Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Contents lists available at ScienceDirect

Journal of King Saud University –

Computer and Information Sciences
journal homepage: www.sciencedirect.com

CAB-IoT: Continuous authentication architecture based on Blockchain

for internet of things
Fatimah Hussain Al-Naji a,⇑, Rachid Zagrouba b
a
Department of Computer Science, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, P.O. Box 1982, Dammam 31441, Saudi Arabia
b
Department of Computer Information Systems, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, P.O. Box 1982, Dammam
31441, Saudi Arabia

a r t i c l e i n f o a b s t r a c t

Article history: Raising incidents of security threats among active sessions is an increasing concern in IoT environment.
Received 24 August 2020 Continuous authentication was introducing to be superior to traditional authentication schemes by con-
Revised 1 November 2020 stantly verify users’ identities on an ongoing basis and spot the moment at which an illicit attacker seizes
Accepted 10 November 2020
control of the session. However, several challenges remain unsolved. This research aims to investigate the
Available online 19 November 2020
power of Blockchain technology to provide real-time and non-intrusive continuous authentication for the
IoT environment. Accordingly, a distributed and scalable continuous authentication solution based on
Keywords:
Blockchain technology called CAB-IoT was proposed. It enabled fog nodes layer that tackles the limita-
Blockchain
Continuous authentication
tions of IoT resources by providing localized processing of heavy continuous authentication-related tasks
Face recognition for a group of IoT devices. Besides, CAB-IoT introduced a trust module that depends on the face recogni-
Internet of things tion machine learning model to detect outliers and abnormal access. Moreover, mutual authentication
Machine learning between end-users and fog nodes is also designed, as well as secure communication between the authen-
ticated nodes. The results demonstrate a lightweight continuous authentication solution that achieved
the desired balance between security and performance requirements where it was observed in a real-
world environment for truly performance results. Security analysis and attack analysis are also consid-
ered during the evaluation.
Ó 2020 The Authors. Published by Elsevier B.V. on behalf of King Saud University. This is an open access
article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).

1. Introduction request. Besides, it would prevent malicious usage if the IoT device
is robbed. It is crucial to constantly ensure that, the user is not
Internet of Things (IoT) environment merges the digital and impersonated which brings a particular type of authentication
physical universes and enabling them to communicate real-time known as continuous authentication.
data, this makes security and privacy concern critical aspects that The traditional authentication scheme authenticates the legiti-
cannot be neglected. To illustrate, smartphone store a significant macy of an entity statistically at the beginning of the communica-
amount of personal data and it could be pair with a smartwatch tion session and decides either it is authenticated or not. Therefore,
to exchange data between them, these sensitive data should be they are vulnerable to security threats such as hijacking attacks,
accessed only by legitimate users, a vulnerability in one of them which take control of the active sessions. Accordingly, there is an
can directly affect the connected device. Consequently, the IoT urgent need to tackle this weakness by continuously authenticate
device needs a unique identity that can reliably identify the legit- the identity of the connected nodes during the whole session. It
imate user, thus authenticating the legitimacy of the access must be considered that the continuous authentication scheme

⇑ Corresponding author.
E-mail addresses: [email protected] (F. Hussain Al-Naji), [email protected] (R. Zagrouba).
Peer review under responsibility of King Saud University.

Production and hosting by Elsevier

https://doi.org/10.1016/j.jksuci.2020.11.023
1319-1578/Ó 2020 The Authors. Published by Elsevier B.V. on behalf of King Saud University.
This is an open access article under the CC BY-NC-ND license (http://creativecommons.org/licenses/by-nc-nd/4.0/).
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

proposed to complement and reinforce static scheme not to resources consumption of IoT devices. The main contributions of
replace it, and it has two types of communication models namely: this research are the following:
device-to-device model and user-to-device model.
In the IoT ecosystem, the user-to-device communication model
CAB-IoT proposed mutual initial static authentication between
identified several opportunities and challenges regarding the end-users and fog nodes to establish a secure encrypted channel
authentication process as opposed to the device-to-device model. between them, whereby access tokens are issued by the smart
Several schemes aim to authenticate users continuously in real- contract with no intermediary or trusted third party.
time with the help of IoT devices to prevent impersonation attacks
This research presented the key role of the overall architecture
or illegal access to the IoT environment from both anonymous and components including the architecture design, sequence dia-
known users. The proposed IoT-based user-to-device continuous grams that illustrate the interactions among the participants,
authentication solutions are largely focused on the performance and the exchanged information, as well as the design process
of the authentication decision. More specifically, the reviewed lit- of the face recognition Machine Learning (ML) model.
eratures evaluate the performance either on a fixed number of user
Several experiments that demonstrate the applicability of the
actions, or over a chunk of test dataset, and others evaluate the proposed architecture to continuously authenticate a user in
results in terms of Equal Error Rate (EER), False Acceptance Rate an IoT enabled environment showing real-time confidence eval-
(FAR), and False Rejection Rate (FRR) over the test data set which uation, minimum time required to authenticate a user, and low
consequently allows an imposter to carry out a variety of unautho- resources consumption.
rized actions before the system recognize his/her identity for the
This research analyzed the security of the proposed solution
first time, this considered as a parodic authentication rather than and showed how it achieves major security goals and its ability
CA procedure. Accordingly, there is a lack of detecting unautho- to overcome different common attacks that target the IoT
rized access as short a few times as possible continuously in environment.
real-time.
IoT devices have limitations in terms of storage, computation, The rest of this paper is organized as follows. Section 2 dis-
and battery which differ between devices. In this regard, portable cusses the related work. Section 3 describes the design adopted
devices are the most preferred device selection for CA, smart- by this research, outlines the overall methodology to be used, dis-
phones in particular (Gonzalez-Manzano et al., 2019). While wear- cusses the solution design, and presents some definitions of the
ables and implementable devices are considered as the most proposed architecture is more detail which will be subsequently
constrained IoT devices, usually rely on a powerful third-party ser- defined as layers to shape the key role of its major components.
ver, cloud-based infrastructure, or even another portable device to Moreover, this section lists the instruments of the study and justi-
carry out the computation process either partially or completely. fies their usage, provides the description of the applied dataset,
Accordingly, there is a need for a lightweight CA approach for the outlines the procedure in detail, and shows the interaction dia-
user-to-device communication model. Behavioral biometrics is grams and the exchanged information between architecture com-
receiving high attention as a unique feature identified by each user. ponents. Section 4 highlights the main settings that were made
Recalling the previous point, matching the selected feature with to apply the proposed solution in the Ethereum platform, provides
the appropriate device to extract it is a crucial evaluation. This type the performance results, and an analysis of the security aspects of
of analysis has been presented in reference (Gonzalez-Manzano the proposed solution. Finally, the limitations and the future work
et al., 2019), portable devices stand out to be suitable for all col- are presented in the conclusions in Section 5.
lected features as a result of the variety of sensors they have, the
ease of their use, and their economic price.
Recently, Blockchain technology took a step toward wider 2. Related work
applications in various areas, including the IoT (Khan et al.,
2020). More succinctly, Blockchain technology prevents unautho- Authentication is an imperative security requirement that
rized data tampering and improve system integrity and immutabil- should be applied for the whole IoT architecture (El-hajj
ity. The use of cryptographic algorithms and decentralized peer-to- et al.,2019). It is crucial for the authentication between the end
peer networks make Blockchain technology a very safe and secure devices and the gateway device. The gateway should authenticate
way to store and maintain data for the IoT systems. Moreover, it is itself while transmitting data to the cloud, and the application
a strong solution to reliably conduct the authentication process node should be authenticated to the cloud to gather data for anal-
without a central authority and overcome single-point-of-failure, ysis (Xu et al., 2014). In the IoT ecosystem, the user-to-device com-
where it is unsuitable to depend on a centralized scheme for con- munication model identified several opportunities and challenges
stantly growing systems. The data on Blockchain represents the regarding the authentication process as opposed to the device-to-
core, and the IoT depends on information like this to function prop- device model (Gonzalez-Manzano et al., 2019).
erly. The Blockchain is currently developing into a kind of universal Several schemes aim to authenticate users continuously in real-
authentication technique (Khalid et al., 2020), since it contains a time with the help of IoT devices to prevent impersonation attacks
database entry for each transaction, it will be easy to search for or illegal access to the IoT environment from both anonymous and
patterns in real-time as needed which consequently detect anoma- known users. IoT devices are characterized by limited resources in
lies early or near real-time. terms of storage, computation, and battery. In particular, wear-
This research aims to investigate the power of Blockchain tech- ables and implementable devices are the most constrained IoT
nology to provide real-time and non-intrusive continuous authen- devices where they have few MHz of CPU, few 10 s of KB of
tication for the IoT environment. However, integrating Blockchain RAM, and few 100 s KB of ROM (Xu et al., 2014; Shafagh et al.,
technology into the IoT environment for continuous authentication 2017). Portable devices, specifically smartphones, and tablets are
purposes arise several challenges that must be taken into consider- the most used in the IoT user continuous authentication applica-
ation to prove its usefulness. Among them, the use of events com- tions, this could be due to their wide usage versatility. Followed
ing from IoT devices to create precise users’ behavior profiles in by wearable devices like smart bracelets in reference (Brown
real-time, and as the continuous authentication performed fre- et al., 2017), general wearables with the accelerometer and the
quently and the IoT devices are resources constrained. Accordingly, gyroscope sensors in references (Brown et al., 2017; Matsuyama
it is necessary to adopt a lightweight mechanism to reduce et al., 2015; Mosenia et al., 2017; Mukherjee, 2017), smart glasses
2498
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

in references (Van Hamme et al., 2017; Chauhan et al., 2016) 2.2. Blockchain and fog cloud for CA in IoT
smartwatch in reference (Acar et al., 2018), wearable voice device
in reference (Feng et al., 2017). Regarding the external devices, like In Agrawal (2018), the Blockchain utilized to provide continu-
surveillance cameras utilized in references (Feng et al., 2017; ous and seamless user authentication in the IoT environment as
Ashibani et al., 2019) besides portable devices, non-contact radar well as controlling the access to smart buildings. Each interaction
to capture cardiac motion in reference (Lin et al., 2017), and smart from the legitimate user (i.e., in terms of gates behavior) within
kiosk in reference (Phan et al., 2015). It is noticeable that reference IoT-zones is recorded from their devices as a transaction in the
(Camara et al., 2018) use a smartphone beside a wearable device to Blockchain to generate the user’s IoT-trail, IoT-hubs is used as a
overcome the limitations of its constrained resources and improve third-party platform to perform the continuous authentication
processing capabilities. process. Markov chain and LSTM models are applied on a public
However, some of the challenges in providing an IoT system with gait dataset to improve generating a unique digital crypto-token
security service is the efficiency of computation and communication. for the user to access the system. The proposed mechanism
These challenges should be addressed carefully as many resource- achieved better accuracy under the LSTM model with 99.30%
constrained devices are usually involved in IoT systems (Al Salami accuracy.
et al., 2016). The utilization of emerging technologies through the In (Nikouei et al., 2019), the authors proposed a novel decen-
application of Blockchain technology and fog computing can provide tralized mechanism to verify the real-time video frames of the
a practical solution ensuring the security requirements of the IoT surveillance systems. The distributed sensor devices aim to track
environment (Zhang and Chen, 2020; Aceto et al., 2020). Blockchain and detect surveillance video events continually, which results in
represents a promising technology to provide security in an IoT envi- difficulty in determining suspicious objects from thousands of
ronment where its information is about the composition of dis- video frames. The authors used a real-time indexing service to
tributed IoT services (Xu and Viriyasitavat, 2019) which assign a unique index for each extracted feature, so the images
consequently matches the decentralized infrastructure and dis- are not vulnerable to malicious modification after their index table
tributed general ledger agreement of Blockchain technology (Lu, is hashed via smart contact and store in the Blockchain for future
2018). Also, its smart contracts offer opportunities to improve the authentication purpose. It is noticed that the data analysis process
reliability of IoT applications (Viriyasitavat et al., 2019). Authors in is deployed in fog nodes as they have more computational capabil-
(Camara et al., 2018; Al Salami et al., 2016) investigate how Block- ities. The results showed the low overhead of the proposed solu-
chain technology could be integrated into different IoT use cases, uti- tion while it authenticates the video data continually in real-time.
lizing its features in IoT environments, and a list of the advantages In fog cloud solutions, scalability is a key issue, and the scalabil-
and limitations of its usage in IoT platforms. Similarly, in (Xu et al., ity of cloud resources and fog nodes becomes important to meet
2018), the author utilized Blockchain’s features to propose a dis- the workload of IoT data. Authors in (Salah, 2013); proposed an
tributed storage system for large-scale IoT applications based on analytical model that aims to determine the minimal number of
Blockchain technology. While authors in (Salah et al., 2019), propose cloud resources needed to satisfy the response time based on finite
a Blockchain-based framework to enable a seamless integration of queueing systems. Moreover, authors in (El Kafhali and Salah,
business transactions and workflows in the agricultural supply chain, 2017), proposed a stochastic model based on queuing theory that
the results showed an efficient trace and track process. In (Hardjono aims to analyze the performance in cloud data centers by modeling
and Smith, 2016), the authors proposed a privacy-preserving method it with an open queuing system that can be used to estimate the
based on permissioned Blockchain to share IoT sensors data between expected Quality of Service (QoS) guarantees the cloud can offer.
device owners and the service providers through cloud ecosystems
securely. However, it achieved full anonymity of the communicating
3. The proposed CAB-IoT
devices, while it is not adapted for the cases that required identifying
the devices. As well as in (Huh et al., 2017), the author proposed an
This research is an applied research and based on experimental
idea based on Blockchain which relies on the smart contracts to
design.
define the actions of each connected object when using the system
in complete anonymity.
3.1. Overall methodology

The overall CAB-IoT proposed Blockchain-based user continu-

2.1. Blockchain for authentication in IoT ous authentication architecture is shown in Fig. 1. Aiming to pro-
vide an efficient continuous authentication for the IoT
Bubbles of Trust system in Hammi et al. (2018), aims to provide environment, CAB-IoT proposes a distributed architecture that uti-
secure virtual zones to authenticate the connected devices in IoT envi- lizes Blockchain technology to avoid the need for an intermediary
ronments securely. The approach is based on public Blockchain. Thus, or a trusted third party, therefore it will provide high trust and
it is utilized from its security characteristics and it has the feature to availability. The selection of Ethereum Blockchain specifically
be applied in a wide range of IoT contexts. Besides, the evaluation because of its ability to assign a unique Ethereum address (i.e.,
results proved its efficiency, ability to satisfy IoT security require- with public and private keys) for every participated node which
ments, and its lowest cost. The approach suffers from its adaptability supports creating custom tokens-based access that enhances the
to real-time applications, since validating the sent messages depends security factor in IoT (Fotiou et al., 2019). Moreover, Ethereum car-
on the consensus needed time which takes almost 14 s. ries out transactions relatively fast where its block time is between
While in Wu et al. (2018), the author identified an out-of-band 10 s and 20 s, while other Blockchain networks take about 10 min
two-factor authentication scheme, where even if the first authenti- (Ozyilmaz and Yurdakul, 2019). Besides, Ethereum’s design sup-
cation factor fails (e.g. the passcode or access token is stolen), the ports the scalability feature as it uses block gas limits (e.g. com-
second factor will prevent the malicious devices by checking the plexity needs, storage needs, and bandwidth usage) for every
relationship information stored in the Blockchain, which in turn transaction’s cost (Anthony Heston, 2019). This research is going
overcome single point failure problem exists in the centralized ser- to implement a private Ethereum network using the proof of
ver. The evaluation of the proposed scheme showed that the mem- authority consensus instead of the more familiar proof of work
ory overhead is well acceptable. consensus. Private Blockchain is simple and provides more advan-
2499
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

tages comparing to the public networks where it improves security

and privacy as well as provides much faster computing time,
cheaper cost, and greater scalability (Larmuseau et al., 2019).
Furthermore, the proposed architecture will enable fog nodes
layer which can augment resource-constrained limitations of IoT
devices by providing high storage and computing capabilities and
networking as well. Besides, fog nodes will provide scalability to
the proposed architecture and carrying out the heavy continuous
authentication-related tasks and communication with the Blockchain
network. As the fog nodes will be deployed near to IoT devices and by
using an ML model, fog computing will provide real-time learning
from IoT devices data more effectively than cloud computing which
causes latency in response time to IoT devices.

3.2. Solution design

The proposed architecture design details consist of the follow-

ing main components: the cloud, fog nodes, Blockchain network,
IoT devices, admin, and end-users. All components have a unique
Ethereum address and connect with the Ethereum smart contract Fig. 1. Overall proposed architecture.
through an EC directly except the IoT devices which interface with
the smart contract indirectly. Fig. 2 shows the block diagram of the module to determine whether continuing access or lockout the
proposed architecture. The key role of the architecture components user from accessing the device. More details will be explained
illustrated as the following: in the solution procedure in Section 3.5.

1. The cloud: store non-real-time data transactions for big data Regarding the selection of the biometric modality, in Al
business logic analysis. The proposed solution considers a Abdulwahid et al. (2015), the author has presented chronological
real-time continuous authentication process where the fog evolution of the selected features that are taken to create an iden-
nodes layer provides localized control response to the IoT tifier for authentication in IoT starting from 2009 to the end of
devices. 2019. The evolution showed the widespread of using humans’
2. Admin user: the admin user maps each IoT device to one fog behavioral data, keystroke dynamics were considered most suit-
node, give permissions through the smart contract to the end- able for continuous behavioral biometric authentication
users to access IoT devices. The owner of the smart contract will (Deutschmann et al., 2013). Also, mobile devices data is used to
be responsible to initiate and deploy it and we assume he/she some extent, specifically touch-screen events. However, humans’
can add multiple admins with management control according physiological data has significant growth in the last few years
to the business requirements. offering robust, unique, and secure identity verification.
3. End-users: request access permission to certain IoT device via The most common physiological biometric modalities are fin-
the smart contract. Then, the user will have access to permis- gerprint, iris, and face (Sundararajan et al., 2019). Selecting the
sion after the authentication process at the responsible fog most effective biometric modality is a prerequisite for maximizing
node. the efficiency of deployment success. Continuous authentication
4. IoT devices: each device belongs to a fog node. Since IoT devices systems should not require the user’s active involvement to
have limited resources, they are unable to run Blockchain. authenticate users continuously (Niinuma and Jain, 2010). Every
Accordingly, the fog nodes layer is enabled as an agent of IoT biometric modality has its strengths and drawbacks as the follow-
devices. ing (Mondal and Bours, 2015):
5. Fog nodes: are directly connected to the Ethereum smart con-
tract and act as an interface between IoT devices and Blockchain
Fingerprint recognition is the most popular physiological
network to relives IoT resource-constrained devices from the modality as it is relatively inexpensive and has a small template
continuous authentication load process. Fog nodes are charac- size that provides fast matching, but it does need a high degree
terized by having high-performance capabilities so that they of user involvement and it is easy to spoof.
will be able to handle multiple simultaneous requests of the
Iris stands out from the others in terms of accuracy and stability
continuous authentication process. The proposed CAB-IoT is throughout our lifetime, but it is relatively expensive and diffi-
similar to (Almadhoun et al., 2019) where they leverage fog cult to perform at a distance larger than the specified distance.
nodes layer to manage accessing IoT devices, but CAB-IoT host Also, in other circumstances, it works by holding an iris scanner
the face recognition ML model where each fog node trains the device or looking into the camera which consequently requires
model and the classification parameters are shared with the active user involvement.
neighbor fog node rather than having a coordinating node
Face modality is more desirable for a continuous authentication
which will affect all the connected fog nodes and make the sys- process, where there is no contact required for facial recogni-
tem vulnerable to risks if it is hacked or manipulated in an tion like there is with the previous modalities, it offers a quick,
unauthorized manner, but in CAB-IoT, it affects only the neigh- automatic, seamless, and user-friendly verification experience.
bor fog node which is relatively easier to handle. The generated As well as it enables to authenticate people in real-time and
face similarity score will be primarily utilized for the continu- from a distant location (Meenakshi, 2013). Accordingly, face
ous authentication process, where the similarity threshold will modality will be used in the proposed solution.
be synced with Blockchain which in turn will immediately
Blockchain network: the proposed CAB-IoT is based on the
detect if the similarity score goes below the threshold. The gen- Ethereum Blockchain, its platform consists of the following
erated comparison result will be the input in the access decision (Zhang et al., 2019):

2500
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Fig. 2. Block diagram of the proposed architecture.

Ethereum accounts: which are controlled accounts and smart tributes strategy to allow the nodes to exchange and update the
contract accounts, both accounts are identified by a 20-bytes parameters, where each node will train the data chunk locally
address. and save the parameters, then exchange the parameters with the

Smart contract: is a program stored inside the Blockchain and next node which will use the received parameter to train the next
function similarly to the real word contracts to reach the pre- data chunk. Then, the ML model will be deployed as a web service
defined goals. It has ABIs to access its functions by sending a in the Azure cloud by using Azure Machine Learning Workspace.
transaction or a message from Ethereum accounts. Regarding the Blockchain network layer, Microsoft has been

Blockchain ledger: every node in the network has a local copy investing a lot into the development of Azure Blockchain service
of the Blockchain. or even the Ethereum network. Azure Blockchain Development
Kit for Ethereum will be used for building the Blockchain network
In the proposed solution, the process at the Blockchain layer and deploying the smart contract on top of it where Azure Block-
divided into three stages which are the following: chain Workbench REST API able to initiates calls to the ledger,
and sending data from the external system to a specific contract
a) Registration stage. hence neither Blockchain nor smart contract can access data from
b) Static authentication stage. outside their network. Besides, Azure Blockchain Development Kit
c) Continuous authentication stage. provides an easily accessible test environment and offers a graph-
ical user-friendly interface for running Ethereum test scenarios and
As shown in Fig. 3, the smart contract receives and responses to exploring the Blockchain network. Moreover, Azure Monitor ser-
requests from the end-user or fog nodes to perform different kinds vice includes a set of performance charts that target several key
of transactions (e.g., registration, static authentication, and contin- KPIs to determine how well the solution is performing at the entire
uous authentication). network level or node level.

3.3. Instruments 3.4. Dataset description

The experimental study will be carried out using the Anaconda The dataset that will be used in this research is the AT&T Data-
platform to pre-process the data and to simulate the face recogni- base of Faces provided by the Olivetti Research Laboratory, Cam-
tion ML model using Python language. The development IDE is bridge, UK (AT&T Laboratories Cambridge, xxxx). It contains
Jupyter Notebook which provides a presentational and interactive 64  64 pixels grayscale face images of 40 people with no class
environment. TensorFlow distribute strategy will be applied to labels and scaled to a common size. Fig. 4 shows a face image for
implement the distributed processing where the nodes will update every 40 distinct people in the dataset.
the model parameters after training the data (Xia et al., 2017). The There are 400 images in the dataset, 10 images for each person
dataset will be sliced into several chunks and TensorFlow dis- in a different direction, under different light conditions, they have
2501
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Fig. 3. The interaction between system nodes and Blockchain.

different facial expressions (e.g., happy, sad, embarrassed, or a) Preprocessing stage: CAB-IoT is going to deal with gray-
angry), and facial details (e.g., wrinkles, eyebrows, or eyeglasses) scale images that are first processed in the face detection
aiming to have variations on those images which add robustness module to separate the face area from the background seg-
of the applied face recognition system as shown in Fig. 5 which ment and detect the size and pose for each image. Then,
shows 10 face images of selected subjects. the face alignment module aims to provide more accurate
localization of the facial components, such as eyes, nose,
3.5. Procedure mouth, and facial outline. Fig. 7 illustrates face detection
and alignment processes.
This section describes the procedure across and within fog b) Recognition stage: will start by extracting useful features
nodes and Blockchain layers. It is divided into two parts, namely: that distinguish between different faces from the aligned
the face recognition model which is held in the fog nodes layer, face which is generated from the preprocessing stage. This
and the authentication which is consists of static authentication stage consists of the following modules:
and continuous authentication.
Feature extraction module: CAB-IoT is going to apply the
eigenface algorithm by using the PCA technique. It is one of
3.5.1. Face recognition model the most important dimensionality reduction technique, where
To reduce the power consumption and achieving a small delay the huge amount of data which is hard to process reduce to a
for the IoT applications, fog computing could apply ML in their smaller amount while keeping as much of information as possi-
operations to utilize the readily available data and computing ble (Jolliffe and Cadima, 2016). PCA is a kind of classical feature
resources (La et al., 2019). CAB-IoT applies ML face recognition extraction and it is an unsupervised learning algorithm widely
model that is working on verification mode to authenticate the applied in computer vision area such as face recognition, it is
user’s identity by matching the claimed identity image against a proven way to improve the accuracy of identifying and verify-
the images that correspond to it in the template database. The pro- ing face-based models in ML (Zhang et al., 2020). The key
cess flow of the face recognition system is shown in Fig. 6. advantages of PCA that make it a suitable selection for face
The whole process divided into pre-processing and recognition recognition system in the IoT environment are the following
stages as the following [160,161]: (Karamizadeh et al., 2013):

Fig. 4. A face image for every 40 distinct people in the dataset.

2502
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Fig. 5. Various face images of selected subjects.

Fig. 6. Face recognition process.

- Reduction of noise since it focuses to find a projection that port vectors (Suthaharan, 2016). Basically, it finds the maxi-
maximizes the total variance of the projected data so the mum margin of the hyperplane which separates the data
small variations in the background are ignored automati- points into classes as shown in Fig. 8.
cally making the process faster and give better accuracy.
- The decreased requirements for computations, time com- One of the critical challenges of the SVM classifier is the neces-
plexity, as well as memory capacity where only the pro- sity of determining the components that relatively determine its
jected trainee images are stored on a reduced basis. performance which is the appropriate kernel function and the
- All principal components are orthogonal to each other, so it value of soft margin parameter C to guarantee high accuracy (Lee
avoids redundant information, which subsequently pro- et al., 2012). Accordingly, to minimize their impact, CAB-IoT is
vides radical data compression thus, allows narrow band- going to apply an enhanced SVM classification approach by replac-
width communication channels to transfer a huge ing the separating hyperplane as the decision-making function
amount of data (Alabi et al., 2015). with Euclidean distance function (Lee et al., 2012). Fig. 9 illustrates

Classification module: CAB-IoT is going to split the dataset into the Euclidean-based approach.
80% for training and 20% for testing which is a common ideal Face images dataset must be pre-processed and converted to a
practice in data science. In the classification module, the numerical format for both training and classification purposes so
extracted feature vector of the input face image is matched they could be mapped into a vector space. Besides, PCA dimension-
against those of enrolled face images in the template database, ality reduction of the data will be applied to decrease the compu-
verifying the face when a match is found with sufficient confi-
dence or as an unknown face otherwise (Arjun et al., 2010).
As shown in the literature review, classification algorithms are
the preferred selection for continuous authentication enforce-
ment, SVM classifier is one of the most used classifiers and
showed the highest accuracy and perform faster prediction
compared to other classifiers. Several researches have been
done on face recognition by SVMs and satisfying results have
been reported (Dadi and Mohan Pillutla, 2016). Moreover, the
SVM classifier has efficient usage of memory where it uses a
subset of the training data in the decision function called sup- Fig. 7. Face detection and alignment processes (Jaha and Ghouti, 2012).

2503
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

tation time of computing as discussed earlier in the feature extrac- to M class problems, where M is the number of individuals.
tion module. Accordingly, CAB-IoT is going to formulate face recognition
During the training phase, training data points will be fit into problems in a different space (Phillips, 1999) as a binary class
the SVM algorithm and mapped into support vectors for each cat- problem instead of the traditional face space approach which
egory, and discard unidentified data points. During the classifica- encodes each facial image as a separate view of a face. The
tion phase (Lee et al., 2012), a new unlabelled data point will be two classes in the different spaces are dissimilarities between
pre-processed and fit into the classification module where the face images of the same user and dissimilarities between face
Euclidean distance function which is illustrated in Eq. (1) is used images of different users. These classes will be the input to
instead of the conventional SVM decision function where pi and the SVM algorithm. Then, the decision surface generated by
qi are the coordinates of P or Q in dimension n SVM will be re-interpret to generate the similarity score
vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
!ffi between two face images which is the basis for verification
u n
u X and identification purposes. To clarify better, as shown in
D¼ t ðpi  qi Þ 2
ð1Þ
Fig. 10, if the similarity score which is the output of the compar-
i¼1
ison function equals the specified threshold or higher, the cap-
The average distance between the new data point and the set tured face image matches the template which means the same
SVs of each of the categories will be calculated to label the data person. Otherwise, the result is non-match.
point with the category whose distance is less.
3.5.2. Authentication

Feature matching module: CAB-IoT is going to apply identity Authenticating a user in the proposed solution is token-access
verification. It is important to note that, SVM is a binary classi- based which is generated by the smart contract. More details will
fier. It is traditionally used to classify a two-class pattern and be described in Section 3.6. While the user’s token which is used
returns the class of the object. While face recognition belongs in the static authentication as one-shot authentication, the charac-
teristic of the continuous monitoring excludes it for this task.
Instead, CAB-IoT is seeking a biometric trait-based approach. In
the continuous authentication system, it is more important to rec-
ognize when an imposter is detected rather than an imposter is
detected (Bours, 2012). For the proposed solution, CAB-IoT focuses
mainly to detect unauthorized access as fast as possible within a
few times as possible.
In data science, anomaly detection is widely applied using var-
ious statistical techniques and ML algorithms. However, in IoT, the
explosion of the generated data over time made this task more
challenging. CAB-IoT introduces a trust module for user continuous
authentication. The access decision of a user is re-evaluated based
on the captured face image of the current user and compare it to
Fig. 8. Illustration of SVM classifier (Suthaharan, 2016). the template of the genuine user. Accordingly, a trust-level value

Fig. 9. Block diagram of the Euclidean-SVM classification approach.

2504
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Fig. 10. Feature matching process.

‘‘TrustLogin‘‘ will be identified ranging from 0.0 (i.e., absolutely no Regarding the continuous authentication in CAB-IoT, the face
trust) to 1.0 (i.e., complete trust) to determine the geniuses of similarity score ‘‘SCface‘‘ transformed into some increment or
the current user, whenever it becomes below the pre-defined decrement to the ”TrustLogin” value during the active sessions.
threshold, the static obtrusive verification must be performed to There are rules used to determine the influence of a face similarity
continue accessing the system. Otherwise, the user will be locked score from a session on the login score. Table 1 defines the points
out from accessing the device. In more detail, the change of to which the function is fit. Table 2 defines the values of confidence
trust-level value ‘‘DTrustLogin” will be calculated continuously function parameters.
which is depends on the face similarity score ‘‘SCface” of the user The resulting fit function is used as ‘‘fmap”, which in this case
that is generated from the face recognition ML model at the fog uses values of face similarity score ‘‘SCface” as shown in Eqs. (4)
nodes layer. Thresholding the similarity score of the user for each and (5).
captured face image during the whole session will increase FAR 8  
< 0:4;
> FAR SC face  1%
and FRR, and subsequently removes a great deal of granularity of 0   
the applied authentication procedure. Accordingly, ‘‘fmap” and f map ¼ f SC face ; 1% < FAR SC face < 20% ð4Þ
>
:  
‘‘fdecrease” functions of the face similarity score will be used to 0:4; FAR SC face  20%
increment or decrement the ‘‘TrustLogin” value.
0 
f SC face ¼ 0:608SC 3face  0:853SC 2face þ 0:648SC face ð5Þ

Computing the Confidence Score ‘‘D TrustLogin”
‘‘fmap” and ‘‘fdecrease” along with the time of the previous session
As mentioned above, if the confidence in the user’s identity ‘‘tprev”, are used to determine the ‘‘TrustLogin” at time ‘‘tses” as
depends on just thresholding the face similarity score, it will result shown in equation
in a large number of false accepts and false rejects which is not pre- Z
  t ses
ferred for authentication. The confidence score should rather TrustLogin ðt ses Þ ¼ TrustLogin t prev þ f decrease dt þ f mapðSC face Þ ð6Þ
change over the time between sessions, where two major functions t prev

will be used to compute it namely: ‘‘fmap” and ‘‘fdecrease” (Crouse

As ‘‘tdelay” gets longer, it becomes more possible that ‘‘fdecrease”
et al., 2015).
will cause the ‘‘TrustLogin‘‘ score to dip below zero between ses-
Function ‘‘fdecrease‘‘ aims to control the system behavior if there
sions. To prevent an imposter from accessing the device for a
is no detected face image. In terms of security, the system is more
longer time from that point to the next session, a future (i.e. at
secure when there are several sessions with no detected face if the
the time ”tfut”) estimate of ‘‘TrustLogin” is calculated using ‘‘tdelay”
device has not been used for a period of time than when the device
and ‘‘tsample” as shown in Eqs. (7) and (8).
is in use even for a few minutes. This function is with one param-
Z
eter ”TLogout‘‘, which specifies the time to log out the user if there is   t fut
TrustLogin t fut ¼ TrustLogin ðtses Þ þ f decrease
no detected face image. t ses
Moreover, function ‘‘fdecrease‘‘ dictates the slope of the
”TrustLogin” value at any given time ‘‘t” based on Eqs. (2) and (3). tfut ¼ tses þ t delay þ t sample ð8Þ
The quadratic portion corresponds to a cubic decline in login con-
fidence. After the legitimate user confirmed his/her identity, the The score at ‘‘tfut” is compared with the login threshold
confidence should decline slowly once there is no detected face ‘‘ThreshouldConfidence” which is adjusted from the legitimate user
image and gets decline faster as more time passes. The slope of template. If the trust value drops below the threshold, means there
‘‘fdecrease” function is bounded at 0.1 per minute to avoid overly is a large deviation between the current user and the legitimate
rapid loss of confidence. The slop of function ‘‘fdecrease” is plotted user, the system will be locked and require obtrusive verification
in Fig. 11. to unlock it. Otherwise, accessing the system will be continuing.
(
 t0:1
2 t 2 ; t < t switch 3.6. Interactions diagrams
f decrease ðt Þ ¼ switch ð2Þ
0:1; t  tswitch
Fig. 12 shows the interactive activities of the registration and
t switch ¼ 1:5  t logout  6 ð3Þ static authentication processes at the Blockchain layer. The defini-
tions of the used notations are presented in Table 3.

2505
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

active activities of this stage occur outside the Blockchain

network (e.g., off-chain interactions) aiming to increase data
throughput as well as reducing transactions latency.

The user will send the ‘‘TokenUser”, the timestamp at which the
token is issued ‘‘T1‘‘, and a random number ‘‘RNUser” encrypted
using the public key of the fog node ‘‘EPK.Fog”.
Once the fog node receives the token, it first checks its fresh-
ness, whether the time between the current time at fog node
‘‘T2” and token issues time is less than the time interval ‘‘DT” that
has been fixed by the admin during the system initialization
Fig. 11. Illustration of function fdecrease (t) mapped for 10 min (Crouse et al., 2015). (T2  T1 < DT). If not, then a ‘‘Reject” message will be emitted to
the user. If yes, the fog node will further check the received mes-
sage by comparing it ‘‘TokenUser|End User” with the one received
a) Registration stage: each node in the proposed architecture before from the Blockchain network ‘‘TokenUser | Blockchain” or else,
will have a unique EA and a key pair where the private key a ‘‘Reject” message will be emitted to the user.
is encrypted and stored locally while the public key is stored If the token ‘‘TokenUser‘‘ is valid, the fog node authenticates the
in the Blockchain ledger. All the registered information will end-user and proceeds as the following:
be used to process the static and continuous authentication
stages. 1. Decrypting the encrypted message ‘‘EPK.Fog (RNUser)” which is
sent from the user with the token, by using the private key of
First, the admin creates and deploys the smart contract, and the fog node ‘‘DPV.Fog” and extract the random number
register other admins if required according to the business ‘‘RNUser*”.
requirements. 2. Sending H (RNUser*, RNFog), EPK.User(RNFog) to the end-user for
Then, the admin maps each device to a fog node through the authenticating itself.
‘‘DeviceFogMapping” function and assigns end users to the device o The end-user decrypts the received message ‘‘EPK.User
that has access to it using the ‘‘UserDeviceMapping” function. (RNFog)” using the private key ‘‘DPV.User” and extract the ran-
dom number ‘‘RNFog*”. Then, compares it with the first part
b) Static authentication stage: An access request to the smart of the message. If matches, the user will reply to the fog
contract will be issued from the end-user using the node with ‘‘RNFog”, or else, a ‘‘Reject” message will be sent
‘‘AccessRequest” function specifying the Ethereum address to the fog node.
of the IoT device and the Ethereum address of the fog node o The fog node will verify it based on the verification result.
in which the device belongs. Then, the smart contract will o Finally, the session key ‘‘H (RNUser, RNFog, UID, EAUser)” can
check the access control list of the IoT devices for that partic- be used to secure the data exchanges between the end-user
ular user; a ‘‘Reject” message will be emitted to the user if and the IoT device.
he/she is not authorized. Otherwise, an acceptance event c) continuous authentication stage: As shown in Fig. 13, if the
will be issued by the smart contract with access ‘‘TokenUser”. user successfully passes the static authentication, the
By definition of the Blockchain, this event will be broadcast ‘‘TrustLogin” value which represents the confidence in the
to all fog nodes of the system. Upon receiving the acceptance user’s identity will be initially set to 1.0 and he/she will be
token, the user will move to the off-chain interaction phase. monitored continuously. Each captured face image during
As the throughput and transaction latency is the main short- the session will be compared with the template of the gen-
comings of Blockchain technology (Jakobs, 2018), the inter- uine user which can be updated when the authorized user
has been obtrusively verified to access the IoT device. In
the simplest form of Blockchain technology, it is a dis-
tributed ledger on which transactions are anonymously
recorded and information on its ledger serves as a tamper-
Table 1 proof source. Accordingly, a pre-defined confidence thresh-
Rules used to determine the influence of a face similarity old ‘‘ThreshouldConfidence”, in this model 0.6 will be adjusted
score on the login score (Crouse et al., 2015). from the genuine user template at the fog nodes layer and
Values of SCface Changes of TrustLogin recorded in the Blockchain ledger, if the ‘‘TrustLogin” value
SCface >= score at 1% FAR 1.0 – TLogout
drops below the threshold, means there is a large deviation
SCface = score at 5% FAR 0.1  (tdelay + tsample) between the current user and the genuine user, the system
SCface = score at 10% FAR 0 will be suspended and require the static authentication to
SCface <= score at 20% FAR -(1.0 – TLogout) continue accessing the device. Otherwise, the device will
be locked.

4. Simulation and results analysis

Table 2
Confidence function param- 4.1. Ethereum platform settings
eters values (Hammi et al.,
2018).
To apply the Ethereum platform in the proposed solution, the
Parameter Value following configurations have been implemented to its
TLogout 10 min components:
TLogin 0.6 s
tsample 10 s Each node is associated with an EA to identify itself during the
tdelay 30 s
authentication process.
2506
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Fig. 12. Sequence diagram of registration and static authentication process.

The Ethereum client is run at all nodes in the architecture requests to the smart contract via transactions and also receiv-
except IoT devices, due to their limited resources. Each ing the results (Githup, xxxx). This configuration was made
enabled-Ethereum client node interacts directly with the Block- specifically to evaluate the energy consumption at the user’s
chain network and sends transactions to run the smart con- IoT device. The specifications of the device are listed in Table 4.
tract’s functions.
Each fog node behaves as an agent to its local IoT devices and
uses their addresses to execute the smart contract on behalf
of them, hence IoT devices do not have Ethereum clients. 4.2. Performance analysis
Geth client which is a command-line interface implemented in
the Go language was installed in the MacBook Pro laptop com- The performance of the proposed solution will be divided into
puter to transfer it into an Ethereum node. Besides, web3.js was the performance of the face recognition ML model and the perfor-
also installed to interact with the geth for sending access mance of the entire authentication procedure.
2507
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Table 3 As shown in Table 5, conventional SVM classifiers with linear

The definition of the used notations.
kernel and RBF kernel have contributed high classification accura-
Notation Definition cies, which are between the range of 95.92% and 99.17%. On the
EADevice Ethereum address of the device. other hand, it performed poorly with polynomial kernel and sig-
EAFog Ethereum address of the fog node. moid kernel with accuracies of 25.00%. This proves the fact that
EAUser Ethereum address of the end-user. the kernel functions greatly affect the accuracy of the SVM.
TokenUser = (UID, EAUser, EADevice, PKUser, T1, DT).
EPK.Fog Encryption using the public key of the fog node.
Regarding the performance of the Euclidean-SVM enhanced
DPK.Fog Decryption using the private key of the fog node. classification approach, the results were ranging from 98.17% to
EPK.User Encryption using the public key of the end-user. 99.83%. Therefore, it is not affected by the implementation of ker-
DPV.User Decryption using the private key of the end-user. nel function and parameter C for achieving good classification
RNUser Random number established by the user.
accuracy. Accordingly, using the Euclidean approach has per-
RNUser* The extracted user’s random number.
RNFog Random number established by the fog node. formed well on face images as in text documents as proved in
RNFog* The extracted fog node’s random number. (Lee et al., 2012).
T1 Timestamp at which the token is issued. Moreover, for both applied classifier approaches, parameter C
T2 Current time at fog node. does not have a significant impact on their accuracies. As illus-
DT Time interval fixed by admin during system initialization.
TokenUser The user token is received from the user.
trated in Table 5, the variance of classification accuracies across
|

End-User
the tested values of parameter C is relatively low. Such a result
TokenUser | The user token received from the Blockchain. can be justified by considering that, the data points in the applied
Blockchain dataset are effectively differentiated which subsequently decreases
H Keccad256 one-way hashing algorithm function which is
the number of the non-separable data points (Lee et al., 2012).
built within the Solidity language. It is the most efficient
function in Ether gas consumption. As for testing accuracy, as shown in Table 5, with Euclidean-
UID User Identification = H (EAUser, EADevice, EAFog). SVM linear function the training results were not improved after
tuning the c parameter and the test score is still 99.97%, but we
can still try improving the training accuracy to ensure that it will
catch more test data if new data were introduced as the dataset
4.2.1. Face recognition model is really small and that may be a bit tricky. Accordingly, polynomial
To evaluate the results of the applied face recognition ML kernel function was applied, and the training score increased com-
model, the following key metrics have been generated pared to a linear function, it improved from 98.75% to 99.83% and
(Biometrics, 2017): the testing accuracy is 99.97%.
Table 6 presents a comparison between the proposed face

Accuracy: is the simplest metric that shows the correctness rate recognition model with related work results that have used the
of the classifier. Table 5 shows the accuracy results of the same dataset and applied PCA for features extraction and SVM
applied classifiers under different parameters. algorithm for classification. The proposed model outperformed

Fig. 13. Sequence diagram of the continuous authentication process.

2508
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Table 4
Specifications of the used user’s IoT device.

Device Name CPU Operating System Memory Hard Disk

MacBook Pro Intel Core i5, 2 GHz macOS sierra 8 GB 256 GB

Table 5
Accuracy results of the face recognition model.

Classification Approach (Kernel) Value of Soft Margin Parameter C Variance of Accuracies

1 10 100 1000 10,000 100,000
SVM (Linear) 96.75% 96.33% 95.92% 95.92% 95.92% 95.92% 0.10012
SVM (Polynomial) 25.00% 25.00% 25.00% 25.00% 25.00% 25.00% 0
SVM (RBF) 99.17% 99.17% 99.17% 99.17% 99.17% 99.17% 0
SVM (Sigmoid) 25.00% 25.00% 25.00% 25.00% 25.00% 25.00% 0
Euclidean-SVM (Linear) 98.75% 98.33% 98.75% 98.17% 98.17% 98.17% 0.06800
Euclidean-SVM (Polynomial) 99.83% 98.33% 98.75% 98.75% 98.75% 98.75% 0.05018
Euclidean-SVM (RBF) 98.33% 98.33% 98.33% 98.33% 98.33% 98.33% 0
Euclidean-SVM (Sigmoid) 98.33% 98.33% 98.33% 98.33% 98.33% 98.33% 0

Table 6 dom imposters face images that were performed besides the
Accuracy comparison between the CAP-IoT face recognition model and the related face images of the genuine user. The time since they logged-in
work results.
until they were logged out was noted. The idle automatic logout
Reference Feature Extractor Classifier Accuracy time according to HIPPA suggestion was set to 10 min (Hippa,
Maw et al. (2019) PCA SVM 91.6% 2020). As shown in Fig. 15, in 97% of genuine user trails, the
Li et al. (2018) Gabor wavelet and SVM 97.00% genuine users kept up access to the device during the entire
PCA trail. Of the remaining trials, the genuine user retained device
Saraswathi and Sivakumari PCA 93.7%
access for at least 5 min.
(2015)
CAB-IoT PCA Euclidean- 99.97%
SVM As indicated in Fig. 16, the impostor had access to the device for
less than 1 min, and the rest had access for less than 1.5 min.
Comparing to the results showed in (Crouse et al., 2015) where
Table 7 this research applied their proposed method in computing the con-
Classification report. fidence score of thresholding face similarity score, this research
Accuracy Precision Recall F1-score results have shown significant reduction regarding imposters
access time. In Crouse et al. (2015), 89% of impostor’s trails had
99.97% 98% 97% 97%
access to the device for less than 1 min, and 11% had access for
more than 2 min which consequently gives them a greater chance
to perform malicious behaviour. Such improvement can be justi-
the others which differ between them by implementing the Eucli-
fied by considering that, unlike (Crouse et al., 2015), CAB-IoT elim-
dean distance function.
inates the need for a separate server for matching and perform all
face recognition ML related tasks in one place. Moreover, Fig. 17

Precision, recall, and f1-score: as shown in Table 7, the model
illustrates how the trust level changes during several sessions with
achieved 98% exactness which represents the performance of
test data of genuine and imposter users. It is clear that the trust
the model in minimizing the number of authorized users that
level dropped below the confidence threshold, which is 0.6 three
are classified as unauthorized, 97% completeness which repre-
times, then the trust value back to the upper limit to 1.0 and a
sents the performance of the model in minimizing the number
new session have been started. This means that an imposter would
of unauthorized users that are classified as authorized, and the
be detected once the trust value drops below the confidence
balance between the two is 97%.
threshold. To mitigate the chance of taking advantage of the sys-

ROC curve: Fig. 14 represents diagrammatically the perfor-
tem by the imposter, the trust level re-set to the upper limit to pre-
mance of classification models. As the AUC gets closely to 1.0,
vent the impostor from taking advantage of the trust that was
the more accurate the results. The AUC score of the model is
constructed up by the legitimate user.
99.54%.

Time evaluation: the average time required for deploying the
4.2.2. Authentication procedure
entire solution is less than one minute and that for executing
To measure the performance of the continuous authentication
the smart contract for static authentication is 0.42 s. Notice that
procedure, the following evaluations were conducted:
CAB-IoT is applied in a real-world private Ethereum which gives
exact time cost as it varies depending on various factors, like the

Confidence evaluation: assuming there are 40 subjects used
hash rate, network architecture, and computing power (Zhang
IoT devices equipped with the proposed solution hence the
et al., 2019).
dataset contains face images of 40 people. In genuine user trails,

Data throughput/overhead: Ethereum Blockchain system
the genuine user used the device for 15 min, while in imposter
depends on gas limit per block to measure data throughput in
trails the genuine user used the device for about a minute, then
its network, where gas is a measurement unit represents the
an imposter gained access to the device. For each session in gen-
required computational work to perform a transaction or a
uine user trails, the trials were performed with all 10 different
smart contract (Borgsten and Jiang, 2018). Setting gas limit
face images of the genuine user, while in imposters trails, ran-
per block aims to protect the Blockchain network’s nodes par-

2509
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Fig. 16. Results of imposters’ trails.

Fig. 14. ROC curve.

Blockchain. Comparing to the results showed in the literature

ticularly miners from losing energy in flawed transactions or reviews with those studies that consider scalability criteria by
malicious attacks. As the average gas price is 21,000 gas, and increasing the number of users as shown in Table 8, and another
the applied limit is 4,712,400 gas/block, a block will contain comparison with those studies that evaluate the network overhead
224 transactions. Taking into account that, private Ethereum’s of their proposed solution without scaling the number of users as
average block time is 14 s (Ozyilmaz and Yurdakul, 2019). shown in Table 9. It is noted that CAB-IoT results were not affected
Therefore, the throughput of the proposed solution is 16 trans- negatively on the resources consumption while using Blockchain
actions per second. technology for the proposed solution and it showed minimal

Resources consumption: the impact of the CAB-IoT solution on resources consumption compared to the results of the related stud-
the CPU and RAM usage of IoT devices have been explored by ies, except for energy consumption where CAB-IoT consumes 8%
conducting two experiments while considering scalability fea- from the battery during active continuous authentication whiten
ture as the following: 15 min similarly to reference [1 5 6] but at the same time it is

Resources consumption while increasing the number of events within an acceptable range.
belonging to a genuine user.

Resources consumption while increasing the number of users. 4.3. Security analysis

In the first experiment, the number of events belonging to a
Confidentiality: integrating Blockchain in the proposed solu-
genuine user increased from 1 event to 10 events. As shown in tion allows us to assign a unique EA to every participated node
Fig. 18, RAM usage increased linearly and reached 1 MB. Such with almost no collision which is a powerful feature of Block-
behaviour can be justified by considering that as the number of chain (Dannen, 2017), which relieves the use of the traditional
events increased, the needed data structure to store the template expensive PKI for key distribution. EA comes with asymmetric
of the user became wider. Therefore, memory consumptions repre- public key pairs which makes it possible to ensure the confiden-
sent a linear increasing trend. On the contrary, the results did not tiality and authentication of the message at the same time,
show CPU-demanding, it remained constant at 2%. In the second which can be subsequently used for session key exchange and
experiment, the number of users increased from 1 user to 40 users, establishing secure SSL sessions.
and one face image for each user. As depicted in Fig. 19, the RAM
Integrity and non-repudiation: the proposed authentication
consumption remained at 4 MB. On the other side, the CPU usage process supports two-way authentication between the end-
increased exponentially and reached 16%, such behaviour can be user and the fog node to prove their legitimacy to each other,
justified by considering that as the number of users increased, where fog nodes use the tokens to authenticate a user while
the system requires more cycles to process the authentication the end-user verifies the fog node using randomly generated
process. unique numbers, this feature is the main contribution added
The results of both experiments demonstrate the minimal ben- to similar work in reference (Almadhoun et al., 2019). Table 10
efit of the resources and the applicability of the proposed solution illustrates the main improvements of the CAB-IoT. It is noted
in smart environments, such as smart home or smart office. Such that fog nodes layer has been utilized in both solutions, but
results can be justified by considering that the fog nodes layer CAB-IoT applied the distribution strategy instead of relying on
has the power to provide high resource capabilities for IoT devices, one coordinating node which subsequently overcomes a single
as well as scalability features to the proposed solution, and aug-
ment the heavy continuous authentication-related tasks of the

Fig. 15. Results of genuine users’ trails. Fig. 17. Illustration of changing the trust level.

2510
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

point of failure problem. Besides, CAB-IoT hosted a biometric The user computes ‘‘RNFog from imposter and sends back ‘‘H
recognition model including the real-time use of ML for contin- (RNFog from imposter)” to the fog node. The verification of ‘‘H
uous authentication purposes. (RNFog from imposter)” will fail, which explains that an attacker

Availability: the proposed distributed solution utilizes Block- cannot launch a MITM attack in the proposed architecture.
chain technology to provide secure authentication and access Moreover, the timestamp values ensure that an imposter can
to IoT devices in a decentralized manner without an intermedi- never forward an already sent message to impersonate the
ary or a trusted third party. Therefore, it provides high trust and legitimate user. Besides, a nonce value which is the UID in
availability and eliminates several issues including a single the proposed solution prevent these attacks where even if the
point of failure and scalability. attacker replaced the user EA with his/her EA and public key,

Achieving these security requirements makes the proposed the attacker will not be able to correctly sign it and it will fail
solution secure against the following attacks: at the verification stage at the fog node.

MITM and replay attacks: the proposed architecture secured
DoS and DDoS attacks: the distributed characteristic of the
against these attacks as the exchange messages within the Blockchain technology makes the proposed solution resilient
authentication processes are cryptographically signed using a against DoS and DDoS attacks. More specifically, the Blockchain
hash function algorithm and random numbers technique. In this enables IoT network to work in P2P, trustless, and with no need
context, the so-called cryptographic hashing functions are fun- for a centralized node to trust each other which subsequently
damentally important, the nature of the Blockchain technology removes a single point of failure (Almadhoun et al., 2019).
relies heavily on cryptography to achieve data security (Bashir
Sybil attack: according to the principle of Blockchain, each reg-
and Blockchain, 2017). If an imposter tries to replicate the istered node has a unique EA and one key pair (Khan and Salah,
access request of the legitimate user to the fog node ‘‘TokenUser; 2018), hence it is difficult for an attacker to create multiple fake
T1, EPK.Fog [RNUser]” by replacing the user EA with imposter EA. identities. Besides, Blockchain use raising the cost strategy for
The fog node will reply with two sets of messages, one for the creating a new identity which subsequently requires a signifi-
legitimate user: ‘‘H (RNUser*, RNFog), EPK.User(RNFog)” and the cant cost to add a large number of pseudonymous fake nodes
other for the imposter node ‘‘ H (RNUser*, RNFog from imposter), (Turesson et al., 2019).
Efrom imposter
PK.User (RNFog from imposter) ”. Then, the attacker blocks the
message meant for the end-user and sends ‘‘H (RNUser*, RNFog 5. Conclusion
from imposter
), Efrom imposter
PK.User (RNFog from imposter)” to the end-user.
We have proposed a blockchain-based continuous authentica-
tion solution for an IoT environment called CAB-IoT. The main find-
ings of the proposed solution are the following:

CAB-IoT presented an accurate face recognition ML model with

a 99.97% accuracy percentage. It found that the Euclidean-SVM
enhanced classification approach performed better than the
conventional classifier during classification and it showed low
effect by kernel function and parameter C.

It is computationally saved when the proposed solution applied
the PCA feature extraction technique on the face recognition ML
model. It makes the process faster by narrowing the bandwidth
communication channel to transfer a huge amount of data and
Fig. 18. CPU-RAM usage of a user. stored them on a reduced basis which subsequently decreased
the storage requirement.

By principle, IoT devices are power sensitive, the use of contin-
uous authentication and Blockchain technology will cause
resources drain, which seems to be a not practical way. The
fog nodes layer gets rid of the resources limitation problem by
handling the frequent communication with Blockchain instead
of them. Moreover, the proposed solution demonstrates a low
impact on the bandwidth where there is a limited overhead;
it reached 16 transactions per second.

The applied method in thresholding face similarity score
showed a great impact on the confidence level, 97% of genuine
users kept up access to the device during the entire trail and
the remaining kept up access for at least 5 min. Regarding
the imposter’s trails, the majority detected in less than
1 min, and only 4% of imposters had access for less than
Fig. 19. CPU-RAM usage of multiple users. 1.5 min.

Table 8
Comparison of resource consumption based on scalability criteria.

Reference Number of users CPU consumption Memory consumption Static authentication time
Nespoli et al. (2019) 30 13% 8 MB 0.5 s
Centeno et al. (2018) – – 1 MB 1s
CAB-IoT 40 16% 4 MB 0.42 s

2511
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Table 9
Comparison of resource consumption.

Reference Network overhead

Energy consumption CPU consumption Memory consumption Authentication time
Banafa (2017) 5.4% – – 5s
Acar et al. (2018) – – – 20 s
Feng et al. (2017) 6.3% – – 1s
Lee and Lee (2017) 2.4% 35% 3 MB 5s
Mosenia et al. (2017) – – – 37 ms
Lin et al. (2017) – – – 4s
Fridman et al. (2017) – – – 1m
Shen et al. (2015) – – 5 MB 0.5 s
Sitova (2016) – – – 3.56 s
Temper et al. (2017) 8% – – –
CAB-IoT 8% 2% 1 MB 0.42 s

Table 10
Comparison of Blockchain-enabled fog nods solutions.

Reference Two-way authentication Continuous authentication Machine learning Fog nodes layer
p
Almadhoun et al. (2019) x x x (Single Coordinating Node)
p p p p
CAB-IoT (Distributed Strategy)

The proposed mutual authentication between the end-user and oratory, Cambridge, UK, AT&T Laboratories Cambridge, (www.cl.-
the fog node enables for session key exchange and establishing cam.ac.uk/research/dtg/attractive/face database.html).
a secure SSL session for secured communication.

Declaration of Competing Interest

5.1. Limitations
The authors declare that they have no known competing finan-
The limitations that were found in the proposed solution and cial interests or personal relationships that could have appeared
how such limitations can be overcome are the following: to influence the work reported in this paper.

As the level of security is the main challenge, CAB-IoT has lim-

itans in conducting extensive experiments to measure the References
robustness of the proposed solution against various attacks.
Acar, A., Aksu, H., Uluagac, A.S., Akkaya, K., 2018. ‘‘WACA: Wearable-assisted
We recommend performing threats modelling and report the continuous authentication”, in. IEEE Security and Privacy Workshops (SPW)
accuracy of the proposed solution against different adversarial 2018, 264–269.
situations which include random, targeted, and engineered Aceto, G., Persico, V., Pescapé, A., 2020. Industry 4.0 and health: Internet of things,
big data, and cloud computing for healthcare 4.0. J. Ind. Inf. Integr. 18, 100129.
attacks.
Agrawal, R. et al., 2018. Continuous security in IoT using Blockchain. In: in 2018 IEEE

The concern of the CAB-IoT solution is to provide a real-time International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp.
continuous user-to-device authentication. As the solution 6423–6427.
depends on the user’s face identity and although the imple- A. Al Abdulwahid, N. Clarke, I. Stengel, S. Furnell, and C. Reich, ‘‘A survey of
continuous and transparent multibiometric authentication systems,” 2015..
mented private Ethereum network provides privacy, criminals Al Salami, S., Baek, J., Salah, K., Damiani, E., 2016. Lightweight Encryption for Smart
can use a variety of methods to manipulate users’ identities. Home. In: in 2016 11th International Conference on Availability, Reliability and
Therefore, we recommend providing a method to protect users’ Security (ARES), pp. 382–388. https://doi.org/10.1109/ARES.2016.40.
A. A. Alabi, A. A., Akanbi, L. A., & Ibrahim, ‘‘Performance Evaluation of the Eigenface
identities and secure their private information. Algorithm on Plain-Feature Images in Comparison with Those of Distinct
Features,” Am. J. Signal Process., vol. 5, no. 2, pp. 32–39, 2015..
R. Almadhoun, M. Kadadha, M. Alhemeiri, M. Alshehhi, and K. Salah, ‘‘A User
5.2. Future work
Authentication Scheme of IoT Devices using Blockchain-Enabled Fog Nodes,”
2019, doi:10.1109/AICCSA.2018.8612856..
In future work, we intend to extend our solution to give more Anthony Heston, ETHEREUM: HOW TO SAFELY CREATE STABLE AND LONG-TERM
PASSIVE INCOME BY INVESTING IN ETHEREUM, First edit. 2019..
generalizations of the proposed solution. We are going to track
V. K. Arjun, V. M., MANZA, R. R., & Karbhari, ‘‘Human face recognition using superior
users’ faces using Arduino and Python and make the webcam fol- principal component analysis (SPCA),” Int. J. Comput. Theory Eng., vol. 2, no. 5,
low users’ faces, which means the solution is not customized to p. 688, 2010..
the data that we used. Moreover, we intend to evaluate our solu- Y. Ashibani, D. Kauling, and Q. Mahmoud, ‘‘Design and Implementation of a
Contextual-Based Continuous Authentication Framework for Smart Homes,”
tion in terms of multiple performances related measures, including Appl. Syst. Innov., 2019, doi: 10.3390/asi2010004..
deployment issues on smartphone devices. AT&T Laboratories Cambridge, ‘‘The database of faces.” www.cl.cam.ac.uk/research/
dtg/attarchive/face database.html..
Banafa, A., 2017. Three Major Challenges Facing IoT. IEEE IoT Newsl..
6. Data availability I. Bashir, Mastering Blockchain. 2017..
Biometrics, P., 2017. ‘‘Understanding biometric performance evaluation. Teknik
Rapor”..
The dataset that is used to support the findings of this study is E. Borgsten and O. Jiang, ‘‘Authentication using Smart Contracts in a Blockchain.”
the AT&T Database of Faces provided by the Olivetti Research Lab- 2018..

2512
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Bours, P., 2012. Continuous keystroke dynamics: A different perspective towards document categorization. Appl. Intell.. https://doi.org/10.1007/s10489-011-
biometric evaluation. Inf. Secur. Tech. Rep.. https://doi.org/10.1016/j. 0314-z.
istr.2012.02.001. Li, M., Yu, X., Ryu, K.H., Lee, S., Theera-Umpon, N., 2018. Face recognition technology
J. D. Brown, W. Pase, C. McKenzie, M. Salmanian, and H. Tang, ‘‘A prototype development with Gabor, PCA and SVM methodology under illumination
implementation of continuous authentication for tactical applications,” 2017, normalization condition. Cluster Comput.. https://doi.org/10.1007/s10586-017-
doi: 10.1007/978-3-319-51204-4_28.. 0806-7.
Camara, C., Peris-Lopez, P., Gonzalez-Manzano, L., Tapiador, J., 2018. Real-time F. Lin, C. Song, Y. Zhuang, W. Xu, C. Li, and K. Ren, ‘‘Cardiac scan: A non-contact and
electrocardiogram streams for continuous authentication. Appl. Soft Comput. continuous heart-based user authentication system,” 2017, doi: 10.1145/
68, 784–794. https://doi.org/10.1016/j.asoc.2017.07.032. 3117811.3117839..
M. P. Centeno, Y. Guan, and A. van Moorsel, ‘‘Mobile based continuous Lu, Y., 2018. Blockchain and the related issues: A review of current research topics. J.
authentication using deep features,” 2018, doi: 10.1145/3212725.3212732.. Manage. Anal. 5 (4), 231–255. https://doi.org/10.1080/23270012.2018.1516523.
J. Chauhan, H. J. Asghar, A. Mahanti, and M. A. Kaafar, ‘‘Gesture-based continuous Matsuyama, Y., Shozawa, M., Yokote, R., 2015. Brain signal‫׳‬s low-frequency fits the
authentication for wearable devices: The smart glasses use case,” 2016, doi: continuous authentication. Neurocomputing 164, 137–143. https://doi.org/
10.1007/978-3-319-39555-5_35.. 10.1016/j.neucom.2014.08.084.
D. Crouse, H. Han, D. Chandra, B. Barbello, and A. K. Jain, ‘‘Continuous authentication Maw, H.M., Thu, S.M., Mon, M.T., 2019. ‘‘Face Recognition based on Illumination
of mobile user: Fusion of face image and inertial Measurement Unit data,” 2015, Invariant Techniques Model”, in. Int. Conf. Adv. Inf. Technol. (ICAIT) 2019, 120–
doi: 10.1109/ICB.2015.7139043.. 125.
Dadi, H.S., Mohan Pillutla, G.K., 2016. Improved face recognition rate using HOG Meenakshi, M., 2013. Real-time facial recognition system – design, implementation
Features and SVM Classifier. IOSR J. Electron. Commun. Eng.. https://doi.org/ and validation. J. Signal Process. Theory Appl.. https://doi.org/10.7726/
10.9790/2834-1104013444. jspta.2013.1001.
Dannen, C., 2017. Introducing Ethereum and Solidity.. S. Mondal and P. Bours, ‘‘Continuous Authentication in a real world settings,” 2015,
Deutschmann, I., Nordstrom, P., Nilsson, L., 2013. Continuous Authentication Using doi: 10.1109/ICAPR.2015.7050673..
Behavioral Biometrics. IT Prof. 15 (4), 12–15. https://doi.org/10.1109/ Mosenia, A., Sur-Kolay, S., Raghunathan, A., Jha, N.K., 2017. CABA: Continuous
MITP.2013.50. Authentication Based on BioAura. IEEE Trans. Comput. 66 (5), 759–772. https://
El Kafhali, S., Salah, K., 2017. Stochastic modelling and analysis of cloud computing doi.org/10.1109/TC.2016.2622262.
data center. In: in 2017 20th Conference on Innovations in Clouds, Internet and Mukherjee, T., 2017. An Approach to Software Development for Continuous
Networks (ICIN), pp. 122–126. https://doi.org/10.1109/ICIN.2017.7899401. Authentication of Smart Wearable Device Users. Arizona State University.
M. El-Hajj, A. Fadlallah, M. Chamoun, and A. Serhrouchni, ‘‘A survey of internet of P. Nespoli, M. Zago, A. H. Celdrán, M. G. Pérez, F. G. Mármol, and F. J. G. Clemente,
things (IoT) authentication schemes,” Sensors (Switzerland), 2019, doi: ‘‘PALOT: Profiling and authenticating users leveraging internet of things,”
10.3390/s19051141.. Sensors (Switzerland), 2019, doi: 10.3390/s19122832..
H. Feng, K. Fawaz, and K. G. Shin, ‘‘Continuous authentication for voice assistants,” K. Niinuma and A. K. Jain, ‘‘Continuous user authentication using temporal
2017, doi: 10.1145/3117811.3117823.. information,” 2010, doi: 10.1117/12.847886..
N. Fotiou, I. Pittaras, V. A. Siris, S. Voulgaris, and G. C. Polyzos, ‘‘Secure IoT access at Nikouei, S.Y., Xu, R., Nagothu, D., Chen, Y., Aved, A., Blasch, E., 2019. ‘‘Real-Time
scale using blockchains and smart contracts,” 2019, doi: 10.1109/ Index Authentication for Event-Oriented Surveillance Video Query using.
WoWMoM.2019.8793047.. Blockchain”. https://doi.org/10.1109/ISC2.2018.8656668.
Fridman, L., Weber, S., Greenstadt, R., Kam, M., 2017. Active authentication on Ozyilmaz, K.R., Yurdakul, A., 2019. Designing a Blockchain-Based IoT With
mobile devices via stylometry, application usage, web browsing, and GPS Ethereum, Swarm, and LoRa: The software solution to create high availability
Location. IEEE Syst. J.. https://doi.org/10.1109/JSYST.2015.2472579. with minimal security risks. IEEE Consumer Electron. Mag. 8 (2), 28–34. https://
githup, ‘‘Geth Client for Building Private Blockchain Networks.”. doi.org/10.1109/MCE.2018.2880806.
Gonzalez-Manzano, L., Fuentes, J.M.D., Ribagorda, A., 2019. Leveraging user-related D. T. Phan, N. N. T. Dam, M. P. Nguyen, M. T. Tran, and T. T. Truong, ‘‘Smart kiosk
internet of things for continuous authentication: A Survey. ACM Comput. Surv. with gait-based continuous authentication,” 2015, doi: 10.1007/978-3-319-
52 (3), 1–38. https://doi.org/10.1145/3314023. 20804-6_18..
Hammi, M.T., Hammi, B., Bellot, P., Serhrouchni, A., 2018. Bubbles of Trust: A P. J. Phillips, ‘‘Support vector machines applied to face recognition,” 1999..
decentralized blockchain-based authentication system for IoT. Comput. Salah, K., 2013. ‘‘A Queueing Model to Achieve Proper Elasticity for Cloud Cluster
Security 78, 126–142. https://doi.org/10.1016/j.cose.2018.06.004. Jobs”, in. IEEE Sixth Int. Conf. Cloud Comput. 2013, 755–761. https://doi.org/
T. Hardjono and N. Smith, ‘‘Cloud-based commissioning of constrained devices 10.1109/CLOUD.2013.20.
using permissioned blockchains,” 2016, doi: 10.1145/2899007.2899012.. Salah, K., Nizamuddin, N., Jayaraman, R., Omar, M., 2019. Blockchain-based soybean
Hippa, ‘‘Security Rule.” https://www.hhs.gov/hipaa/for-professionals/faq/security- traceability in agricultural supply chain. IEEE Access 7, 73295–73305. https://
rule/index.html (accessed Feb. 01, 2020).. doi.org/10.1109/ACCESS.2019.2918000.
S. Huh, S. Cho, and S. Kim, ‘‘Managing IoT devices using blockchain platform,” 2017, Saraswathi, M., Sivakumari, D.S., 2015. ‘‘Evaluation of PCA and LDA techniques for
doi: 10.23919/ICACT.2017.7890132.. Face recognition using ORL face database”, IJCSIT). Int. J. Comput. Sci. Inf.
Jaha, E.S., Ghouti, L., 2012. ‘‘Color face recognition using quaternion. PCA”. https:// Technol. 1, 810–813p.
doi.org/10.1049/ic.2011.0109. H. Shafagh, L. Burkhalter, A. Hithnawi, and S. Duquennoy, ‘‘Towards blockchain-
Jakobs, K., 2018. Corporate and global standardization initiatives in contemporary based auditable storage and sharing of iot data,” 2017, doi: 10.1145/
society. IGI Global. 3140649.3140656..
Jolliffe, I.T., Cadima, J., 2016. Principal component analysis: A review and recent C. Shen, Y. Zhang, Z. Cai, T. Yu, and X. Guan, ‘‘Touch-interaction behavior for
developments. Phil. Trans. R. Soc. A. 374 (2065), 20150202. https://doi.org/ continuous user authentication on smartphones,” 2015, doi: 10.1109/
10.1098/rsta.2015.0202. ICB.2015.7139046..
Karamizadeh, S., Abdullah, S.M., Manaf, A.A., Zamani, M., Hooman, A., 2013. An Sitova, Z. et al., 2016. HMOG: New behavioral biometric features for continuous
overview of principal component analysis. JSIP 04 (03), 173–175. https://doi. authentication of smartphone users. IEEE Trans. Inf. Forensics Secur.. https://
org/10.4236/jsip.2013.43B031. doi.org/10.1109/TIFS.2015.2506542.
Khalid, U., Asim, M., Baker, T., Hung, P.C.K., Tariq, M.A., Rafferty, L., 2020. A Sundararajan, A., Sarwat, A.I., Pons, A., 2019. A survey on modality characteristics,
decentralized lightweight blockchain-based authentication mechanism for IoT performance evaluation metrics, and security for traditional and wearable
systems. Cluster Comput 23 (3), 2067–2087. https://doi.org/10.1007/s10586- biometric systems. ACM Comput. Surv. 52 (2), 1–36. https://doi.org/10.1145/
020-03058-6. 3309550.
Khan, M.A., Jamali, M.M., Maksymyuk, T., Gazda, J., 2020. A blockchain token-based Suthaharan, S., 2016. Machine learning models and algorithms for big data
trading model for secondary spectrum markets in future generation mobile classification. Integr. Ser. Inf. Syst 36, 1–12.
networks. Wireless Commun. Mobile Comput. 2020, 1–12. https://doi.org/ Temper, M., Tjoa, S., Kaiser, M., 2017. ‘‘Touch to Authenticate -. Continuous
10.1155/2020/7975393. Biometric Authentication on Mobile Devices”. https://doi.org/10.1109/
Khan, M.A., Salah, K., 2018. IoT security: Review, blockchain solutions, and open ICSSA.2015.016.
challenges. Futur. Gener. Comput. Syst.. https://doi.org/10.1016/ H. Turesson, A. Roatis, M. Laskowski, and H. Kim, ‘‘Privacy-preserving blockchain
j.future.2017.11.022. mining: Sybil-resistance by proof-of-useful-work,” arXiv Prepr.
La, Q.D., Ngo, M.V., Dinh, T.Q., Quek, T.Q.S., Shin, H., 2019. Enabling intelligence in arXiv1907.08744, 2019..
fog computing to achieve energy and latency reduction. Digital Commun. T. Van Hamme, D. Preuveneers, and W. Joosen, ‘‘Improving resilience of
Networks 5 (1), 3–9. https://doi.org/10.1016/j.dcan.2018.10.008. behaviometric based continuous authentication with multiple
Larmuseau, A., Shila, D.M., 2019. In: Blockchain for Distributed Systems Security. accelerometers,” 2017, doi: 10.1007/978-3-319-61176-1_26..
Wiley, pp. 253–274. https://doi.org/10.1002/9781119519621.ch12. Viriyasitavat, W., Xu, L.D., Bi, Z., Hoonsopon, D., 2019. Blockchain technology for
Lee, W.H., Lee, R.B., 2017. ‘‘Implicit Smartphone User Authentication with Sensors applications in internet of things – Mapping from system design perspective.
and. Contextual Machine Learning”. https://doi.org/10.1109/DSN.2017.24. IEEE Int. Things J. 6 (5), 8155–8168. https://doi.org/10.1109/JIOT.2019.2925825.
Lee, L.H., Wan, C.H., Rajkumar, R., Isa, D., 2012. An enhanced Support Vector Wu, L., Du, X., Wang, W., Lin, B., 2018. ‘‘An Out-of-band Authentication Scheme for
Machine classification framework by using Euclidean distance function for text Internet of. Things Using Blockchain Technology”. https://doi.org/10.1109/
ICCNC.2018.8390280.

2513
F. Hussain Al-Naji and R. Zagrouba Journal of King Saud University – Computer and Information Sciences 34 (2022) 2497–2514

Xia, X.-L., Xu, C., Nan, B., Long, L., Li, Y., Li, X., Dai, Y., Yang, H., 2017. Facial expression Zhang, C., Chen, Y., 2020. A review of research relevant to the emerging industry
recognition based on tensorflow platform. ITM Web Conf. 12, 01005. https:// trends: Industry 4.0, IoT, blockchain, and business analytics. J. Ind. Intg. Mgmt.
doi.org/10.1051/itmconf/20171201005. 05 (01), 165–180. https://doi.org/10.1142/S2424862219500192.
Xu, Q., Aung, K.M.M., Zhu, Y., Yong, K.L., 2018. ‘‘A blockchain-based storage system Zhang, Y., Kasahara, S., Shen, Y., Jiang, X., Wan, J., 2019. Smart contract-based access
for data analytics in the internet of things”, in Studies. Comput. Intell.. control for the internet of things. IEEE Int. Things J. 6 (2), 1594–1605. https://
Xu, L.D., Viriyasitavat, W., 2019. Application of blockchain in collaborative internet- doi.org/10.1109/JIOT.2018.2847705.
of-things services. IEEE Trans. Comput. Soc. Syst. 6 (6), 1295–1305. https://doi. Zhang, Y., Xiao, X., Yang, L.-X., Xiang, Y., Zhong, S., 2020. Secure and efficient
org/10.1109/TCSS.2019.2913165. outsourcing of PCA-based face recognition. IEEE Trans. Inform. Forensic Secur.
Xu, L.D., He, W.u., Li, S., 2014. Internet of Things in Industries: A Survey. IEEE Trans. 15, 1683–1695. https://doi.org/10.1109/TIFS.2019.2947872.
Ind. Inf. 10 (4), 2233–2243. https://doi.org/10.1109/TII.2014.2300753.

2514