Algorithm 1 YB-IoT-CG Layered Access Decision
Require: IoT message $M_i=(d_i,{\tau }_i,n_i,t_i,p_i,{\sigma }_i)$; ${\mathsf{fw}}_i$, ${\mathsf{ctx}}_i$
Require: $0\le {\theta }_{\mathrm{risk}}<{\theta }_{\mathrm{revoke}}\le 1$; revocation cache ${\mathcal{R}}_{\mathrm{cache}}$
1: if ¬WellFormed$\left(M_i\right)$ then
2:       CommitAudit$(H\left(M_i\right),1,\mathsf{Challenge},\mathsf{Malformed})$
3:       return $\mathsf{Challenge}$
4: end if
5: ${\kappa }_i\leftarrow H\left(\mathsf{DID}\left(d_i\right)\right)$
6: if  ${\kappa }_i\in {\mathcal{R}}_{\mathrm{cache}}$ then
7:        CommitAudit$(H\left(M_i\right),1,\mathsf{Revoke},\mathsf{OnChainRevoked})$
8:        return $\mathsf{Revoke}$	▹ recognize existing revocation; do not create a new one
9: end if
10: if  ¬VerifyBaseAuth$\left(M_i\right)$ then
11:        CommitAudit$(H\left(M_i\right),1,\mathsf{Challenge},\mathsf{InvalidBaseAuth})$
12:        return $\mathsf{Challenge}$	▹ unauthenticated traffic cannot update risk or enqueue revocation
13: end if
14: $C_i\leftarrow (d_i,{\tau }_i,n_i,t_i,H\left(p_i\right),{\mathsf{fw}}_i,{\mathsf{ctx}}_i)$; $h_i\leftarrow H\left({\mathrm{enc}}_C\left(C_i\right)\right)$
15: $(a_i,b_i,c_i)\leftarrow {\rho }_q\left(h_i\right)$
16: $L\leftarrow r_{12}{r}_{23}{r}_{12}(a_i,b_i,c_i)$
17: $R^{\mathrm{YB}}\leftarrow r_{23}{r}_{12}{r}_{23}(a_i,b_i,c_i)$
18: if  $L\ne R^{\mathrm{YB}}$ then
19:        $e_i\leftarrow H(h_i \Vert L \Vert R^{\mathrm{YB}} \Vert \mathsf{YBE}\_\mathsf{Mismatch})$
20:        CommitAudit$(h_i,1,\mathsf{Challenge},e_i)$
21:        RecordAuthenticatedNonce$(d_i,n_i,t_i)$
22:        return $\mathsf{Challenge}$
23: end if
24: Sfresh ← FreshnessScore$(n_i,t_i,d_i)$ using Equation (19)
25: Schain ← TMTOProximity$(h_i,d_i)$ using Equation (16)
26: Sctx ← ContextScore$(d_i,{\mathsf{ctx}}_i)$ using Equation (20)
27: $R_i\leftarrow \alpha s_{\mathrm{chain}}+\beta s_{\mathrm{fresh}}+\gamma s_{\mathrm{ctx}}$
28: Di ← ContextDECISION$(d_i,R_i,{\mathsf{ctx}}_i)$	▹ Algorithm 3
29: if  $D_i=\mathsf{Revoke}$ then
30:        if $R_i\ge {\theta }_{\mathrm{revoke}}$ then
31:              $e_i\leftarrow H(h_i \Vert R_i \Vert \mathsf{CorroboratedRisk})$
32:              CommitAudit$(h_i,R_i,\mathsf{Revoke},e_i)$
33:              QueueRevocation$({\kappa }_i,e_i)$
34:              RecordAuthenticatedNonce$(d_i,n_i,t_i)$
35:              return $\mathsf{Revoke}$
36:        else
37:              CommitAudit$(h_i,R_i,\mathsf{Challenge},\mathsf{CorroborationBelowThreshold})$
38:              RecordAuthenticatedNonce$(d_i,n_i,t_i)$
39:              return $\mathsf{Challenge}$
40:        end if
41: else if  $R_i\ge {\theta }_{\mathrm{risk}}$ or  $D_i=\mathsf{Challenge}$ then
42:        CommitAudit$(h_i,R_i,\mathsf{Challenge},\mathsf{PolicyRisk})$
43:        RecordAuthenticatedNonce$(d_i,n_i,t_i)$
44:        return $\mathsf{Challenge}$
45: end if
46: CommitAudit  $(h_i,R_i,\mathsf{Accept},\mathsf{OK})$
47: RecordAuthenticatedNonce  $(d_i,n_i,t_i)$
48: ${\theta }_{\mathrm{risk}}\leftarrow BoundedEWMA({\theta }_{\mathrm{risk}},R_i,\lambda ,\eta ,{\theta }_{\min },{\theta }_{\max })$	▹ Algorithm 2; accepted traffic only
49: return $\mathsf{Accept}$