → transaction hash, per row.

Ganache Local EVMAutomined blocks at RPC 127.0.0.1:7545 — gas 52,789 to 684,727 per transaction.

Remix IDE — IoTSecure.solregisterDevice() · uploadData() · getLogCount(), deployed via Ganache provider.

References

Standing on cryptographic shoulders

IoT Analytics, "State of IoT — Spring 2023," IoT Analytics GmbH, Hamburg, 2023.
M. Frustaci, P. Pace, G. Aloi, G. Fortino, "Evaluating Critical Security Issues of the IoT World: Present and Future Challenges," IEEE Internet of Things Journal, vol. 5, no. 4, pp. 2483–2495, Aug. 2018.
S. Nakamoto, "Bitcoin: A Peer-to-Peer Electronic Cash System," 2008.
A. Dorri, S. S. Kanhere, R. Jurdak, P. Gauravaram, "Blockchain for IoT Security and Privacy: The Case Study of a Smart Home," Proc. IEEE PerCom Workshops, Kona, HI, USA, 2017, pp. 618–623.
A. Reyna, C. Martín, J. Chen, E. Soler, M. Díaz, "On Blockchain and Its Integration with IoT: Challenges and Opportunities," Future Generation Computer Systems, vol. 88, pp. 173–190, Nov. 2018.
M. A. Khan, K. Salah, "IoT Security: Review, Blockchain Solutions, and Open Challenges," Future Generation Computer Systems, vol. 82, pp. 395–411, May 2018.
F. Restuccia, S. D'Oro, T. Melodia, "Securing the Internet of Things in the Age of Machine Learning and Software-Defined Networking," IEEE Internet of Things Journal, vol. 5, no. 6, pp. 4829–4842, Dec. 2018.
National Institute of Standards and Technology, "FIPS PUB 180-4: Secure Hash Standard (SHS)," U.S. Dept. of Commerce, Gaithersburg, MD, Aug. 2015.

Secure every packet.
Trust no device.

30 billion devices.
An unprotected attack surface.

Identity Spoofing

Data Tampering

Replay Attacks

MitM Interception

Four goals. One verifiable pipeline.

Design

Implement

Integrate

Validate

A five-layer, zero-trust pipeline

Watch the cryptographic pipeline
run in your browser

🔬 Worked Example — Temperature Sensor

Five attack classes. Zero got through.

Device Spoofing

Data Tampering

Protocol Replay

Unauthorized Access

Man-in-the-Middle

Launch them yourself →

Measured. Mined. Verified.

Table I — Blockchain ledger metrics

Table II — Live device telemetry profiles

Table III — Cyberattack mitigation matrix

From Solidity contract to live SOC

See the whole system running live

Built at RV College of Engineering

Prathik P Kekare

Dr. K B Ramesh

Standing on cryptographic shoulders

30 billion devices.An unprotected attack surface.

Identity Spoofing

Data Tampering

Replay Attacks

MitM Interception

Four goals. One verifiable pipeline.

Design

Implement

Integrate

Validate

A five-layer, zero-trust pipeline

Watch the cryptographic pipeline run in your browser

🔬 Worked Example — Temperature Sensor

Five attack classes. Zero got through.

Device Spoofing

Data Tampering

Protocol Replay

Unauthorized Access

Man-in-the-Middle

Launch them yourself →

Measured. Mined. Verified.

Table I — Blockchain ledger metrics

Table II — Live device telemetry profiles

Table III — Cyberattack mitigation matrix

From Solidity contract to live SOC

See the whole system running live

Built at RV College of Engineering

Prathik P Kekare

Dr. K B Ramesh

Standing on cryptographic shoulders

30 billion devices.
An unprotected attack surface.

Watch the cryptographic pipeline
run in your browser