## 1 Introduction  
The Internet of Things (IoT) ecosystem includes multitudinous devices connected to the Internet [1] with a variety of capabilities, such as sensing, processing, and communicating. In 2025, the number of IoT devices is estimated to exceed 75 billion [2, 3], driving a parallel rise in the already massive amount of data that must be locally processed at the edges of networks to reduce latency and save network bandwidth. Cloud computing provides a lot of processing and storage power for thousands of IoT devices [4]. However, due to the geographic centralization of cloud computing data centers, the large volume of data generated by the distributed IoT devices will not be processed in a timely manner, which will increase the latency from IoT devices to the cloud especially as the number of IoT devices continues to grow. To overcome these challenges, fog computing has emerged to deal with the high processing demand and temporary storage. Fog computing serves as a middle layer between IoT devices and the cloud [5, 6, 7], solving the data transmission latency between them. Despite the benefits of fog computing for IoT devices and the cloud, there are several security issues between the IoT, fog, and cloud layers. For example, the Dyn cyberattack (21 October 2016) disrupted Internet service across Europe and the US [8] through a series of distributed denial-of-service (DDoS) attacks that targeted IoT-enabled devices such as cameras, residential gateways, and baby monitors. Many services were affected by this cyberattack, including businesses such as Amazon, Comcast, PayPal, and Netflix and news networks such as Fox News and CNN. Further significant threats to IoT devices include eavesdropping [1; 4; 9; 10] and unauthorized access [9; 11; 12], which can lead to device failure. Because there is no human interaction involved in the communication between these devices and because they have extensive operating times, it is difficult to monitor and detect their security issues. Therefore, it is essential to build a security model that meets the security requirements of the IoT-Fog-Cloud architecture by applying authentication and authorization between the IoT, fog, and cloud layers. Because there are not enough real-life implementations of cloud-based IoT environments, as mentioned in our previous work [5], we proposed two architectures of cloud-based IoT environments and three analysis methods using a real-world environment [6; 7]. We utilized a fog layer between IoT devices and the cloud in the first architecture, while in the second architecture, IoT devices sent data directly to the cloud [6; 7]. We conducted several experiments and evaluated our results of the methodologies and the three analysis methods [6], finding that the first architecture (IoT-Fog-Cloud) outperforms the second architecture (IoT-Cloud) in terms of performance. This is because all of the IoT devices in the second architecture (IoT-Cloud) need to have a certificate to be authenticated to the AWS cloud. However, only one certificate which is placed on the fog device of the first architecture (IoT-Fog-Cloud) is required to be authenticated to the AWS cloud. Therefore, the communication between the IoT layer and the fog layer, in particular, was left without adequate authentication and authorization mechanisms [6]. To fill the gap in security requirements between the IoT layer and fog layer and overcome the limitations and challenges presented by these security issues [5; 6; 7], this paper makes the following contributions:  
* We propose a fine-grained data access control model based on the attribute-based encryption (ABE) of the IoT-Fog-Cloud architecture to limit access to sensor data to meet the authorization aim. * We propose a blockchain-based certificate model of the IoT-Fog-Cloud architecture to authenticate IoT devices to fog devices to meet the authentication aim.