# Survey of Blockchain-Based Applications for IoT
## 4 Identity and Access Control  
### Authentication  
The trust and authentication process starts by identifying the entity connecting to the blockchain network. While users can authenticate by username/password or multi-factor authentication (MFA), many IoT devices are headless without a traditional user interface. Due to the large number of IoT devices, zero-touch provisioning (ZTP) or low-touch provisioning (LTP) is required to streamline the process and minimize user interaction by identifying the device with one of its hardware characteristics. Figure 4: Organization of this survey paper. \begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Survey Name**} & \multirow{2}{*}{**Year**} & \multicolumn{6}{c}{**Selected Applications** & **Covered in This Survey (See Below *)**} \\ \cline{3-14}  & & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **10** & **11** & **12** \\ \hline Blockchain in IoT Security: A Survey [19] & 2018 & ✔ & ✔ & ✔ & X & X & ✔ & ✔ & ✗ & X & X & X & X \\ \hline Survey on the Application of Blockchain to IoT [20] & 2019 & X & ✔ & ✔ & X & X & X & ✔ & ✗ & X & X & X & X \\ \hline A Survey of Blockchain Applications in IoT Systems [21] & 2019 & X & ✔ & ✔ & ✔ & ✗ & ✗ & ✔ & ✗ & X & X & X & X \\ \hline A Comprehensive Survey of Blockchain [22] & 2019 & ✔ & ✔ & ✔ & ✔ & ✗ & ✗ & ✔ & ✗ & ✗ & X & X & X \\ \hline Embedding Blockchain Tech. Into IoT for Sec. [23] & 2021 & ✔ & ✔ & ✔ & ✔ & ✗ & ✗ & ✗ & ✗ & ✗ & X & X & X \\ \hline Adoption and App. of Blockchain Tech. in IoT [24] & 2023 & ✔ & ✔ & ✔ & ✔ & ✗ & ✗ & ✗ & ✗ & ✗ & X & X & X \\ \hline Enhancing Sec., Privacy, and Scalability [25] & 2023 & ✔ & ✔ & ✔ & ✔ & ✗ & X & ✔ & ✗ & ✗ & X & X \\ \hline This survey paper & 2025 & ✔ & ✔ & ✔ & ✔ & ✔ & ✗ & ✗ & ✗ & ✗ & ✗ & ✗ \\ \hline \hline \end{tabular}  
* 1—authentication; 2—trust and cryptography; 3—data immutability; 4—data transparency; 5—smart contracts; 6—oracles; 7—micropayment; 8—consensus optimization; 9—multi-layer blockchains; 10—decentralized ML; 11—non-fungible tokens (NFTs); 12—tokenomics.  
\end{table} 
Table 3: Comparison between this survey and similar surveys. In the TCP/IP stack, hardware is identified by the Media Access Control (MAC) address. However, since this MAC address is sent in clear text as part of IP communication and can be easily spoofed, it cannot be considered a way to authenticate IoT devices and identify them securely. To establish a more trusted device identity, digital certificates are used as cryptographic credentials that bind a device to a verifiable identity. These certificates are generated by a trusted authority (such as a Public Key Infrastructure (PKI) or a blockchain-based identity system) and contain essential device attributes, including a unique device identifier, public key, and issuer information. For certificates to be effective, they must be securely generated, trusted, and stored. Generation involves cryptographic key pair creation, where a device is assigned a private key for signing and a public key for verification. Trust is established through Certificate Authorities (CAs) or decentralized blockchain-based identity frameworks, ensuring that certificates cannot be forged or altered. Storage must also be tamper-resistant, typically secured in Trusted Platform Modules (TPMs) or blockchain ledgers to prevent unauthorized modifications or access. TPM technology provides a more secure hardware-based authentication method that ensures device identity verification without requiring user interaction. A TPM is based on the ISO/IEC 11889 [26] standard and functions as a hardware-based security module. It operates as a specialized microcontroller, enhancing device security by integrating cryptographic keys and algorithms for the secure storage of passwords, certificates, encryption keys, and authentication mechanisms [27]. Many low-cost, resource-limited IoT devices lack a TPM, which restricts this method to devices equipped with a TPM.