## 7 Security Analysis
### Informal Security Analysis  
(1) Mutual Authentication: Edge Gateway \(EG_{i}^{X}\) can obtain \(PDID_{i}^{X}\) and the public key \(PK_{D_{i}^{X}}\) from the message sent by Device \(D_{i}^{X}\) and retrieve the device's registration information from the blockchain through the anchor node. Edge Gateway \(EG_{j}^{Y}\) in a different domain can also retrieve the verification record containing \(PDID_{i}^{X}\) from the blockchain through the anchor node. By using \(PDID_{i}^{X}\) and the verification record, both \(EG_{i}^{X}\) and \(EG_{j}^{Y}\) can authenticate Device \(D_{i}^{X}\). Device \(D_{i}^{X}\) can receive \(M_{4}\) during the intra-domain authentication phase and \(M_{6}\) during the cross-domain handover authentication phase. By utilizing \(M_{4}\) and \(M_{6}\), Device \(D_{i}^{X}\) can confirm that the messages are from Edge Gateway \(EG_{i}^{X}\) and Edge Gateway \(EG_{j}^{Y}\), respectively. As a result, the proposed protocol supports mutual authentication. Figure 3: The workflow of cross-domain device mutual authentication. (2) Session Key Agreement: Device \(D_{i}^{X}\) generates session keys \(SK_{it}\) and \(SK_{im}\) during intra-domain authentication and cross-domain handover authentication, respectively. An attacker may attempt to compute the session keys; however, without solving the discrete logarithm problem, the attacker cannot compute \(U_{it}\) and \(Y_{im}\). Therefore, the attacker is unable to obtain the session keys \(SK_{it}\) and \(SK_{im}\). (3) Replay Attack: Each authentication message contains a timestamp. The receiver verifies the timestamp before performing any processing. If the timestamp is invalid, the receiver will discard the received message. This mechanism prevents attackers from replaying previously captured messages. (4) Man-in-the-Middle Attack: Even if an attacker captures messages transmitted over public channels, they are unable to forge or modify the messages, because the attacker cannot obtain the valid parameters contained in the hash values of \(\{M_{2},M_{4},M_{5},M_{6}\}\). Therefore, the proposed scheme can effectively defend against man-in-the-middle attacks. (5) Impersonation Attack: A malicious Device \(D_{A}\) may attempt to impersonate the legitimate Device \(D_{i}^{X}\). However, during intra-domain authentication, \(D_{A}\) cannot obtain \(PDID_{i}^{X}\) and the private key \(SK_{D_{i}^{X}}\) of \(D_{i}^{X}\). Therefore, it is unable to impersonate \(D_{i}^{X}\) or generate a legitimate authentication request message during cross-domain authentication. (6) Anonymity: During the authentication phase, Device \(D_{i}^{X}\) uses a pseudonym \(PDID_{i}^{X}\) for verification; therefore, its real identity is not exposed during the authentication process. In addition, the temporary identity \(TID_{i}\) contains a random number \(b_{t}\), making it impossible for an attacker to obtain any identity information about Device \(D_{i}^{X}\) through \(TID_{i}\). Thus, the proposed protocol can ensure the anonymity of the device. (7) Short-Term Key Exposure: Even if the random numbers \(\{a_{i},a_{t},b_{t},c_{i},c_{m}\}\) are exposed to an attacker, the attacker still cannot obtain \(PDID_{i}^{X}\). Since \(SK_{it}=h(U_{it}||TID_{i}||PDID_{i}^{X})\) and \(SK_{im}=h(Y_{im}||TID_{i}||PDID_{i}^{X})\), the attacker is unable to compute the session keys. (8) Forward Security: In this protocol, the generation of session keys \(SK_{it}\) and \(SK_{im}\) requires \(U_{it}\) and \(Y_{im}\), which are generated by the device and the edge gateway during each authentication process based on random numbers. Even if an attacker knows all the long-term keys, they still cannot obtain or compute previous or current session keys. Therefore, the proposed protocol ensures forward security.