# DCAGS-IoT: Dynamic Cross-Domain Authentication Scheme Using Group Signature in IoT
## 1 Introduction  
To meet the application needs such as smart medical care, Internet of Vehicles (IoV) [1], smart home, industrial production, energy and power, Internet of Things (IoT) focuses on achieving communication between people, between people and things, and between things, providing Internet users with a more immersive application experience [2]. However, in recent years, as a large number of devices are continuously connected to the IoT, security problems in the IoT environment have emerged in an endless stream. Malicious attackers may use the insecure cross-domain authentication of devices, making network security problems more serious. Therefore, it is particularly important to design a secure and effective dynamic cross-domain authentication scheme in the IoT environment to protect the privacy of users. Cross-domain authentication [3] refers to the process of user or device identity authentication between multiple trust domains. This process not only needs to establish the credibility of the relationship between each trust domain, maintain the efficiency of the authentication process and ensure the reliability of the authentication system, but also needs to ensure the security authentication and real-time management of legal devices between each trust domain. In the real-time scenario of distributed systems, we can divide cross-domain authentication into two types: static cross-domain authentication and dynamic cross-domain authentication. Static cross-domain authentication refers to the authentication performed by user to access an information service entity in the target trust domain withoutleaving the trust domain to which it belongs. For example, the cross-domain authentication scenario in which devices in different factories are cooperatively produced in the Industrial IoT. The dynamic cross-domain authentication is the authentication performed by the user who moves to the target trust domain to access the information service entity. For example, in the Internet of Vehicles environment, in order to have a better travel experience, vehicles need to constantly interact with roadside units. At present, many schemes only consider static cross-domain authentication without discussing dynamic cross-domain authentication. Motivations and benefits. Traditional cross-domain authentication frameworks rely on centralized servers [4] such as using Public Key Infrastructure (PKI) and Identity-Based Cryptograph (IBC) to design the authentication architecture. However, the centralized authentication architecture is prone to single point of failure issues and is vulnerable to denial-of-service attacks. The emergence of blockchain has promoted the development of identity authentication, thus the authentication architecture is not limited to a centralized architecture, but its openness and transparency exposes user privacy to the public. To solve some problems existing in the existing cross-domain authentication schemes in the IoT environment, this paper proposed a dynamic cross-domain authentication scheme based on the group signature technology, combined with the distributed peer-to-peer network architecture of blockchain technology. Since the size of the signature generated by the scheme is independent of the number of group members and only depends on the security parameters, the efficiency of protocol implementation is improved, and the security and availability of the authentication scheme are guaranteed. The main contributions of this paper are as follows:  
1. Aiming at the difficulty of user joining and revocation in the dynamic cross-domain authentication environment, an effective update algorithm with complexity O(log\(N\)) is provided in the static Merkle tree accumulator to realize the dynamic addition and revocation of users. 2. We used group signature technology to allow members of a group to sign messages on behalf of the entire group, thus protecting user privacy from being leaked. Moreover, users are responsible for the issued signatures as tracking agencies can be used to identify them. 3.