Privacy-Preserving Identity-Based Undeniable Signatures from Lattices with Controlled Verifiability for IoT Networks

Abstract

The Internet of Things (IoT) network plays an important role in production and people’s daily life. IoT networks generally face security problems of privacy leakage and message denial. To protect the privacy of IoT data and users, this paper first introduces a controlled verification model for IoT networks and then proposes an identity-based undeniable signature (ID-US) scheme. This controlled verification model establishes a secure IoT data-sharing channel with blockchain technology, which reduces data tampering and inconsistency. This ID-US scheme is constructed with lattice cryptography, which can provide strong resistance to quantum attacks. Meanwhile, the undeniable and identity mechanisms ensure that the signed message cannot be denied. Next, the security proof in the random oracle model shows that this ID-US can achieve soundness and unforgeability. The Scyther test results show that there are no attacks by verifying 11 points of attacks from the perspectives of the KGC, signer, and verifier. Moreover, the efficiency analysis and performance analysis of the key size, time consumption, energy consumption, and transaction latency have been performed, and the results show that the ID-US scheme is more efficient than similar schemes in the recently published literature, and the controlled verification model can protect IoT data privacy and support secure IoT data sharing with the undeniable property.

1. Introduction

The rapid proliferation of the IoT network has reshaped the way physical devices, sensing systems, and back-end cloud services interact, giving rise to large-scale, heterogeneous networks that span smart homes, industrial control systems, vehicular ad hoc networks, healthcare monitoring, and smart-city infrastructures [1]. Recent industry estimates project the number of deployed IoT endpoints to exceed 29 billion by 2030, and the data generated by these devices is increasingly mission-critical: it drives automated decision-making, machine-learning analytics, and even safety-relevant control loops [2]. Consequently, ensuring the confidentiality, integrity, authenticity, and non-repudiation of IoT data has become a first-order concern for both academia and industry.

At the same time, the open and pervasive nature of IoT deployments creates an unprecedented attack surface. Adversaries may eavesdrop on wireless channels, impersonate legitimate nodes, inject forged sensing data, or repudiate previously issued commands. Traditional security mechanisms, in particular public-key digital signatures, are therefore widely recognized as a fundamental building block of IoT security [3]. A valid signature attached to a message can be checked by any verifier and serves as cryptographic evidence that the message originated from the claimed sender and has not been altered in transit, providing the integrity and non-repudiation properties required for many IoT applications [4], including firmware updates, over-the-air software provisioning, and cross-domain data exchange. However, classical signature schemes do not, by themselves, guarantee privacy. In conventional public-key infrastructures (PKI), a signature is a publicly verifiable object: anyone holding the signer’s public key can verify it at any time, without the signer’s consent. While this is desirable in open systems, it has serious consequences in privacy-sensitive IoT scenarios. Consider a wearable health monitor that periodically signs a patient’s heart rate and transmits the signed report to a hospital cloud. Under a standard signature scheme, any party that intercepts the signed report can verify its origin, link all reports produced by the same device, and thereby profile the patient’s daily activities, location patterns, and medical conditions. Similarly, in smart metering, vehicular networks, and location-based services, signed messages can be exploited as user identifiers or pseudonyms, eroding the very anonymity the IoT system is meant to preserve [5]. This tension between public verifiability and user privacy is one of the central challenges in designing signature schemes for modern IoT environments.

To reconcile these two requirements, undeniable signature schemes can offer an elegant primitive [6]. In an undeniable signature scheme, a signature is not publicly verifiable; instead, verification is carried out through an interactive confirm/deny protocol between the signer and the verifier, so that the validity of a signature can only be established with the cooperation of the signer. This selective verifiability provides a natural mechanism for content protection and signer privacy: signatures cannot be duplicated, widely disseminated, or used to track users without the signer’s consent. As a result, undeniable signatures have attracted considerable attention in privacy-preserving applications such as electronic voting, licensed software distribution, and secure electronic health record sharing [7,8,9]. A parallel line of research seeks to simplify key management in large-scale IoT deployments. Classical PKI requires every user to obtain a certificate binding their identity to a public key, which is cumbersome for billions of resource-constrained devices [10]. Identity-based cryptography (IBC) eliminates the need for certificates by deriving a user’s public key directly from a publicly known identifier [11]. A trusted Key Generation Center (KGC) issues the corresponding private key. The pairing-based construction, in particular, has inspired a rich body of identity-based signature (IBS) schemes [4,12,13], and a number of identity-based undeniable signature (ID-US) schemes [14,15], which combine the certificate-free convenience of IBC with the selective verifiability of undeniable signatures and are particularly well suited to IoT.

Despite their appealing functionality, nearly all existing ID-US schemes are built on the hardness of number-theoretic problems such as the discrete logarithm problem (DLP), the integer factorization problem (IFP), or the computational/decisional Diffie–Hellman problem (CDH/DDH) in finite groups or pairing-friendly elliptic curves [16]. The advent of large-scale quantum computers, however, fundamentally threatens this foundation: Shor’s algorithm solves DLP, IFP, and CDH in polynomial time [17], rendering all pairing-based and RSA-type schemes insecure. With the National Institute of Standards and Technology (NIST) actively standardizing post-quantum primitives and the “harvest-now, decrypt-later” threat already materializing in IoT deployments with long secrecy lifetimes, it is essential that the cryptographic core of IoT security be quantum-resistant.

Lattice-based cryptography has emerged as one of the most promising post-quantum paradigms, offering several compelling advantages for IoT [18]: (i) worst-case to average-case hardness reductions under standard lattice assumptions such as the Short Integer Solution (SIS) and Learning With Errors (LWE) problems; (ii) resistance to known quantum attacks; (iii) relatively efficient arithmetic over small integers, which is attractive for resource-constrained sensors and RFID-class devices; and (iv) a rich algebraic structure that supports advanced functionalities, including identity-based encryption, attribute-based encryption, and digital signatures. The NIST Post-Quantum Cryptography Standardization Process has further validated the maturity of lattice constructions, with CRYSTALS-Dilithium [19] and Falcon [20] selected as primary digital signature standards. Nevertheless, despite these advances, the literature on lattice-based identity-based undeniable signatures remains surprisingly sparse. The few existing works either rely on the pre-image sampleable trapdoor paradigm without addressing confirm/deny protocols, or build on weaker non-standard assumptions, leaving a significant gap in provably secure, post-quantum, privacy-preserving IoT authentication.

Motivated by these observations, a lattice-based identity-based undeniable signature (ID-US) scheme is specifically tailored to the privacy, efficiency, and security requirements of IoT networks. The main contributions are summarized as follows:

• A controlled verification model is introduced based on blockchain for IoT networks. IoT data is collected by the edge IoT devices, and then the data-sharing processes are protected by an ID-US scheme and transformed through a distributed blockchain network. This mechanism solves the privacy leakage and IoT data loss problems.

• An ID-US scheme is proposed to support the controlled verification model. This ID-US integrates identity and undeniable mechanisms to achieve user anonymity, data anonymity, and signature non-repudiation. Meanwhile, this ID-US scheme is constructed with the lattice assumption, which provides anti-quantum-attack security for IoT networks.

• The security proof of the ID-US scheme in the random oracle model is presented. Some related security analyses are presented, and the security analysis results show that this ID-US scheme is correct and secure.

• The comparison and performance have been executed. The security test with Scyther has been executed, and the results show that there are no attack weak points. The efficiency comparison of key size and time consumption is presented. The performance evaluations are also simulated. The results show that this ID-US scheme is efficient. Meanwhile, the transaction latency has been compared. The comparison results show that this controlled verification model provides enhanced security while ensuring low latency.

In the following, Section 2 reviews IoT network privacy protection and post-quantum privacy protection methods. Section 3 presents the lattice theory. Section 4 introduces the controlled verification model and ID-US scheme. Section 5 gives the security analysis of the ID-US scheme and tests it with Scyther. Section 6 evaluates its efficiency and performance. Finally, Section 7 shows the conclusion.

2. Related Work

This section reviews prior work along two complementary axes. Section 2.1 surveys network-level privacy protection mechanisms that have been proposed for IoT, and Section 2.2 then narrows the focus to post-quantum privacy-preserving techniques for IoT.

2.1. IoT Network Privacy Protection

Pseudonym-based schemes replace long-lived identifiers with short-lived pseudonyms that are rotated periodically to break linkability across sessions. Such schemes have been widely studied in VANETs, smart metering, and wearable health monitoring [21,22]. Pseudonym schemes are simple and compatible with existing PKI or IBS infrastructure. However, they offer only weak privacy, because they rely on frequent synchronous rotation and remain vulnerable to side-channel deanonymization through timing and RF fingerprinting.

Group and ring signatures allow a member of an authorized group to produce a signature that is verifiable as originating from some member of the group while concealing the actual signer. They have been applied to smart-grid billing, anonymous sensor-data credentialing, and vehicular announcements [23,24]. Attribute-based signatures (ABS) and attribute-based encryption (ABE) bind keys and signatures to descriptive attributes instead of explicit identities. They support fine-grained, policy-driven access control in healthcare and industrial IoT [25,26]. Group and ring signatures provide strong in-group anonymity and support dynamic revocation, yet they depend on a trusted group manager who can deanonymize any signature, and ring signatures incur sizes that grow linearly with the ring size, which is costly on bandwidth-limited IoT links. Attribute-based schemes enable fine-grained access control and hide identities behind attribute sets, but most efficient constructions rely on pairings. Such schemes are expensive on IoT-class hardware without dedicated pairing accelerators and are vulnerable to quantum attacks.

Complementary to the above, homomorphic encryption enables cloud aggregators to compute over encrypted IoT readings [27,28]. Differential privacy adds calibrated noise to aggregate outputs in order to bound the influence of any single record [29]. Blockchain-based trust management removes single trusted authorities by anchoring identities and signatures on a tamper-evident ledger, often combined with ring signatures or zero-knowledge proofs [30]. Homomorphic encryption and differential privacy offer strong cryptographic or information-theoretic guarantees for aggregated IoT data, but neither of them provides per-message authentication or non-repudiation. Such guarantees are essential for safety-critical IoT commands and signed alerts. Fully homomorphic encryption is still far too expensive for typical IoT workloads. Blockchain-based architectures eliminate single points of failure, yet on-chain transactions incur significant latency, throughput, and energy overheads that conflict with IoT bandwidth and battery constraints. Meanwhile, public ledgers can themselves become a privacy liability when off-chain identities are linked to on-chain addresses. In addition, quantum methods, such as quantum key distribution and quantum Internet, have been introduced to enhance network security for IoT applications [31,32].

In summary, no single family from the IoT privacy literature delivers signer anonymity, signature non-repudiation, and quantum resistance at the same time. The primitive that comes closest in functionality, namely undeniable signatures, has not yet been built on a post-quantum foundation.

2.2. Post-Quantum Privacy Protection Methods

The NIST post-quantum standardization process has stimulated a rich body of work on quantum-resistant IoT security. Lattices are currently regarded as the most mature family for signatures [18]. They offer multiple standardized primitives, well-studied implementations, and a rich toolkit of advanced functionalities including IBE, ABE, ABS, and group signatures.

Modern lattice cryptography rests on LWE and SIS. Both admit worst-case to average-case reductions from standard lattice problems. Their algebraic variants, Ring-LWE and Module-LWE, enable compact representations and small keys and signatures, while preserving the worst-case guarantees. Building on these tools, a series of provably secure lattice signature schemes has been proposed. Combining identity-based cryptography with lattice foundations yields lattice-based identity-based signatures (L-IBS) [33,34,35]. Such schemes remove certificates while remaining quantum-resistant. A small but growing line of work has attempted to construct lattice-based undeniable signatures [8,9,14,15,36,37]. These constructions combine selective verifiability with post-quantum security and represent the most direct precursors of our scheme. Lattice foundations are attractive because they offer worst-case to average-case hardness, resistance to known quantum attacks, and arithmetic over small integers suitable for resource-constrained sensors and RFID-class devices. Their main drawbacks are larger signature and key sizes compared to RSA/ECDSA at the same classical security level and the limited number of side-channel-hardened implementations. In summary, no prior scheme simultaneously achieves post-quantum security under standard lattice assumptions, identity-based key generation, full confirm/deny selective verifiability, and strong anonymity with a rigorous invisibility proof.

The former two subsections together reveal a common gap in the literature. However, none of these families simultaneously guarantees signer anonymity, signature non-repudiation, and quantum resistance. Meanwhile, the post-quantum privacy literature lacks a construction that integrates undeniable selective verifiability with identity-based key generation and rigorous invisibility proofs. In this work, a lattice-based ID-US scheme is proposed to cover these challenges.

3. Preliminaries

Some definitions of lattice theory are presented.

Definition 1.

Lattice [38]: $v_1,\cdots ,v_n\in {\mathbb{R}}^m$ is a set of linearly independent vectors; the lattice ${\mathsf{\Lambda }}_L$ is shown in Equation (1):

$${\mathsf{\Lambda }}_L=\{a_1{v}_1+a_2{v}_2+\cdots +a_n{v}_n:a_1,a_2,\cdots ,a_n\in \mathbb{Z}\}$$ (1)

where $A=(a_1,\cdots ,a_m)\subset {\mathbb{R}}^{n\times m}$ is a basis of lattice Λ. Here, n is the dimension and m is the rank, which satisfy $m=O\left(n\log q\right)$.

Definition 2.

q-ary Lattice [38] : The “q-ary” lattice is shown in Equation (2), where q is a prime number and $\mathcal{A}\in {\mathbb{Z}}_q^{n\times m}$ is a matrix.

$$\begin{array}{cc}\hfill & {\mathcal{L}}^{\perp }\left(A\right)=\{x\in {\mathbb{Z}}^m|Ax=0modq\}\hfill \\ \hfill & {\mathcal{L}}_y^{\perp }\left(A\right)=\{x\in {\mathbb{Z}}^m|A^T\mathbf{y}=xmodqfory\in {\mathbb{Z}}^n\}\hfill \end{array}$$ (2)

Definition 3.

Gaussian distribution [39] : With standard deviation $\sigma \in \mathbb{R}$ and center $c\in \mathbb{R}$ evaluated at $x\in \mathbb{R}$, the Gaussian distribution is defined by ${\rho }_{c,\sigma }\left(x\right)=exp({\displaystyle \frac{-{(x-c)}^2}{2{\sigma }^2}})$, and more generally by ${\rho }_{c,\sigma }\left(x\right)=exp({\displaystyle \frac{-\left|\right|x-{c\left|\right|}^2}{2{\sigma }^2}})$ for $x,c\in {\mathbb{R}}^n$. Here, ${\rho }_{\sigma }\left(x\right)$ represents the Gaussian distribution when the center $c=0$. $D_{\sigma }\left(x\right)={\rho }_{\sigma }\left(x\right)/{\rho }_{\sigma }\left(\mathbb{Z}\right)$ represents the discrete Gaussian distribution over $\mathbb{Z}$ with center $c=0$. $D_{\sigma }\left(x\right)={\rho }_{\sigma }\left(x\right)/{\rho }_{\sigma }\left({\mathbb{Z}}^m\right)$ represents the more general situation over ${\mathbb{Z}}^m$ with center $c=0$.

Definition 4.

$\Re -{\mathit{SIS}}_{\mathit{q},\mathit{n},\mathit{m},\mathsf{\beta }}^{\mathsf{\kappa }}$   problem  [39]: Given a ring ℜ and a distribution κ over ${\Re }_q^{n\ast m}$, $\Re -SI{S}_{q,n,m,\beta }^{\kappa }$ is a problem to find non-zero $v\in {\Re }_q^m$ to achieve the following Equation (3).

$$Av=0$$ (3)

where $A\in {\Re }_q^{n\ast m}$, and ${\left|\right|v\left|\right|}_2\le \beta$.

Definition 5.

SampleMat algorithm [40]: For the matrix $A\in {\mathbb{Z}}_q^{n\times m}$ and the short basis $T\in {\mathbb{Z}}_q^{m\times m}$ obtained by the TrapGen(n,m,q) algorithm, the secure Gaussian parameter $\sigma \ge \left(\parallel B\parallel \right)·\omega \left(\sqrt{lo{g}_{2}n}\right)$ and the uniform matrix $U\in {\mathbb{Z}}_q^{n\times k}$, this algorithm outputs a random matrix $S\in {\mathbb{Z}}_q^{m\times k}$, where $AS=0modq$.

4. Controlled Verification Model for IoT Network

A controlled verification model is presented first, and then an ID-US scheme based on the lattice assumption is proposed in this section.

4.1. Controlled Verification Model

Figure 1 illustrates a secure controlled verification model architecture for the multi-scenario Internet of Things. This model uses the ID-US scheme as its core. It seamlessly connects industrial, home, medical, and vehicular terminals to the cloud and blockchain. This architecture builds a complete closed loop across the data lifecycle. The loop covers data collection, transmission, storage, and utilization. The signature mechanism runs through the entire process. It ensures the authenticity, privacy, security, and non-repudiation of massive data throughout the lifecycle. This breaks traditional centralized trust bottlenecks. It creates a highly credible digital ecosystem.

Figure 1.

Controlled verification model.

• Data Collection: These scenarios include sensors and robots in industrial plants. They also include smart homes and personal terminals. Furthermore, they include wearable monitoring instruments for patients. Finally, they involve smart vehicles and traffic facilities on roads. Devices continuously generate massive amounts of environmental, production, physiological, and traffic data within this heterogeneous edge node network. The system allocates a unique identity-based key to every legal data collection terminal by introducing the ID-US scheme in this phase. Every device digitally signs data at the source during the collection process. This guarantees the native confidentiality of the data. It prevents unauthorized forged nodes from accessing the network and injecting false data. It fundamentally ensures clear, authentic, and unforgeable identity attribution for every bit of collected data. This lays a solid trust foundation for subsequent data flow.

• Data Transmission: This IoT network efficiently and stably relays data collected by edge terminals to the upper control center. The open wireless network plays an essential role in IoT data transmission. To prevent eavesdropping, interception, and man-in-the-middle tampering attacks, blockchain technology takes responsibility for transaction integrity, tamper-proof records, and network-wide consistency. Meanwhile, highly sensitive data is routed between base stations. This data includes medical signs, industrial commands, and vehicle collision warnings. The signature verification mechanism ensures the integrity of data packets in the channel. Any third party might attempt to tamper with or hijack data mid-transmission. This will cause signature verification to fail. IoT network nodes will immediately intercept and discard the altered data. This builds an indestructible data channel for applications highly dependent on real-time security.

• Data Storage: Data enters the storage stage after safely arriving at the top layer of the network. Traditional systems mostly rely on centralized cloud server storage. They easily become single-point attack targets and pose internal tampering risks. This model cleverly introduces a cloud and blockchain collaborative storage architecture. Massive business entity data is encrypted and stored in cloud servers with powerful computing capabilities. More core device identity public keys, access control policies, and signature records are distributed and anchored on the blockchain ledger. The blockchain network applies the DPoS mechanism to achieve systematic trading consistency. The decentralized and tamper-proof characteristics of the blockchain provide an additional digital trust shield for cloud data. Internal administrators of cloud servers cannot silently tamper with or delete historical data without leaving on-chain audit traces. This achieves transparency and security in data storage. The blockchain network acts in the role of lightweight information recording and cross-institutional information exchange. Note that it only verifies the IoT data transaction validity, but does not verify the signature’s validity.

• Data Utilization: It involves remote diagnostic analysis in hospitals and accurate automated scheduling in factories. It also involves collaborative decision-making in autonomous driving and remote control of smart homes. The core controlled verification and non-repudiation of the model demonstrate irreplaceable practical value in this application stage. Here, the receiver first verifies the validity when they receive the transmitted IoT data. Authorized institutions or systems retrieve historical data for analysis and decision-making. They must rely on blockchain records to conduct strict signature verification on the data. This ensures the utilized data sources are accurate. Real disputes may occur in certain scenarios. These include traffic accident responsibility division or medical diagnostic accident accountability. The signature mechanism makes it impossible for the data sender to deny previously issued data records or control commands. The system can accurately trace the entire process of generation, circulation, and use of every piece of data. It provides digital evidence with the highest legal validity. It effectively clarifies the responsibilities of all parties and promotes the secure operation of the entire ecosystem.

Based on the ID-US scheme, this blockchain-based model can achieve security and control. The verification requires the participation of the signer through an interactive confirmation protocol. The signer decides when, to whom, and whether verification is performed. A disavowal protocol resolves disputes when a malicious signer denies a valid signature or falsely claims one. The control over verification therefore stays with the signer. Cryptographic protocols and the blockchain jointly guarantee the binding force of this control.

4.2. The Proposed ID-US Scheme

This ID-US scheme integrates the identity mechanism to improve signature traceability. It mainly consists of five algorithms, $\mathbf{Setup}$, $\mathbf{KeyExt}.$, $\mathbf{Sign}$, $\mathbf{Verify}$, and $\mathbf{Confirmation}/\mathbf{disavowal}$.

$\mathbf{Setup}$: This ID-US is constructed by a lattice problem $\Re -SI{S}_{q,n,m,\beta }^{\kappa }$ as shown in Definition 4, where $\beta \ge \sqrt{m}{q}^{n/m}$ and ${\Re }_q^{n\times m}$. KGC first sets the system parameters according to the following Algorithm 1.

Algorithm 1 Setup

Input: $\Re -SIS$, security parameter n Output: System parameter $pp$;   1:Sets $q=q\left(n\right)\ge 3$ as a prime number;   2:Sets $m\ge 3nlogq$ as a positive integer;   3:KGC randomly selects an approximate random distribution matrix $mpk=A\in Z_q^{n\times m}$;   4:Generates a basis $T\in Z_q^{m\times m}$ from ${\mathsf{\Lambda }}^{\perp }\left(A\right)$, $\left|\right|\tilde{T}\left|\right|\le L$;   5:Sets $H_1,H_2,H_3,H_5:{\{0,1\}}^{*}\to Z_q^{n\times m}$ as the hash functions;   6:Sets $H_4:{\{0,1\}}^{*}\to Z_q^m$ as the other one hash function;   7:Serves the master public key $mpk=A$ and master secret key $msk=T$;   8:Opens $pp=\{n,q,m,A,H_1,H_2,H_3,H_4,H_5\}$.

$\mathbf{KeyExt}.(pp,I{D}_i)$: Under the system parameter $pp$, KGC generates the key pair $(Pk,Sk)$ for user $I{D}_i$ according to the following Algorithm 2.

Algorithm 2 KeyExt.

Input: $pp$, and $I{D}_i$ Output: Keys pair $(Pk,Sk)$   1:KGC calculates $a_{I{D}_i}=H_1\left(I{D}_i\right)\in Z_q^{n\times m}$;   2:Samples $s_{I{D}_i}=SampleMat(A,T,\sigma ,a_{I{D}_i})\in Z_q^{m\times m}$, where $A{s}_{I{D}_i}=a_{I{D}_i}modq$, $\left|\right|s_{I{D}_i}\left|\right|\le \sigma \sqrt{m}$, and $\sigma \ge \left|\right|\tilde{T}\left|\right|w\left(\sqrt{logm}\right)$;   3:Randomly chooses $sd\in {\{0,1\}}^{*}$ as a seed;   4:Calculates $L=H_2\left(sd\right)\in Z_q^{n\times m}$;   5:Randomly selects $x\in D_{\sigma }^m$;   6:Calculates $X=Lxmodq$;   7:Returns $(Pk,Sk)=\{(a_{I{D}_i},L,X),(s_{I{D}_i},x)\}$ back to user $I{D}_i$.

$\mathbf{Sign}(pp,Pk,Sk,\mu )$: Under the system parameter $pp$, and key pair $(Pk,Sk)$, the user $I{D}_i$ signs message $\mu$ according to the following Algorithm 3.

Algorithm 3 Sign

Input: $pp$, $(Pk,Sk)$, and $\mu$ Output: ID-US e   1:Randomly chooses $y\in D_{\sigma }^m$;   2:Calculates $U=H_3\left(\mu \right)\in Z_q^{n\times m}$;   3:Calculates $e_1=H_4(X+Aymodq,U)$;   4:Calculates $e_2=(y+s_{I{D}_i}{e}_1)modq$;   5:Calculates $e_3=Uxmodq$;   6:Opens ID-US $e=(e_1,e_2,e_3,\mu )$.

$\mathbf{Verify}(pp,Pk,e,\mu )$: Given $pp$, e, and $\mu$, the verifier can verify the validity of the ID-US e. Details are shown in the following Algorithm 4.

Algorithm 4 Verify

Input: $pp$, e, and $\mu$ Output: Accept or Reject   1:Verifier first checks: if $\left|\right|e_2\left|\right|>T$ then   2:   Rejects   3:else Continues   4:If $\left|\right|e_2{\left|\right|}_{\infty }\ge q/4$ then   5:   Rejects   6:else Continues   7:If $e_1=H_4(X+A{e}_2-a_{I{D}_i}{e}_{1}modq,U)$   8:   Accepts

Here, $T=\eta \sqrt{m\sigma }$ is an acceptable threshold, and $\eta$ is generally set within the interval $[1.1,1.4]$.

$\mathbf{Confirmation}/\mathbf{Disavowal}(pp,e)$: Given $pp$ and e, the signer and verifier cooperate to confirm or deny the ID-US e. Details are shown in Algorithm 5.

Algorithm 5 Confirmation/Disavowal

Input: $pp$, and e Output: Confirmation or Disavowal    1:Signer and verifier calculate L and X;    2:Chooses a permutation r over $(1,2,\dots ,m)$;    3:Chooses a vector $\pi \in D_{\sigma }^m$;    4:Calculates $F_1=H_5\left(r\right|\left|L\pi mod2q\right)$;    5:Calculates $F_2=H_5\left(r\left(\pi \right)\right)$;    6:Calculates $F_3=H_5\left(r(\pi +x)\right)$;    7:Calculates $F_4=H_5\left(r\right|\left|U\pi mod2q\right)$;    8:Sets the commitments $(F_1,F_2,F_3,F_4)$;    9:Verifier sends a challenge $f\in \{1,2,3\}$ to signer;  10:Signer answers $(r,\pi )$ for $f=1$ challenge;  11:Answers $(r,\pi +x)$ for $f=2$ challenge;  12:Answers $\left(r\right(\pi ),r(x\left)\right)$ for $f=3$ challenge;  13:Verifier checks the validity of $F_1$, $F_2$, and $F_4$ for $f=1$ challenge;  14:Checks the validity of $F_1$, $F_2$, and $F_4$ for $f=2$ challenge;  15:If $F_4=H_5\left(r\right||U(\pi +x)-e_3)$, outputs confirmation;  16:else $F_4\ne H_5\left(r\right||U(\pi +x)-e_3)$, outputs disavowal;  17:Checks the validity of $F_2$, $F_3$, and $\left|\right|r\left(e\right)\left|\right|\le \beta \sqrt{m}$ for $f=3$ challenge;  18:Outputs “Confirmation” when verifications are all successful;  19:Otherwise, outputs “Disavowal”.

5. Security Analysis

This section first analyzes the correctness of the ID-US scheme, and then proves its soundness and unforgeability.

5.1. Correctness

When $\left|\right|e_2\left|\right|\le T$ and $\left|\right|e_2{\left|\right|}_{\infty }<q/4$, the ID-US $e=(e_1,e_2,e_3,\mu )$ can pass the verification as shown in Algorithm 4. Then, it has Equation (4).

$$H_4(X+A{e}_2-a_{I{D}_i}{e}_{1}modq,U)=H_4(X+Aymodq,U)$$ (4)

The former Equation (4) holds when $X+A{e}_2-a_{I{D}_i}{e}_1=X+Aymodq$ holds, and the details are shown in Equation (5).

$$\begin{array}{cc}\hfill X+A{e}_2-a_{I{D}_i}{e}_1& =X+A(y+s_{I{D}_i}{e}_1)-a_{I{D}_i}{e}_1\hfill \\ \hfill & =X+Ay+A{s}_{I{D}_i}{e}_1-a_{I{D}_i}{e}_1\hfill \\ \hfill & =X+Ay+a_{I{D}_i}{e}_1-a_{I{D}_i}{e}_1\hfill \\ \hfill & =X+Aymodq\hfill \end{array}$$ (5)

5.2. Soundness

Theorem 1.

Soundness . For a valid or invalid $(\pi ,e)$, it always outputs $Prob\left(Disavowal\right)=1$ or $Prob\left(Confirmation\right)=1$, respectively.

Proof. 

Here, the valid and invalid $(\pi ,e)$ are analyzed separately.

(1) Invalid case: The equation $e_3\ne U{x}^{T}modq$ holds for an invalid pair $(\pi ,e)$. Then, the signer responds according to the following principle.

• If $f=1$, responds with ${\psi }_1$ and ${\theta }_1$;

• If $f=2$, responds with ${\psi }_2$ and ${\theta }_2$;

• If $f=3$, responds with ${\theta }_3$ and ${\theta }_3$.

Then, the verifier has:

$$\left\{\begin{array}{c}{F}_1=H_5({\psi }_1\left|\right|L{\theta }_1^{T}modq)=H_5({\psi }_2\left|\right|(L{\theta }_2^T-X)modq)\hfill \\ F_2=H_5\left({\psi }_1\left({\theta }_1\right)\right)=H_5\left({\theta }_4\right)\hfill \\ F_3=H_5\left({\psi }_s\left({\theta }_2\right)\right)=H_5({\theta }_3+{\theta }_4)\hfill \\ F_4=H_5({\psi }_1\left|\right|U{\theta }_1^{T}modq)=H_5({\psi }_2\left|\right|(U{\theta }_2^T-e_3)modq)\hfill \end{array}\right.$$ (6)

Unfortunately, $H_5$ has a collision, or the results in Equation (7) hold by ${\left|\right|\theta \left|\right|}_3\le \beta \sqrt{m}$.

$$\left\{\begin{array}{c}{\psi }_1={\psi }_2\hfill \\ L{\theta }_1^{T}modq=(L{\theta }_2^T-X)modq\hfill \\ {\varphi }_1\left({\theta }_1\right)={\theta }_4\hfill \\ {\varphi }_2\left({\theta }_2\right)={\theta }_3+{\theta }_4\hfill \\ U{\theta }_1^{T}modq=(U{\theta }_2^T-e_3)modq\hfill \end{array}\right.$$ (7)

Next, it has ${\theta }_2-{\theta }_1={\psi }_1^{-1}\left({\theta }_3\right)$ from the second and third equations in Equation (9). It also has $X=L{\psi }_1^{-1}{\left({\theta }_3\right)}^T$. So, $x={\psi }_1^{-1}\left({\theta }_3\right)$ holds. Then, it has $e_3=U{\psi }_1^{-1}{\left({\theta }_3\right)}^{T}modq=U{x}^{T}modq$. However, $e_3\ne U{x}^{T}modq$ holds for an invalid $(\pi ,e)$. This leads to a contradiction, and it shows that the signer cannot correctly answer the former three challenges at the same time. Assuming that the success probability of the signer correctly answering each challenge $f=1$ (or $f=2$, $f=3$) is ${\displaystyle \frac{1}{2}}$, the success probability of answering three challenges simultaneously is ${\displaystyle \frac{1}{2}}\ast {\displaystyle \frac{1}{2}}\ast {\displaystyle \frac{1}{2}}={\displaystyle \frac{1}{8}}$. Therefore, $Prob\left(Disavowal\right)=1-{\left({\displaystyle \frac{1}{8}}\right)}^N$ will be close to 1 with increasing $N(N\ge 2)$, where N is the response times.

(2) Valid case: The equation $e_3=U{x}^{T}modq$ holds for a valid pair $(\pi ,e)$. As in the former analysis in the Invalid case, the success probability of answering three challenges simultaneously is ${\displaystyle \frac{1}{8}}$. Therefore, $Prob\left(Confirmation\right)=1-{(1-1/8)}^N$ will be close to 1 with increasing N, where N is the response times. □

5.3. Unforgeability

Theorem 2.

Unforgeability : Under the lattice assumption, this ID-US cannot be forged by an adversary with a chosen-message attack in the ROM.

Proof. 

In the ROM, one challenger C and one adversary E execute a query-response game. E performs the query, but it does not query on the target message ${\mu }^{*}$. C responds to E’s queries. When E obtains enough information, it attempts to forge an ID-US. Next, C attempts to solve the $\mathbb{Z}-SI{S}_{q,n,m,\beta }^{\kappa }$ instance $A^{\prime }v=0modq$. Details are as follows.

• Initialize: C initiates and opens the system parameters $pp$.

• $H_1$ query: For $H_1$, E performs the query on a random user $I{D}_i$. C sets a list $Lis{t}_{H_1}$ to store the query results. When it obtains the query, it first checks $Lis{t}_{H_1}$ and sends $(a_{I{D}_i},I{D}_i)$ back to E if the query is queried. If it does not exist, it calculates $a_{I{D}_i}=H_1\left(I{D}_i\right)$, sends the result $(a_{I{D}_i},I{D}_i)$ to E, and records it in $Lis{t}_{H_1}$.

• $H_2$ query: For $H_2$, E performs the query on a random seed $sd$. C sets a list $Lis{t}_{H_2}$ to store the query results. When it obtains the query, it first checks $Lis{t}_{H_2}$ and sends $(sd,L)$ back to E if the query is queried. If it does not exist, it calculates $L=H_2\left(sd\right)$, sends the result $(sd,L)$ to E, and records it in $Lis{t}_{H_2}$.

• $H_3$ query: For $H_3$, E performs the query on a non-target message $\mu$. C sets a list $Lis{t}_{H_3}$ to store the query results. When it obtains the query, it first checks $Lis{t}_{H_3}$ and sends $(\mu ,U)$ back to E if the query is queried. If it does not exist, it calculates $U=H_3\left(\mu \right)$, sends the result $(\mu ,U)$ to E, and records it in $Lis{t}_{H_3}$.

• $H_4$ query: For $H_4$, E performs the query on a non-target message $\mu$. C sets a list $Lis{t}_{H_4}$ to store the query results. When he obtains the query, he first checks $Lis{t}_{H_4}$ and sends $(e_1,U)$ back to E if the query is queried. If it does not exist, he performs the $H_2$ query to obtain U firstly, calculates $e_1=H_4(X+Aymodq,U)$, sends the result $(e_1,U)$ to E, and records it in $Lis{t}_{H_4}$.

• Secret key query: For secret key, E performs the query on a non-target user $I{D}_i^{\prime }$. C sets a list $Lis{t}_{SK}$ to store the query results. When it obtains the query, it first checks $Lis{t}_{SK}$ and sends $(s_{I{D}_i^{\prime }},a_{I{D}_i^{\prime }})$ back to E if the query is queried. If it does not exist, it performs the $H_1$ query to obtain $a_{I{D}_i^{\prime }}$ firstly, calculates $s_{I{D}_i^{\prime }}=SampleMat(A,T,\sigma ,a_{I{D}_i^{\prime }})$, sends the result $(s_{I{D}_i^{\prime }},a_{I{D}_i^{\prime }})$ to E, and records it in $Lis{t}_{SK}$.

• Signature query: For signature, E performs the query on a non-target message $\mu$. C sets a list $Lis{t}_S$ to store the query results. When it obtains the query, it first checks $Lis{t}_S$ and sends $(e,\mu )$ back to E if the query has been queried. If it does not exist, it performs the $H_3$ query to obtain U firstly, calculates $e_1=H_4(X+Aymodq,U)$, $e_2=(y+s_{I{D}_i^{\prime }}{e}_1)modq$, and $e_3=Uxmodq$. Then, it sends the result $(e=(e_1,e_2,e_3),\mu )$ to E, and records it in $Lis{t}_S$.

• Forge: Under the former assumption and queried information, E can forge a valid ID-US $(e^{\prime }=(e_1^{\prime },e_2^{\prime },e_3^{\prime }),{\mu }^{\prime })$ for the target message ${\mu }^{\prime }$, and return it to C.

• Challenge: C generates a signature $(e^{″}=(e_1^{″},e_2^{″},e_3^{″}),{\mu }^{\prime })$ for the same message ${\mu }^{\prime }$. Next, it utilizes these two valid signatures $e^{\prime }$ and $e^{″}$ to solve the $\mathbb{Z}-SI{S}_{q,n,m,\beta }^{\kappa }$ instance. Firstly, it computes $U^{\prime }=H_3\left({\mu }^{\prime }\right)$, and obtains the following results, as shown in Equation (8).

  $$\left\{\begin{array}{c}{e}_1^{\prime }=H_4(X+A{y}^{\prime }modq,U^{\prime })\hfill \\ e_1^{″}=H_4(X+A{y}^{″}modq,U^{\prime })\hfill \end{array}\right.$$ (8)
• Analyze: Here, it has $A{y}^{\prime }=A(e_2^{\prime }-s_{I{D}_i}^{\prime }{e}_1^{\prime })=A{e}_2^{\prime }-a_{I{D}_i}^{\prime }{e}_1^{\prime }$ as $e_2^{\prime }=(y^{\prime }+s_{I{D}_i}^{\prime }{e}_1^{\prime })modq$ holds. Therefore, it has the following results in Equation (9).

  $$\left\{\begin{array}{c}{e}_1^{\prime }=H_4(X+A{y}^{\prime }modq,U^{\prime })=H_4(X+A{e}_2^{\prime }-a_{I{D}_i}^{\prime }{e}_1^{\prime }modq,U^{\prime })\hfill \\ e_1^{″}=H_4(X+A{y}^{″}modq,U^{\prime })=H_4(X+A{e}_2^{″}-a_{I{D}_i}^{\prime }{e}_1^{″}modq,U^{\prime })\hfill \end{array}\right.$$ (9)
  Next, it also has Equation (10).

  $$\left\{\begin{array}{c}X+A{y}^{\prime }=X+A{e}_2^{\prime }-a_{I{D}_i}^{\prime }{e}_1^{\prime }modq\hfill \\ X+A{y}^{″}=X+A{e}_2^{″}-a_{I{D}_i}^{\prime }{e}_1^{″}modq\hfill \end{array}\right.$$ (10)
  Then, it also has Equation (11).

  $$\left\{\begin{array}{c}A(e_2^{\prime }-y^{\prime })=a_{I{D}_i}{e}_1^{\prime }modq\hfill \\ A(e_2^{″}-y^{″})=a_{I{D}_i}{e}_1^{″}modq\hfill \end{array}\right.$$ (11)

  Here, from Equation (11), it has $A(e_2^{\prime }-e_2^{″}-y^{\prime }+y^{″})=a_{I{D}_i}(e_1^{\prime }-e_1^{″})modq$. Because $e_1^{\prime }\ne e_1^{″}$, $a_{I{D}_i}\in Z_q^{n\times m}$, and $e_1^{\prime },e_q^{″}\in Z_q^m$, it has $A(e_2^{\prime }-e_2^{″}-y^{\prime }+y^{″})=0modq$. So $v=e_2^{\prime }-e_2^{″}-y^{\prime }+y^{″}$ is a solution of the $\mathbb{Z}-SI{S}_{q,n,m,\beta }^{\kappa }$ instance $Av=0modq$. However, it cannot solve the $SIS$ problem with the current most advanced computing conditions, so this solution is not credible. It also indicates that the assumption of E is not correct, and E cannot forge a valid ID-US. Meanwhile, the probability that E can forge a valid ID-US is ${\displaystyle \frac{1}{q_{H_1}+q_{H_2}+q_{H_3}+5/4\left(q_{H_4}\right)+q_{SK}+5/4\left(q_S\right)}}$. Here, $q_{H_1}$, $q_{H_2}$, $q_{H_3}$, $q_{H_3}$, $q_{SK}$, and $q_S$ are the query times as E can perform enough queries when it obtains enough information. The factor $5/4$ means that we assume the existence of a $1/4$ probability of performing $H_2$ and $H_3$ queries in $H_4$ and $Signaturequery$, respectively. However, with the query times increasing, E’s success probability will become negligible. Therefore, this ID-US scheme can capture the security property of unforgeability.

□

5.4. Other Security Properties

Some other security properties achieved by the proposed ID-US scheme are analyzed in this subsection. These security properties are obtained by function design and do not require a formal security proof with ROM. Following are the detailed analyses.

• Non-repudiation: There are two settings that can guarantee this property of non-repudiation. If the signature has passed verification, the signer cannot deny it, as the confirmation/disavowal mechanism can prevent this repudiation. Meanwhile, the signer’s identity is inserted into the signature, and the signer cannot deny a valid signature with his own identity.

• Post-quantum security: This ID-US is constructed with the lattice assumption, which can provide anti-quantum-attack security for IoT data sharing across different IoT devices and networks.

• Controlled verification: The proposed ID-US scheme can guarantee that a valid signature cannot be denied by the signer. The confirmation/disavowal mechanism utilizes a challenge form to achieve non-repudiation. Only after passing the challenges can the signature be accepted by the verifier. This controlled verification guarantees the security of user privacy and IoT data.

• Data anonymity: The controlled verification model can also be established with blockchain technology. The real data is stored in the native server, and the lightweight messages, such as storage address, operation records, and transaction information, are recorded in the blockchain ledger. Only after passing the signature verification can the receiver obtain the real data from the storage address. This form saves online ledger space but also guarantees data anonymity.

In a word, the results of correctness analysis, security proof, and other related security analysis show that this ID-US scheme is correct and secure for data sharing in IoT networks.

6. Performance Evaluations

6.1. Scyther Test

The Scyther verification results (as shown in Figure 2) indicate that this ID-US scheme achieves complete security under all analyzed protocol roles. Specifically, the KGC, the Signer (S), and the Verifier (V) all report “No attacks,” with every security claim successfully verified. The following paragraphs present a detailed analysis of these results.

Figure 2.

Scyther test results.

• The KGC’s behavior is verified, which asserts the secrecy of the commitment, the KGC’s master secret key $sk$, and the secret seed $sd$. All three claims are marked as “Ok Verified,” confirming that the KGC protocol role maintains the confidentiality of all sensitive parameters throughout execution. This indicates that the master key and the randomly sampled secret seed $sd$ are not leaked to the adversary through any observable communication channel, even under the assumption of a Dolev–Yao attacker with full control over the network.

• The signer’s behavior is verified. The commitments are all verified as secure, confirming that the signer faithfully follows the protocol and that no sensitive intermediate values are disclosed in the commitment phase. Furthermore, the claims also confirm the secrecy of the signer’s private key $sk$ and the secret value $sd$. The successful verification of these claims demonstrates that the signing process preserves the privacy of the signer’s long-term private key and all ephemeral random values, which is essential for ensuring unforgeability and key-isolating security in lattice-based identity-based signatures.

• The verifier’s behavior is verified. The commitments are verified as secure, indicating that the verifier correctly preserves the integrity of the protocol transcripts. Moreover, the secrecy of the verifier’s private key $sk$ is also confirmed. This demonstrates that the ID-US scheme maintains the confidentiality of the verifier’s credentials, which is a critical requirement for achieving the deniable/undeniable property of the scheme—namely, that the verifier cannot fabricate valid transcripts to later falsely attribute signatures to the signer.

In total, these test results show that this ID-US has no attack weak points from the perspectives of KGC, signer, and verifier, so it is correct and secure.

6.2. Efficiency Analysis

This section first analyzes the efficiency of the proposed ID-US with similar schemes of Li and He et al. 2024 [7], Li and Shen et al. 2023 [8], Chen et al. 2026 [9], Dey et al. 2024 [36], Almende et al. 2025 [37] published in recent years. Then, the performance of the proposed model and ID-US scheme is evaluated.

6.2.1. Efficiency Comparison

The comparisons of key sizes for $Pk$, $Sk$, and Signature are presented in Table 1. This table applies the same comparison format and unifies the system parameters. The items of this ID-US scheme have certain advantages, as the $Pk$ is smaller than that in schemes [7,8,9], the $Sk$ is smaller than those in schemes [7,36], and the Signature is slightly smaller than that in schemes [8,9]. The smaller key size can save storage space and improve the processing speed for data sharing among different IoT devices. More importantly, this ID-US scheme has an identity mechanism that can provide a traceable mechanism for transaction disputes.

Table 1.

Key size comparison.

Items	$\mathit{Pk}$	$\mathit{Sk}$	Signature
Li and He et al. 2024 [7]	$2mn\log q$	$2m^2\log q$	$(m+n+mn)\log q$
Li and Shen et al. 2023 [8]	$mn\log 2q$	$mn\log 2q$	$(m+n+mn)\log 2q$
Chen et al. 2026 [9]	$mn\log 2q$	$mn\log 2q$	$(m+n+mn)\log 2q$
Dey et al. 2024 [36]	$mn\log q$	$(2m^2+1)\log q$	$(m+n+mn)\log q$
Almende et al. 2025 [37]	$mn\log q$	$m^2\log q$	$(m+n+mn)\log q$
This ID-US	$mn\log q$	$m^2\log q$	$(m+n+mn)\log q$

Meanwhile, the time cost comparisons for KeyGen., Sign, Verify, and Confirm./Disav. are presented in Table 2. Here, the same comparison form is also applied. $T_{MMV}$ is the multiplication of a matrix and a vector, $T_{MMM}$ is the multiplication of two matrices, $T_{AVV}$ is the addition of two vectors, $T_{AMM}$ is the addition of two matrices, $T_H$ is the hash algorithm (SHA 256), $T_{Trap}$ is the trapdoor, and $T_{Samp}$ is the SamplePre. These items influence the execution time of the ID-US scheme. Less execution time will improve the transaction processing time. The items of this ID-US scheme have certain advantages.

Table 2.

Time costs comparison.

Items	KeyGen.	Sign	Verify	Confirm./Disav.
Li and He et al. 2024 [7]	$2T_{MMM}+2T_{AMM}$	$2T_H+3T_{MMM}+2T_{MMV}+2T_{AMM}+T_{AVV}$	–	$T_H+2T_{MMM}+T_{AMM}$
Li and Shen et al. 2023 [8]	$T_{Trap}+T_H+T_{MMV}$	$2T_H+3T_{MMV}+2T_{AVV}$	$T_H+2T_{MMV}+2T_{AVV}$	$5T_H+3T_{MMV}+3T_{AVV}$
Chen et al. 2026 [9]	$T_{Trap}+T_H+T_{MMV}+2T_{MMM}$	$2T_H+3T_{MMV}+2T_{AVV}$	$T_H+2T_{MMV}+2T_{AVV}$	$5T_H+3T_{MMV}+3T_{AVV}$
Dey et al. 2024 [36]	$T_{Trap}+T_H+T_{MMV}$	$2T_H+T_{Samp}+T_{MMV}$	$T_{MMV}$	$4T_H+4T_{MMV}+2T_{AMM}+3T_{AVV}$
Almende et al. 2025 [37]	$T_{Trap}+T_H+T_{MMV}+T_{AVV}$	$2T_H+T_{Samp}+2T_{MMV}+T_{MMM}+T_{AMM}+2T_{AVV}$	$T_{MMM}+T_{AMM}$	$5T_H+3T_{MMV}+8T_{AVV}$
This ID-US	$T_{Samp}+2T_H+T_{MMV}$	$2T_H+3T_{MMV}+T_{AVV}+T_{AMM}$	$T_H+2T_{MMV}+2T_{AMM}$	$5T_H+3T_{MMV}+3T_{AVV}$

6.2.2. Performance Evaluation

To clearly show the differences between this ID-US and similar schemes, the performance is evaluated on a Windows 11 desktop with an Intel Core i7-9700 CPU at 3.2 GHz and 16 GB RAM.

As shown in Figure 3, Figure 4 and Figure 5, the key size performances are presented. Here, four security levels are selected, which use the same settings as in [9]. The 80-bit level is with the system parameters $n=256$, $m=2312$, and $q=2^{10}$, 128-bit is with the system parameters $n=512$, $m=5549$, and $q=2^{12}$, 192-bit is with the system parameters $n=768$, $m=9710$, and $q=2^{14}$, and 256-bit is with the system parameters $n=1024$, $m=14796$, and $q=2^{16}$. Here, the 80/128/192-bit security corresponds to the security level of classical encryption. The results show that this ID-US scheme has certain advantages over similar schemes. These performance results are consistent with the theoretical analysis as shown in Table 1.

Figure 3.

$Pk$ size comparison [7,8,9,36,37].

Figure 4.

$Sk$ size comparison [7,8,9,36,37].

Figure 5.

Signature size comparison [7,8,9,36,37].

In Figure 6, the performance of time costs is presented. Here, the time consumption of every operation item is executed in the aforementioned environment. $T_{MMV}=0.01$ ms, $T_{MMM}=0.1$ ms, $T_{AVV}=0.003$ ms, $T_{AMM}=0.01$ ms, $T_H=0.008$ ms, $T_{Trap}=2$ ms, and $T_{Samp}=2$ ms, which are set by performing 100 calculations in the aforementioned environment and averaging the results. The execution results are shown in Table 3. For KeyGen., the time costs remain at the same level, although it uses the Sample algorithm to generate the private key. For Sign, the time costs have a big advantage over those in schemes [7,36,37] as there is no need for $T_{Trap}$ and $T_{Samp}$ algorithms with high time consumption. For verification, the time costs have a big advantage over those in scheme [37]. For the Confirm./Disav., the time costs have a big advantage over those in schemes [7,36,37]. These performance results are consistent with the theoretical analysis as shown in Table 2. Therefore, the proposed ID-US can support more efficient transaction verification and IoT data sharing.

Figure 6.

Time consumption comparison [7,8,9,36,37].

Table 3.

Time costs execution comparison.

Items	KeyGen.	Sign	Verify	Confirm./Disav.
Li and He et al. 2024 [7]	0.22	0.359	–	0.218
Li and Shen et al. 2023 [8]	2.018	0.052	0.034	0.079
Chen et al. 2026 [9]	2.218	0.052	0.034	0.079
Dey et al. 2024 [36]	2.018	2.026	0.01	0.098
Almende et al. 2025 [37]	2.021	2.152	0.11	0.094
This ID-US	2.026	0.059	0.048	0.079

6.3. Energy Consumption and Transaction Latency

To prove the application ability of the proposed ID-US scheme, an IoT device with the configuration of 3.0 V and 7.5 mA is selected. The total time consumption is composed of four algorithms: KeyGen., Sign, Verify, and Confirm./Disav. For example, the total time consumption of this ID-US scheme is 2.212 ms, so the energy consumption is $2.212\ast 3.0\ast 7.5=49.77$ J. With the same IoT device, the other five related schemes are also computed, and the comparison results are shown in Figure 7.

Figure 7.

Energy comparison [7,8,9,36,37].

To verify the effectiveness of the proposed controlled verification model, the transaction latency has been measured and compared with Hyperledger (HL). It simulates five IoT nodes, and the transaction (Tx.) number increases from 200 to 1400. For the transaction throughput, all the test transactions are correctly verified, packaged, and recorded. The main difference is the transaction latency, which reflects the efficiency of IoT data transaction execution. Three items of “CreateAccount”, “Query”, and “Transaction” are selected. Then, the simulation results are shown in Figure 8. Here, the dotted and solid lines represent the proposed controlled verification model and HL, respectively. Although the controlled verification model is equipped with the post-quantum lattice-based signature scheme, it does not influence the transaction latency compared with HL. Therefore, the proposed controlled verification model can maintain low transaction latency while supporting secure transactions.

Figure 8.

Latency comparison.

7. Conclusions

This work utilizes the blockchain and ID-US scheme to establish a controlled verification model for IoT networks. The blockchain technology helps to establish a secure IoT data-sharing channel, and the distributed ledger also guarantees IoT data immutability and message non-loss. Meanwhile, this ID-US scheme applies an undeniable mechanism to achieve message undeniability, and the identity mechanism to guarantee message traceability. It can also provide anti-quantum capability for IoT networks in the near-future quantum computer age. Moreover, the security proof in ROM shows that this ID-US can obtain the security properties of soundness and unforgeability. In addition, this ID-US scheme has no attack weak points in the Scyther test, and the efficiency comparison results show that it has certain advantages over similar schemes in key size, time consumption, and transaction latency. Therefore, the proposed controlled verification model and ID-US scheme are suitable for protecting IoT data sharing through different IoT devices and networks.

In the future, effort will focus on the practical application of this ID-US. Meanwhile, solution improvement and performance optimization with resource-constrained IoT devices with related post-quantum signature algorithms will also be carried out.

Author Contributions

Conceptualization, methodology, validation, J.C., C.L., and S.L.; writing—original draft preparation, formal analysis, J.C., R.L., C.L., and H.A.; writing—review and editing, supervision, funding acquisition, C.L., H.A., and S.L. All authors have read and agreed to the published version of the manuscript.

Institutional Review Board Statement

Not applicable.

Informed Consent Statement

Not applicable.

Data Availability Statement

The original contributions presented in this study are included in this article. Further inquiries can be directed to the corresponding author.

Conflicts of Interest

The authors declare no conflicts of interest.

Funding Statement

This work was supported by the National Natural Science Foundation of China under grant numbers 72293583, 72293580; in part by the Foundation and Cutting-Edge Technologies Research Program of Henan Province (CN) under grant 262102210202, grant 26210221113, and grant 262102210208; in part by the Proof-of-Concept Project in ZZULI Research Institute of Industry Technology under grant YJYGNYZ-2025001; and in part by the Doctor Scientific Research Fund of Zhengzhou University of Light Industry under grant 2021BSJJ033.