Secure architecture for distributed governance and
automated compliance applicable to mobile IoT

Venceslas M. Olowo, Sèmèvo A. R. M. Ahouandjinou, Adoté F. X. Ametepe,

Probus M. A. F. Kiki

► To cite this version:

Venceslas M. Olowo, Sèmèvo A. R. M. Ahouandjinou, Adoté F. X. Ametepe, Probus M. A. F. Kiki. Secure architecture for distributed governance and automated compliance applicable to mobile IoT. 2025. hal-05318693

HAL Id: hal-05318693

https://inria.hal.science/hal-05318693v1

Preprint submitted on 17 Oct 2025

**HAL** is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
PREPRINT

Secure architecture for distributed governance and automated compliance
applicable to mobile IoT

Venceslas M. OLOWO*¹, Sèmèvo A. R. M. AHOUANDJINOU¹,²,³,
Adoté F. X. AMETEPE²,³, Probus M. A. F. Kiki¹

¹Doctoral School of Engineering Sciences (ED-SDI/UAC), Benin

²Institute of Training and Research in Computer Science (IFRI/UAC), Benin

³Institute of Mathematics and Physical Sciences (IMSP/UAC), Benin

*E-mail: v.olowo@hotmail.fr

Abstract

The Internet of Things (IoT) has become a key driver of digital transformation, interconnecting a wide range of devices such as smart wearables and mobile objects in dynamic and heterogeneous environments. These systems face the dual challenge of designing distributed and adaptive architectures while ensuring strong protection of sensitive personal data in contexts marked by constrained resources and heightened privacy risks. To address these requirements, we propose a secure modular architecture that combines lightweight cryptography, a permissioned distributed ledger, and automated audit orchestration. Cryptographic commitments are generated using the SHAKE128 sponge function, while authentication relies on SPHINCS+ SHAKE256 post-quantum signatures. Rights governance is supported by Hyperledger Fabric with smart contracts enabling data update, portability, and revocation. The integration of Zero-Knowledge Proofs (ZKPs), adapted to IoT constraints, plays a central role by verifying compliance and integrity without exposing raw data. This approach ensures confidentiality and regulatory alignment with GDPR, CCPA, and Beninese Law No. 2017-20 of April 20, 2018, as amended by Law No. 2020-35 of January 6, 2021. Experimental evaluations on biometric, video, and GPS datasets demonstrate nearly 50% reduction in processing time, an error rate below 1%, improved traceability, and a reduced attack surface. These results confirm the ability of the proposed model to reconcile efficiency, resilience, and compliance in mobile IoT ecosystems.

**Keywords:** Internet of Things; ZKP; blockchain; smart contracts; lightweight cryptography.

I INTRODUCTION

This paper addresses the challenges of the Mobile Internet of Things, which requires solutions capable of simultaneously ensuring security, distributed governance, and regulatory compliance in highly constrained and heterogeneous environments. Existing approaches combine lightweight cryptography, privacy-preserving techniques, and consent management, but they remain insufficient to guarantee resilience and verifiable compliance at scale. We propose a modular and distributed architecture that integrates a permissioned ledger. SHAKE128 generates commitments, and SPHINCS+ SHAKE256 provides authentication. Communications are
secured, and rights management is automated. Update, portability, and revocation are executed through smart contracts. Hyperledger Fabric operates under a Proof-of-Authority consensus. The integration of ZKPs represents the major contribution, enabling compliance and integrity verification without disclosing sensitive information. Biometrics, video, and geolocation are supported. Experimental results show reduced latency, increased energy efficiency, enhanced attack detection, and complete traceability. This framework provides a robust response to the current and emerging challenges of mobile IoT. The remainder of this paper is structured as follows: Section II reviews the state of the art, Section III describes the proposed architecture, Section IV reports the experimental results, Section V discusses their implications, and Section VI concludes with future research directions.

## II STATE OF THE ART

The Mobile Internet of Things extends the collection and processing of personal data on resource-constrained devices, thereby increasing exposure to network attacks, software and hardware vulnerabilities, and governance weaknesses. Foundational studies have structured IoT into perception, network, middleware, and application layers, showing that each introduces specific attack vectors, particularly in mobile and heterogeneous deployments. Sicari et al. [1] formalized this multilayer model and, along with colleagues, highlighted the link between limited resources, protocol heterogeneity, and privacy risks. Ziegeldorf et al. [2] demonstrated that device mobility fragments network topology and requires adaptive architectures sensitive to location and quality of service [3]. Özköse et al. [4] emphasized the impact of coexisting radio technologies such as NB-IoT, LTE-M, Sigfox, and BLE on the uniformity of security policies. Collectively, these contributions highlight the need to move protection functions closer to the edge and establish governance mechanisms capable of producing verifiable guarantees. To support this evolution, an operational classification distinguishes direct identifiers, sensitive data, and behavioral metadata, thereby guiding minimization, masking, and retention strategies. Tran et al. [5] proposed a taxonomy aligning encryption and access control mechanisms with data sensitivity and stressed the importance of dynamic consent management to ensure lawful processing. Finally, Voigt et al. [6] clarified the application of GDPR by detailing the interplay between minimization, right to erasure, portability, and accountability, all of which require verifiable proofs and reliable audit logs.

Figure 1 illustrates the hierarchical IoT architecture in three layers (Edge, Fog, Cloud), highlighting the relationship between the growing number of connected devices and the distribution of computing and storage resources up to the centralized Cloud.
<figure><img src="image_2.png" /><figcaption>Figure 1: Edge-Fog-Cloud architecture for large-scale IoT [7].</figcaption></figure>

This architecture illustrates the functional stratification of IoT. The Edge layer concentrates billions of devices generating data flows under resource constraints, requiring local processing and security. The Fog layer ensures aggregation, filtering, low latency, and large-scale management, offloading the Cloud. The latter centralizes intensive computation, storage, and compliance governance. Cryptography combines AES-128 (Edge) and ECC (Fog/Cloud), ensuring confidentiality and energy efficiency. Data lifecycle management reduces risks, but limited adoption of standardized formats hampers portability and interoperability [2, 8, 9].

Authentication and authorization for constrained devices are evolving toward optimized schemes. Granjal et al. propose a multifactor authentication approach combining lightweight X.509 certificates, JWT tokens with ECC-224 keys, and periodically revalidated biometrics, achieving over 98% spoofing detection with latency below 150 ms. Siris et al. adapt the Zero Trust paradigm to mobile IoT, reducing unauthorized access by nearly 30% [10]. Tran et al. design an embedded middleware that dynamically adjusts rights according to consent, enabling revocation and re-issuance without service disruption [5]. Lightweight Zero-Knowledge Proofs (ZKPs), investigated by Boo and Martin-Fernández, provide low-cost compliance attestations [11, 12]. These mechanisms are integrated into a broader proof framework, including immutable logs and verifiable timestamps, requiring increased resistance to differential and linear attacks. Chen et al. optimize key compression to reduce memory footprint [13]. Compliance relies on GDPR [5], ISO/IEC 27001/27701 standards [14], and Beninese Law No. 2017-20 of April 20, 2018, as amended by Law No. 2020-35 of January 6, 2021 [15], with Adeoye recommending fine-grained traceability and alerts in case of violations [16].

Artificial Intelligence (AI) has become a cornerstone for strengthening personal data protection in Mobile IoT. It addresses growing threats arising from device mobility, heterogeneity, and energy constraints. Early approaches relied on supervised learning for intrusion and anomaly detection. Neshenko et al. (IEEE CST, 2019) demonstrated that convolutional neural networks outperform classical statistical methods in detection accuracy. Federated learning subsequently emerged. Yang et al. (Proc. IEEE, 2019) showed that this paradigm reduces data leakage while improving anomaly detection [17]. Mehta et al. (Journal of Privacy and Confidentiality, 2023) applied AI to dynamic consent management through natural language processing. AI offers three strengths: proactive detection of emerging threats, intelligent anonymization
of data flows, and scalability across Edge-Fog-Cloud architectures. However, it faces limita-
tions. Training requires substantial resources, models remain vulnerable to adversarial attacks,
and opacity limits transparency and accountability, challenging GDPR compliance (Voigt &
Von dem Bussche, 2017) [6]. Recent studies highlight hybridization as a promising solution:
combining AI, advanced cryptography, blockchain, and ZKPs to reconcile performance, com-
pliance, and transparency (Aldahmani et al., IEEE OJVT, 2023; Tran et al., 2024; Zhang et al.,
IEEE TDSC, 2024) [5, 18].

III PROPOSED ARCHITECTURE

## 3.1 Architectural Approach

The rise of Mobile IoT raises significant challenges in terms of security, governance, and regulatory compliance, compounded by hardware limitations, protocol heterogeneity, and device mobility. Centralized models struggle to ensure resilience, traceability, and automated compliance. The proposed architecture integrates permissioned distributed ledgers, smart contracts for rights management [22], and lightweight cryptographic mechanisms tailored to microcontrollers. This modular design provides decentralized governance, robust authentication, and dynamic compliance while optimizing latency and energy consumption in distributed Mobile IoT environments [23].

Decentralized authentication mechanisms, based on stateless challenge-response protocols, eliminate reliance on a central trusted authority. This modular architecture strengthens distributed governance and enables automated compliance with GDPR and CCPA. It relies on Hyperledger Fabric with Proof-of-Authority consensus, providing traceability and automated enforcement of rights.

Figure 2 illustrates the stateless authentication protocol deployed within the secure Mobile IoT
architecture. It combines cryptographic commitment via sponge functions, multimodal ZKPs,
and dynamic rights management aligned with GDPR, CCPA, and Beninese Law No. 2017-20
of April 20, 2018, as amended by Law No. 2020-35 of January 6, 2021. The scheme details
interactions between sensors, the distributed ledger, the orchestrator, the data subject, and the
regulatory authority.
<figure><img src="image_3.png" /><figcaption>Figure 2: Secure architecture for distributed governance and automated compliance in Mobile IoT.</figcaption></figure>

This architecture implements a robust commitment and verification mechanism for data collected by IoT sensors such as images, biometric samples, and GPS positions, leveraging the SHAKE128 sponge function and modality-specific ZKPs.

Figure 3 illustrates a five-layer modular architecture integrating data governance, ZKP, access control, continuous auditing, and anomaly detection, ensuring regulatory compliance, enhanced security, and operational resilience in Mobile IoT.

<figure><img src="image_4.png" /><figcaption>Figure 3: Mobile IoT architecture based on a private blockchain and smart contracts.</figcaption></figure>
This figure depicts the proposed Mobile IoT architecture, built on a private permissioned blockchain and smart contracts that enforce immutable management of privacy policies, consent, and access rights. The cryptographic module, embedding ZKPs and the SHAKE128 sponge function at the sensor level, ensures authenticity and integrity at data capture.

Table 1 describes the proposed architecture (Figure 2), highlighting the operational workflow from IoT data acquisition to regulatory supervision, as well as the objectives, cryptographic functions, and associated security benefits.

<table><caption>Table 1: Operational mapping of the ZKP-IoT protocol for commitment and verification</caption><thead><tr><td>Step</td><td>Objective</td><td>Cryptographic function</td><td>Security and compliance benefits</td></tr></thead><tbody><tr><td>Data normalization</td><td>Standardize sensor outputs (image, biometrics, GPS) for uniform processing</td><td>Preprocessing function, Normalize(·)</td><td>Eliminates variability, ensures reproducibility, and prepares data for secure commitment</td></tr><tr><td>Commitment generation</td><td>Bind normalized data to a unique secure reference</td><td>Sponge hash C = H<sub>s</sub>(ID || D || r) (SHAKE128)</td><td>Guarantees integrity, uniqueness via r, and prevents forgery</td></tr><tr><td>Challenge generation</td><td>Create a verifiable test without state storage</td><td>Stateless challenge Ch = H<sub>s</sub>(ID || t || C)</td><td>Ensures freshness, resists replay attacks, and avoids centralized storage</td></tr><tr><td>Signature</td><td>Prove authenticity and data origin</td><td>Digital signature σ = Sign<sub>sk</sub>(Ch)</td><td>Provides non-repudiation and source verification</td></tr><tr><td>Contextual verification</td><td>Validate multimodal data relevance and reliability</td><td>Visual, biometric, and geolocation checks</td><td>Strengthens authenticity by detecting anomalies and contextual inconsistencies</td></tr><tr><td>Final fingerprint</td><td>Generate an immutable blockchain record</td><td>Final hash F = H<sub>s</sub>(ID || C || t || σ)</td><td>Ensures tamper-proof traceability, facilitating regulatory audits</td></tr><tr><td>Rights enforcement</td><td>Automate legal compliance processes</td><td>Smart contracts (erase, update, consent, portability)</td><td>Guarantees compliance with GDPR, CCPA, and Beninese Law No. 2017-20</td></tr><tr><td>Secure regulatory interaction</td><td>Maintain transparency and supervision</td><td>Encrypted channels between subject, orchestrator, and authority</td><td>Provides real-time control, auditability, and trusted governance</td></tr></tbody></table>

The synthesis outlines the sequence of operations, their objectives, the cryptographic primitives involved, and the benefits in terms of security and compliance. It demonstrates how the integration of sponge functions, ZKPs, contextual verification, and automated rights management ensures integrity, authenticity, non-repudiation, and alignment with frameworks such as GDPR, CCPA, and Beninese Law No. 2017-20.

To further clarify the entire workflow, Algorithm 1 details each phase, from data collection to immutable anchoring and rights management.
**Algorithm 1: Execution of the ZKP-IoT operational workflow**

**Input:** Image data ($D_{img}$); biometric data ($D_{bio}$); GPS data ($D_{gps}$); device identifier (ID); private key (sk); public key (pk); timestamp (t); secure nonce (r)

**Output:** Immutable fingerprint (F) stored on the blockchain; compliance status and audit logs

1 **Declarations**

2 $\tilde{D} \leftarrow \emptyset$ // Vector of normalized data

3 $C \leftarrow \emptyset$ // Commitment binding ID, $\tilde{D}$, and r

4 $Ch \leftarrow \emptyset$ // Stateless challenge derived from ID, t, and C

5 $\sigma \leftarrow \emptyset$ // Digital signature of the challenge

6 $F \leftarrow \emptyset$ // Final blockchain-anchored fingerprint

7 $\text{Signature Verified} \leftarrow \text{false}$ // Signature verification result

8 $\text{Context Valid} \leftarrow \text{false}$ // Context validation result

9 $\theta_{img}, \theta_{bio}, \theta_{gps} \leftarrow \emptyset$ // Validation thresholds

10 $\theta \leftarrow \{\theta_{img}, \theta_{bio}, \theta_{gps}\}$ // Threshold set for contextual checks

11 $\text{status} \leftarrow \text{INIT}$ // Pipeline status code

12 **Begin**

13 1. $\tilde{D} \leftarrow \text{Normalize}(D_{img}, D_{bio}, D_{gps})$ // Standardize inputs and remove noise

14 2. $C \leftarrow \text{Hs}(ID \parallel \tilde{D} \parallel r)$ // Compute cryptographic commitment

15 3. $Ch \leftarrow \text{Hs}(ID \parallel t \parallel C)$ // Generate fresh challenge

16 4. $\sigma \leftarrow \text{Sign}(sk, Ch)$ // Prover generates digital response

17 5. $\text{Signature Verified} \leftarrow \text{Verify}(pk, Ch, \sigma)$ // Verifier checks signature

18 6. **if** $\text{Signature Verified} = \text{false}$ **then**

19 status $\leftarrow \text{AUTH_FAIL}$

20 **return** authentication failure

21 7. $\text{Context Valid} \leftarrow \text{Context Validate}(\tilde{D}, \theta)$ // Multimodal context validation: image, biometrics, geospatial

22 8. **if** $\text{Context Valid} = \text{false}$ **then**

23 status $\leftarrow \text{CTX_FAIL}$

24 **return** context validation failure

25 9. $F \leftarrow \text{Hs}(ID \parallel C \parallel t \parallel \sigma)$ // Compute auditable fingerprint

26 10. $\text{BlockchainStore}(F)$; status $\leftarrow \text{ONCHAIN}$ // Immutable blockchain storage

27 11. status $\leftarrow \text{ExecuteContracts}(\text{consent}, \text{erase}, \text{update}, \text{portability})$ // Rights management via smart contracts

28 12. $\text{ArchiveAudit}(F, status, t)$ // Archive logs and generate audit reports

29 13. **return** F // Operational workflow completed

30 **End**

## 3.2 Stateless commitment and authentication protocol

Authentication in Mobile IoT must balance strong cryptographic guarantees with low overhead. The proposed architecture implements a stateless challenge-response protocol, based on the SHAKE128 sponge function and post-quantum hash-based signatures. Each device computes a commitment $C = H_s(ID \parallel \tilde{D} \parallel r)$ from its identifier, normalized data, and a secure nonce. This step preserves confidentiality. The challenge is derived as $Ch = H_s(ID \parallel t \parallel C)$ using a trusted timestamp. The signature $\sigma = \text{Sign}_{\text{pq}}(sk, Ch)$ reduces key size and accelerates
verification. Peers validate locally and reject invalid transactions. A contextual verification, leveraging GPS, biometric, or visual data, further enhances reliability.

Algorithm 2 presents the proposed ZKP protocol for Mobile IoT, combining SHAKE128, post-quantum signatures, and contextual validation to deliver secure, efficient, auditable, and stateless authentication that is resilient to classical and quantum threats.

<table><caption>**Algorithm 2:** ZKP-IoT proof process with SHAKE128</caption><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td>1</td><td>Declarations</td><td></td></tr><tr><td>2</td><td>Variables: C &larr; &emptyset;, Ch &larr; &emptyset;, &sigma; &larr; &emptyset;, F &larr; &emptyset;</td><td></td></tr><tr><td>3</td><td>Booleans: Signature Verified &larr; false, Is_ctx_valid &larr; false</td><td></td></tr><tr><td>4</td><td>Begin</td><td></td></tr><tr><td>5</td><td>1. C &larr; H<sub>s</sub>(ID &parallel; D &parallel; r) // Commitment binding ID and normalized data<br/>with a nonce</td><td></td></tr><tr><td>6</td><td>2. Ch &larr; H<sub>s</sub>(ID &parallel; t &parallel; C) // Challenge derived from timestamp and<br/>commitment</td><td></td></tr><tr><td>7</td><td>3. &sigma; &larr; SIGN(sk, Ch) // Digital response</td><td></td></tr><tr><td>8</td><td>4. Signature Verified &larr; VERIFY(pk, Ch, &sigma;) // Signature verification</td><td></td></tr><tr><td>9</td><td>5. if Signature Verified = false then</td><td></td></tr><tr><td>10</td><td>&nbsp;&nbsp;&nbsp;&nbsp;return authentication failure</td><td></td></tr><tr><td>11</td><td>6. Is_ctx_valid &larr; CONTEXTVALIDATE(D) // GPS, biometric, and visual<br/>checks</td><td></td></tr><tr><td>12</td><td>7. if Is_ctx_valid = false then</td><td></td></tr><tr><td>13</td><td>&nbsp;&nbsp;&nbsp;&nbsp;return context validation failure</td><td></td></tr><tr><td>14</td><td>8. F &larr; H<sub>s</sub>(ID &parallel; C &parallel; t &parallel; &sigma;) // Final audit hash</td><td></td></tr><tr><td>15</td><td>9. BLOCKCHAINSTORE(F) // Immutable anchoring on the blockchain</td><td></td></tr><tr><td>16</td><td>10. return proof success</td><td></td></tr><tr><td>17</td><td>End [24]</td><td></td></tr></tbody></table>

Figure 4 depicts the ZKP-based authentication architecture, combining cryptographic commitment, challenge-response verification, contextual checks, and immutable blockchain recording to ensure reliable operations in Mobile IoT.
<figure><img src="image_5.png" /><figcaption>Figure 4: SPHINCS+ authentication with contextual validation and blockchain recording</figcaption></figure>

Table 2 details the five-layer ZKP-IoT architecture, specifying objectives, cryptographic mechanisms, and security guarantees from initial commitments to secure key lifecycle management.

<table><caption>Table 2: Five-layer structure of the proposed ZKP-IoT architecture</caption><thead><tr><td>Layer</td><td>Objective</td><td>Cryptographic function</td><td>Security and compliance benefits</td></tr></thead><tbody><tr><td>Layer A: Commitment generation</td><td>Bind sensor data (image, biometrics, GPS) to a unique, unfalsifiable reference</td><td>Sponge function: Commitment = Sponge(ID || DATA || Nonce) (SHAKE128)</td><td>Ensures integrity, uniqueness via nonce, and prevents forgery</td></tr><tr><td>Layer B: Challenge-Response</td><td>Authenticate data origin without state storage</td><td>Challenge: Challenge = Sponge(ID || Timestamp || Commitment); Response: SPHINCS + _Sign(sk, Challenge); Verify: SPHINCS + _Verify(pk, Challenge, Response)</td><td>Provides authenticity, non-repudiation, replay resistance, and quantum-resistant signatures</td></tr><tr><td>Layer C: Contextual validation</td><td>Check accuracy and contextual relevance of data</td><td>Visual verification, biometric matching, GPS geofencing</td><td>Detects anomalies, strengthens sensor trust, mitigates contextual spoofing</td></tr><tr><td>Layer D: Immutable recording</td><td>Store validated data in a tamper-proof ledger</td><td>Hyperledger blockchain with Record = Sponge(Validated Data)</td><td>Guarantees immutability, auditability, and compliance (GDPR, CCPA, Japanese Law No. 2017-20)</td></tr><tr><td>Layer E: Post-quantum key management</td><td>Secure the cryptographic key lifecycle</td><td>HSM/KMS integration for key generation, rotation, and revocation</td><td>Enhances operational security, supports PQC algorithms, and aligns with key-management standards</td></tr></tbody></table>

This synthesis clarifies each architectural layer and explains how sponge-based commitments, post-quantum signatures (SPHINCS+), contextual validation, distributed immutability, and hardware-backed key management jointly ensure integrity, authenticity, confidentiality, and regulatory compliance. The layered design provides resilience to emerging quantum-era threats while enabling real-time verification and tamper-proof storage.

Figure 5 illustrates the layered service architecture designed for secure data management, dynamic policy orchestration, and automated regulatory compliance in Mobile IoT ecosystems.
<figure><img src="image_6.png" /><figcaption>Figure 5: Modular service architecture for Mobile IoT data management and orchestration</figcaption></figure>

The architecture applies multi-layer protection. Heterogeneous sensors collect sensitive data, which are immediately preprocessed and anonymized. Cryptographic commitments use SHAKE128 and signatures rely on SPHINCS+, preserving confidentiality without exposing raw data. Validation operates across contexts: visual, biometric, and geospatial checks strengthen reliability, and cross-authentication enforces consistency. Validated data are recorded in a permissioned blockchain; Hyperledger provides traceability and consensus. Orchestration is implemented with Apache Airflow. GDPR rights are automated via smart contracts—consent, erasure, update, and portability are enforced. Every operation is timestamped and validated, ensuring continuous compliance amid evolving legal frameworks (GDPR, CCPA, and Chinese law). The dynamic orchestration improves resilience and distributed governance while guaranteeing transparency and regulatory alignment [15].

## IV EXPERIMENTAL RESULTS

Experiments were conducted in a realistic setting that combines constrained IoT devices, distributed fog infrastructures, and a private blockchain for secure event recording. The goal is to validate the cryptographic robustness, dynamic regulatory compliance, and operational performance of the proposed architecture.

The experimental environment includes:

* ARM Cortex-M microcontrollers (256 KB RAM, 72 MHz) to emulate mobile sensors.

* The **ns-3** network simulator configured to emulate BLE and NB-IoT communications with mobility scenarios.
* A Hyperledger Fabric instance with Proof-of-Authority (PoA) consensus to guarantee fast, immutable transaction traceability [25].

* Kubernetes for blockchain service orchestration.

* Prometheus and Grafana for performance monitoring.

* The SHAKE128 sponge function for cryptographic commitments [26].

* JSON Web Tokens (JWT) for dynamic consent management [27].

* Stateless authentication protocols based on hash trees that are resistant to quantum attacks [28].

The testbed evaluates the modular mobile IoT architecture under resource constraints. ARM Cortex-M boards represent constrained devices and serve to assess lightweight cryptography and secure protocols [29]. Network dynamics, including BLE and NB-IoT traffic with mobility and topological variation, are reproduced with ns-3 [30], enabling precise latency and throughput measurements. A permissioned Hyperledger Fabric blockchain with PoA consensus automates compliance and accelerates transaction finality [25]. Kubernetes orchestrates blockchain services resiliently [31], while Prometheus/Grafana provide real-time monitoring, anomaly detection, and energy analytics [32]. On the cryptographic side, SHAKE128 reduces energy consumption while maintaining strong security [26]. JWTs manage user consent in line with data-protection requirements [27]. To evaluate privacy-preserving compliance verification, Zero-Knowledge Proofs (ZKPs) are integrated, enabling policy verification without exposing raw data in multimodal contexts (biometrics, imaging, geolocation). Finally, stateless, hash-based signatures provide quantum-resilient authentication with low energy cost [28]. These components demonstrate feasibility and establish a solid experimental foundation for a secure, scalable, and regulation-compliant IoT ecosystem.

<figure><img src="image_7.png" /><figcaption>Figure 6: Functional tree and CMakeLists configuration of the *iot_project* module in ns-3.</figcaption></figure>

The structure shown reflects expected functional outcomes of *iot_project* rather than a strict folder layout. The architecture is decomposed into specialized modules that ensure modularity, maintainability, and smooth integration within ns-3. The *crypto* module implements SHAKE128 via XKCP and SPHINCS+ for signing and verification, exposing standardized *IHasher* and *ISigner* interfaces. The *utils* module groups essential primitives such as *geo-utils* for quantization and geofencing, *time-utils* for timestamp handling, and an *id-provider*. The *sensors* module models GPS, biometrics, and camera, generating heterogeneous data streams.
The *blockchain* module manages *Transaction*, an append-only *Ledger*, and *Smart Contract* via *BasicPolicy*. The *orchestration* module coordinates the entire pipeline: data collection, cryptographic commitment, signing, policy enforcement, and anchoring in the distributed ledger. The *police-device-helper* facilitates simulation within *ns-3*. The testing layer validates utilities, sensors, ledger consistency, policies, SHAKE128, and SPHINCS+. Together, these modules enable secure, auditable, and regulation-compliant Mobile IoT data processing.

<figure><img src="image_8.png" /><figcaption>Figure 7: Sensor-device-blockchain interaction in a Mobile IoT scenario simulated with ns-3.</figcaption></figure>

Figure 7 illustrates experimental validation with multimodal IoT sensors. Camera, biometrics, and GPS produce normalized data that the *PoliceDevice* aggregates, commits, and signs. The blockchain anchors an immutable record. This pipeline demonstrates efficient and compliant processing. Results confirm lightweight, audited orchestration. The layered view supports the modular approach. Lightweight cryptography, ZKPs, and smart contracts provide compliance and security under tight constraints.

In summary, the *iot_project* implemented in *ns-3* forms a modular, robust, and extensible base to validate a secure IoT authentication pipeline. The approach combines heterogeneous sensors (GPS, biometrics, camera), SHAKE128-based cryptographic normalization, SPHINCS+ post-quantum signatures, and distributed governance via an append-only ledger and smart contracts. Results demonstrate end-to-end feasibility—from data collection to immutable blockchain anchoring—ensuring traceability and confidentiality. The orchestrator provides smooth coordination, and tests confirm the reliability of core primitives. Further improvements are planned (ledger persistence, camera heuristics, SPHINCS+ verification paths, realistic network scenarios) to support compliant, auditable, and resilient Mobile IoT deployments.

Table 3 summarizes key indicators comparing a traditional architecture with the proposed one.

<table><caption>Table 3: Performance comparison between traditional and distributed IoT architectures</caption><thead><tr><td>Performance indicator</td><td>Traditional</td><td>Proposed</td><td>Gain (%)</td></tr></thead><tbody><tr><td>Preprocessing latency (ms)</td><td>12,000</td><td>2,000</td><td>-83% [33]</td></tr><tr><td>Authentication latency (ms)</td><td>120</td><td>45</td><td>-63%</td></tr><tr><td>MITM attack detection rate</td><td>74%</td><td>98% [34]</td><td>+32%</td></tr><tr><td>Energy consumption (mAh)</td><td>1.5</td><td>0.5</td><td>-67%</td></tr><tr><td>Traceability rate</td><td>68%</td><td>100%</td><td>+32%</td></tr><tr><td>Detected non-compliances</td><td>12%</td><td>1.8%</td><td>-85%</td></tr><tr><td>Average audit time (s)</td><td>28</td><td>8</td><td>-71%</td></tr><tr><td>Anomaly response time (s)</td><td>14</td><td>3</td><td>-79%</td></tr></tbody></table>
The detection pipeline complements the experimental environment by ensuring an integrated
chain from the ingestion of signed packets (*Commit*, *Challenge*, *Response*, *PK*, *ID*, *Timestamp*,
*Status*) to the traceability of alerts recorded on the blockchain. An indexing service extracts
metrics (latency, coordinates, inter-event delays, failures), which are evaluated in real time by
Prometheus. These data feed a correlation engine that detects weak signals, such as repeated
biometric failures associated with geographic anomalies. Alertmanager enforces escalation
policies (notification, blocking, audit), with each alert linked to the *device ID*, the commitment
hash, and the block reference.

V ANALYSIS OF RESULTS AND DISCUSSION

The experimental results demonstrate notable improvements. Latency and energy consump-
tion decrease significantly. These reductions stem from lightweight cryptographic algorithms
and delegation to fog nodes. Effectiveness translates into enhanced detection of MITM and
replay attacks. Advanced cryptographic mechanisms and real-time auditing reinforce these per-
formances. Security is built on five components. Data are normalized $\tilde{D}$ with identifier *ID*
and nonce *r*. A commitment *C* = *H*<sub>s</sub>(*ID* || *D* || *r*) is computed. A post-quantum signa-
ture *σ* = Sign<sub>pq</sub>(*sk*, *C*) ensures authenticity. Transmission uses a stateless challenge–response
*Ch* = *H*<sub>s</sub>(*ID* || *t* || *C*) with verification Verify<sub>pq</sub>(*pk*, *Ch*, *σ*). A final digest *F* is anchored
on the blockchain. Smart-contract functions *consent*, *erase*, *update*, and *portability* guarantee
compliance and auditability. Experiments on ARM Cortex-M confirm the speed of SHAKE128,
the efficiency of SPHINCS+, and an end-to-end latency of approximately ≈ 16 ms, mainly
limited by communications with Hyperledger Fabric.

<figure><img src="image_9.png" /><figcaption>Figure 8: Average execution time per component.</figcaption></figure>

The main bottleneck arises from communications with Hyperledger Fabric, while SHAKE128
and ZKP verification maintain excellent performance on constrained devices.
The evaluation in Table 3 highlights major improvements. Preprocessing latency is reduced by 83%. Authentication accelerates by 63% [33, 35]. These gains result from decentralization, lightweight cryptography, and optimized task distribution [36, 37]. MITM detection increases from 74% to 98% [34]. Energy consumption drops by 67%. Traceability reaches 100%. Non-compliance decreases by 85%. Audits are accelerated by 71%. Anomaly responses improve by 79%. The *iot_project* module experimentally validates a modular pipeline integrating GPS, biometrics, and camera. SHAKE128 and SPHINCS+ ensure robustness. Blockchain and smart contracts guarantee traceability. The orchestrator coordinates the steps. Tests validate core components. Improvements remain, including ledger persistence, SPHINCS+ optimization, and sensor refinements.

# VI CONCLUSION

This article demonstrates that the integration of distributed governance with lightweight cryptographic mechanisms and automated orchestration provides a sustainable advancement in strengthening both security and regulatory compliance for constrained mobile IoT systems. The proposed architecture relies on a permissioned Hyperledger Fabric ledger operating under a Proof of Authority consensus, SHAKE128-based cryptographic commitments generated close to the sensors, and stateless hash-based signatures ensuring authenticity. Access control is enforced through a stateless challenge-response protocol and JSON Web Tokens, while zero-knowledge proofs (ZKP) establish regulatory compliance and data integrity without disclosing raw information, including in multimodal scenarios. Designed for microcontrollers, ZKPs minimize computational overhead while enhancing confidentiality, resilience against insider threats, and alignment with GDPR, CCPA, and Benin's Digital Code. Experimental evaluation highlights significant gains: an 83% reduction in preprocessing time, 63% faster authentication, MITM detection rate improved to 98%, 67% reduction in energy consumption, complete traceability, and an 85% decrease in non-compliances, with over 70% improvement in audit and anomaly response times. Identified limitations concern PoA consensus scalability, write latency under heavy load, residual edge energy consumption, and multi-jurisdictional policy management. Future work will focus on optimizing ZKP generation for embedded environments, adopting Byzantine fault-tolerant consensus mechanisms, and leveraging explainable ZKP combined with artificial intelligence to enhance transparency, detection, and adaptive orchestration.

# BIBLIOGRAPHY

[1] S. Sicari, A. Rizzardi, L. A. Grieco, and A. Coen-Porisini. "Security, Privacy and Trust in Internet of Things: The Road Ahead". en. In: *Computer Networks* 76 (Jan. 2015), pp. 146-164. ISSN: 1389-1286. DOI: 10.1016/j.comnet.2014.11.008. URL: https://www.sciencedirect.com/science/article/pii/S1389128614004089 (visited on 03/24/2025).

[2] J. H. Ziegeldorf, O. G. Morchon, and K. Wehrle. "Privacy in the Internet of Things: Threats and Challenges". en. In: *Security and Communication Networks* 7.12 (Apr. 2014), pp. 2728-2742. ISSN: 1939-0122. DOI: 10.1002/sec.795. URL: https://doi.org/10.1002/sec.795 (visited on 03/24/2025).

[3] J. Gubbi, R. Buyya, S. Marusic, and M. Palaniswami. "Internet of Things (IoT): A vision, architectural elements, and future directions". In: *Future Generation Computer Systems* 29 (2013), pp. 1645-1660. ISSN: 0167-739X. DOI: 10.1016/j.future.2013.01.010. URL: https://doi.org/10.1016/j.future.2013.01.010 (visited on 08/18/2025).
[4] H. Özköse. "Bibliometric Analysis and Scientific Mapping of IoT". en. In: *Journal of Computer Information Systems* 63.6 (Nov. 2023), pp. 1438-1459. ISSN: 0887-4417. DOI: 10.1080/08874417.2023.2167135. URL: https://doi.org/10.1080/08874417.2023.2167135 (visited on 03/24/2025).

[5] V. H. Tran, A. Mehrotra, M. Chetty, N. Feamster, J. Frankenreiter, and L. Strahilevitz. "Measuring Compliance with the California Consumer Privacy Act Over Space and Time". en. In: *Proceedings of the CHI Conference on Human Factors in Computing Systems*. Honolulu, HI, USA: ACM, May 2024, pp. 1-19. ISBN: 979-8-4007-0330-0. DOI: 10.1145/3613904.3642597. URL: https://doi.org/10.1145/3613904.3642597 (visited on 03/24/2025).

[6] P. Voigt and A. Von Dem Bussche. *The EU General Data Protection Regulation (GDPR): A Practical Guide*. en. 2nd ed. Cham, Switzerland: Springer Nature Switzerland AG, 2024. ISBN: 978-3-031-62327-1. DOI: 10.1007/978-3-031-62328-8. URL: https://doi.org/10.1007/978-3-031-62328-8 (visited on 03/24/2025).

[7] M. Conti, S. Kumar, C. Lal, and S. Ruj. "A Survey on Security and Privacy Issues of Bitcoin". en. In: *IEEE Communications Surveys & Tutorials* 20.4 (Oct. 2018), pp. 3416-3452. ISSN: 1553-877X. DOI: 10.1109/COMST.2018.2842460. URL: https://doi.org/10.1109/COMST.2018.2842460 (visited on 03/24/2025).

[8] W. Zhou and S. Piramuthu. "Security/privacy of wearable fitness tracking IoT devices". In: *2014 9th Iberian Conference on Information Systems and Technologies (CISTI)*. 2014 9th Iberian Conference on Information Systems and Technologies (CISTI). Barcelona, Spain: IEEE, June 2014. DOI: 10.1109/CISTI.2014.6877073. URL: https://ieeexplore.ieee.org/document/6877073 (visited on 07/13/2025).

[9] R. Roman, J. Najera, and J. Lopez. "Securing the Internet of Things". In: *Computer* 44.9 (Sept. 2011), pp. 51-58. ISSN: 1558-0814. DOI: 10.1109/MC.2011.291. URL: https://doi.org/10.1109/MC.2011.291 (visited on 08/18/2025).

[10] V. A. Siris, D. Dimopoulos, N. Fotiou, S. Voulgaris, and G. C. Polyzos. " OAuth 2.0 meets Blockchain for Authorization in Constrained IoT Environments". In: *2019 IEEE 5th World Forum on Internet of Things (WF-IoT)*. 2019 IEEE 5th World Forum on Internet of Things (WF-IoT). Apr. 2019, pp. 364-367. DOI: 10.1109/WF-IoT.2019.8767223. URL: https://ieeexplore.ieee.org/abstract/document/8767223 (visited on 11/18/2023).

[11] E. Boo, J. Kim, and J. Ko. "LiteZKP: Lightening Zero-Knowledge Proof-Based Blockchains for IoT and Edge Platforms". en. In: *IEEE Systems Journal* 16.1 (Jan. 2022), pp. 112-123. ISSN: 1932-8184. DOI: 10.1109/JSYST.2020.3048363. URL: https://doi.org/10.1109/JSYST.2020.3048363 (visited on 03/24/2025).

[12] T. M. Fernandez-Carames and P. Fraga-Lamas. "Towards Post-Quantum Blockchain: A Review on Blockchain Cryptography Resistant to Quantum Computing Attacks". en. In: *IEEE Access* 8 (Apr. 2020), pp. 21091-21116. ISSN: 2169-3536. DOI: 10.1109/ACCESS.2020.2968985. URL: https://doi.org/10.1109/ACCESS.2020.2968985 (visited on 03/24/2025).

[13] L. Chen, S. Jordan, Y.-K. Liu, D. Moody, R. Peralta, R. Perlner, et al. *Report on Post-Quantum Cryptography*. en. NIST Interagency Report NISTIR 8105. Gaithersburg, MD: National Institute of Standards and Technology, Apr. 2016. DOI: 10.6028/NIST.IR.8105. URL: https://doi.org/10.6028/NIST.IR.8105 (visited on 03/24/2025).

[14] K. Christidis and M. Devetsikiotis. "Blockchains and Smart Contracts for the Internet of Things". en. In: *IEEE Access* 4 (July 2016), pp. 2292-2303. ISSN: 2169-3536. DOI:
10.1109/ACCESS.2016.2566339. URL: https://doi.org/10.1109/ACCESS.2016.2566339 (visited on 03/24/2025).

[15] V. M. Olowo, A. S. R. M. Ahouandjinou, F.-X. A. Ametepe, and P. M. A. F. Kiki. "An Overview of Personal Data Protection in Mobile IoT Based Upon a Bibliometric Analysis". en. In: *IET Conference Proceedings*. Vol. 2024. 23. Jan. 2025, pp. 321-327. DOI: 10.1049/icp.2024.4442. URL: https://digital-library.theiet.org/content/conferences/10.1049/icp.2024.4442 (visited on 03/24/2025).

[16] S. Adeoye. "Internet of Things (IoT): A Vision, Architectural Elements and Future Directions". en. In: *Cognitive Management Systems (CJMS)* 5.1 (Jan. 2025), pp. 316-338. ISSN: 2634-8479. DOI: 10.47760/cognizance.2025.v05i01.027. URL: https://doi.org/10.47760/cognizance.2025.v05i01.027 (visited on 03/24/2025).

[17] Y. Yang, L. Wu, G. Yin, L. Li, and H. Zhao. "A Survey on Security and Privacy Issues in Internet-of-Things". In: *IEEE Internet of Things Journal* 4.5 (Oct. 2017), pp. 1250-1258. DOI: 10.1109/JIOT.2017.2694844.

[18] Y. Zhang, S. Kasahara, Y. Shen, X. Jiang, and J. Wan. "Smart Contract-Based Access Control for the Internet of Things". In: *IEEE Internet Things Journal* 6.2 (Apr. 2019), pp. 1594-1605. DOI: 10.1109/JIOT.2018.2847705.

[19] M. V. Olowo and al. "Protection des données personnelles dans l'Internet des Objets mobile : analyse bibliométrique et revue synthétique". fr. In: *Le Journal de la Recherche Scientifique de l'Université de Lomé* (2025). Référencé dans African Journal On Line (AJOL).

[20] M. Aria and C. Cuccurullo. "bibliometrix: An R-tool for comprehensive science mapping analysis". In: *Journal of Informetrics* 11.4 (Nov. 2017), pp. 959-975. ISSN: 1751-1577. DOI: 10.1016/j.joi.2017.08.007. URL: https://doi.org/10.1016/j.joi.2017.08.007 (visited on 08/18/2025).

[21] Z. Zheng, S. Xie, H.-N. Dai, X. Chen, and H. Wang. "An Overview of Blockchain Technology: Architecture, Consensus, and Future Trends". en. In: *2017 IEEE International Congress on Big Data (BigData Congress)*. Honolulu, HI, USA: IEEE, July 2017, pp. 557-564. ISBN: 978-1-5386-2537-5. DOI: 10.1109/BigDataCongress.2017.85. URL: https://doi.org/10.1109/BigDataCongress.2017.85 (visited on 03/24/2025).

[22] A. Zwitter and J. Hazenberg. "Decentralized Network Governance: Blockchain Technology and the Future of Regulation". en. In: *Frontiers in Blockchain* 3 (Mar. 2020), p. 12. DOI: 10.3389/fbloc.2020.00012. URL: https://doi.org/10.3389/fbloc.2020.00012 (visited on 03/24/2025).

[23] A. Scrivano. *Cloud Service Architectures for Internet of Things (IoT) Integration: Analyzing Efficient Cloud Computing Models and Architectures Tailored for IoT Environments*. en. Preprint. June 2025. DOI: 10.20944/preprints202506.2017.v1. URL: https://doi.org/10.20944/preprints202506.2017.v1 (visited on 03/24/2025).

[24] Q. Yu, J. Lyu, and L. Jiang. "An Improved ARIMA-Based Traffic Anomaly Detection Algorithm for Wireless Sensor Networks". In: *International Journal of Distributed Sensor Networks* 12.1 (Jan. 2016), p. 965-983. DOI: 10.1155/2016/9653230. URL: https://journals.sagepub.com/doi/10.1155/2016/9653230 (visited on 08/17/2025).

[25] H. Honar Pajooh, M. Rashid, F. Alam, and S. Demidenko. "Hyperledger Fabric Blockchain for Securing the Edge Internet of Things". en. In: *Sensors* 21.2 (Jan. 2021), p. 359. ISSN:
1424-8220. DOI: 10.3390/s21020359. URL: https://www.mdpi.com/1424-8220/21/2/359 (visited on 03/24/2025).

[26] J. Kelsey, S. Change, and R. Perlner. *SHA-3 Derived Functions: cSHAKE, KMAC, TupleHash and ParallelHash*. Tech. rep. Gaithersburg, MD: National Institute of Standards and Technology, Dec. 2016. DOI: 10.6028/NIST.SP.800-185.

[27] M. Jones, J. Bradley, and N. Sakimura. *JSON Web Token (JWT)*. Tech. rep. RFC Editor, May 2015. DOI: 10.17487/RFC7519.

[28] P. Palmieri. "Hash-based signatures for the internet of things: position paper". en. In: *Proceedings of the 15th ACM International Conference on Computing Frontiers*. Ischia Italy: ACM, May 2018, pp. 332-335. ISBN: 978-1-4503-5761-6. DOI: 10.1145/3203217.3206427. URL: https://dl.acm.org/doi/10.1145/3203217.3206427 (visited on 03/24/2025).

[29] A.-E. M. Taha, A. M. Rashwan, and H. S. Hassanein. "Secure Communications for Resource-Constrained IoT Devices". en. In: *Sensors* 20.13 (June 2020), p. 3637. ISSN: 1424-8220. DOI: 10.3390/s20133637. URL: https://www.mdpi.com/1424-8220/20/13/3637 (visited on 03/09/2025).

[30] M. Mamun-Ibn-Abdullah, M. Shahinuzzaman, S. M. A. Rahim, and M. H. Kabir. "Convergence Platform of Cloud Computing and Internet of Things (IoT) for Smart Healthcare Application". In: *Journal of Computer and Communications* 08.08 (2020), pp. 1-11. ISSN: 2327-5219, 2327-5227. DOI: 10.4236/jcc.2020.88001. URL: https://www.scirp.org/journal/doi.aspx?doi=10.4236/jcc.2020.88001 (visited on 02/29/2024).

[31] D. D. Santos, C. F. R. Geyer, J. C. S. D. Anjos, A. B. Sousa, D. Donsez, and V. R. Q. Leithardt. *MiddleFog: A Middleware for Protocol Interoperability in Heterogeneous IoT Environments*. Tech. rep. IEEE, Feb. 14, 2024. DOI: 10.36227/techrxiv.170792.976.68508243/v1.

[32] M. Rikhi, T. Setiyaningsih, and S. S. Norman. "P Pengembangan Teknologi Internet of Things Pendeteksi Kebakaran pour Ruang Server Dilengkapi Pemantauan Real-Time melalui CCTV dan Notifikasi WhatsApp serta Monitoring menggunakan Grafana". In: *jst.unsada* 14.1 (Aug. 2024), pp. 112-119. DOI: 10.70746/jstunsada.v14i1.4.92.

[33] M. Z. A. Bhuiyan, G. Wang, and J. Wu. "Lightweight Cryptographic Algorithms for Resource-Constrained IoT Devices and Sensor Networks". In: *Security and Privacy Issues in IoT Devices and Sensor Networks*. Ed. by M. Kolhe and Y. Patil. Elsevier, 2021, pp. 153-185. ISBN: 978-0-12-821255-4. DOI: 10.1016/b978-0-12-821255-4.00008-0.

[34] J. Ruohonen and K. Hjerppe. "The GDPR Enforcement Fines at a Glance". In: *Information Systems* 106 (May 2022), p. 101876. DOI: 10.1016/j.is.2021.101876.

[35] "Energy Efficient IoT". In: *Highly-Distributed Systems*. Cham: Springer International Publishing, 2022, pp. 195-216. DOI: 10.1007/978-3-030-92829-2_9. URL: https://doi.org/10.1007/978-3-030-92829-2_9.

[36] M. N. Khan, A. Rao, and S. Camtepe. "Lightweight Cryptographic Protocols for IoT-Constrained Devices: A Survey". In: *IEEE Internet of Things Journal* 8.6 (Mar. 2021), pp. 4132-4156. ISSN: 2327-4662, 2372-2541. DOI: 10.1109/JIOT.2020.3026493. URL: https://ieeexplore.ieee.org/document/9205259/ (visited on 03/09/2025).

[37] M. Barati, O. Rana, I. Petri, and G. Theodorakopoulos. "GDPR Compliance Verification in Internet of Things". In: *IEEE Access* 8 (2020), pp. 119697-119709. ISSN: 2169-3536.
DOI: 10.1109/ACCESS.2020.3005509. URL: https://ieeexplore.ieee.org/document/9127459/ (visited on 03/24/2025).