{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T05:00:53Z","timestamp":1790226053741,"version":"4.1.0"},"reference-count":46,"publisher":"MDPI AG","issue":"18","license":[{"start":{"date-parts":[[2026,9,20]],"date-time":"2026-09-20T00:00:00Z","timestamp":1789862400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>IoT deployments handle credential hygiene reactively: cloned, replayed, or stale credentials are typically discovered only after misuse, and revocation state is often propagated through centralized lists whose integrity cannot be independently verified. This article introduces the Yang\u2013Baxter IoT Consistency Gateway (YB-IoT-CG), a Zero-Trust admission-control framework that pushes an algebraic layer of credential screening to the edge and anchors security evidence on a modeled permissioned-ledger architecture. YB-IoT-CG operates after conventional secret-based authentication and Yang\u2013Baxter equality is used as an execution-consistency invariant rather than as proof of device identity or message authenticity. Each authenticated message is hashed into a digest and reduced to an algebraic transcript that is verified over two Yang\u2013Baxter traversal paths. Beyond equality checking, chain-proximity metrics inspired by time\u2013memory trade-off analysis, nonce and timestamp freshness heuristics, and contextual risk scoring identify credentials that should be proactively challenged or revoked before telemetry is admitted. The proactive risk component is deterministic and policy-based rather than a learned predictive model. Decisions are batched into Merkle trees whose roots are represented through a permissioned-ledger model, credential revocation is propagated through a modeled on-chain registry, and device identities are bound to W3C Decentralized Identifiers (DIDs) with verifiable credentials. This design provides tamper-evident audit support while keeping ledger interaction off the packet decision path. Validation is based on a controlled Python 3.13.7 packet-level simulation and a parameterized ledger model, not on a physical IoT or live Hyperledger Fabric deployment. Across 60 seeded simulation runs, the complete post-authentication screening pipeline obtained a median incremental decision time of 7.8 \u03bcs, 99.4% aggregate decision accuracy for the modeled attack classes, a 0.43% false rejection rate, and a 31.4 ms amortized ledger service-time equivalent per decision for a batch size of 64. The 99.4% value is a property of the composed freshness\/context\/registry\/YB policy and is not a YB-only detection rate; the YB-specific positive guarantee is limited to the isolated fault class of Proposition 7. These results provide simulation-based evidence supporting a lightweight, explainable, auditable, and proactive approach to credential hygiene at the edge.<\/jats:p>","DOI":"10.3390\/s26185960","type":"journal-article","created":{"date-parts":[[2026,9,22]],"date-time":"2026-09-22T10:21:48Z","timestamp":1790072508000},"page":"5960","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Blockchain-Backed Revocation and Yang\u2013Baxter Consistency Screening for Zero-Trust IoT Admission Control"],"prefix":"10.3390","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-5622-6939","authenticated-orcid":false,"given":"Yair E.","family":"Rivera-Julio","sequence":"first","affiliation":[{"name":"Department of Computer Systems Engineering, Corporaci\u00f3n Universitaria Americana, Barranquilla 080002, Colombia"},{"name":"Department of Productivity and Data, Faculty of Engineering, Universidad Aut\u00f3noma del Caribe, Barranquilla 080020, Colombia"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"conceptualization","vocabulary":"credit"},{"role":"software","vocabulary":"credit"},{"role":"investigation","vocabulary":"credit"},{"role":"data-curation","vocabulary":"credit"},{"role":"writing-original-draft","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2468-370X","authenticated-orcid":false,"given":"Esmeide A.","family":"Leal-Narv\u00e1ez","sequence":"additional","affiliation":[{"name":"Department of Productivity and Data, Faculty of Engineering, Universidad Aut\u00f3noma del Caribe, Barranquilla 080020, Colombia"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"validation","vocabulary":"credit"},{"role":"resources","vocabulary":"credit"},{"role":"visualization","vocabulary":"credit"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8175-2201","authenticated-orcid":false,"given":"Javier Prieto","family":"Tejedor","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Automation, Faculty of Science, University of Salamanca, 37008 Salamanca, Spain"}],"role":[{"vocabulary":"crossref","role":"author"},{"role":"methodology","vocabulary":"credit"},{"role":"formal-analysis","vocabulary":"credit"},{"role":"writing-review-editing","vocabulary":"credit"},{"role":"supervision","vocabulary":"credit"},{"role":"project-administration","vocabulary":"credit"},{"role":"funding-acquisition","vocabulary":"credit"}]}],"member":"1968","published-online":{"date-parts":[[2026,9,20]]},"reference":[{"key":"ref_1","first-page":"8","article-title":"Internet of Things: A survey on the security of IoT frameworks","volume":"38","author":"Ammar","year":"2018","journal-title":"J. Inf. Secur. Appl."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Rose, S., Borchert, O., Mitchell, S., and Connelly, S. (2020). Zero Trust Architecture, NIST Special Publication 800-207.","DOI":"10.6028\/NIST.SP.800-207"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"153","DOI":"10.1016\/j.jalgebra.2006.03.040","article-title":"Braces, radical rings, and the quantum Yang\u2013Baxter equation","volume":"307","author":"Rump","year":"2007","journal-title":"J. Algebra"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"401","DOI":"10.1109\/TIT.1980.1056220","article-title":"A cryptanalytic time-memory trade-off","volume":"26","author":"Hellman","year":"1980","journal-title":"IEEE Trans. Inf. Theory"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"369","DOI":"10.1007\/3-540-48184-2_32","article-title":"A digital signature based on a conventional encryption function","volume":"Volume 293","author":"Pomerance","year":"1988","journal-title":"Advances in Cryptology\u2014CRYPTO \u201987"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Androulaki, E., Barger, A., Bortnikov, V., Cachin, C., Christidis, K., Caro, A.D., Enyeart, D., Ferris, C., Laventman, G., and Manevich, Y. (2018, January 23\u201326). Hyperledger Fabric: A distributed operating system for permissioned blockchains. Proceedings of the Thirteenth EuroSys Conference (EuroSys \u201918), Porto, Portugal.","DOI":"10.1145\/3190508.3190538"},{"key":"ref_7","unstructured":"Sporny, M., Longley, D., Sabadello, M., Reed, D., Steele, O., and Allen, C. (2026, July 28). Decentralized Identifiers (DIDs) v1.0: Core Architecture, Data Model, and Representations. W3C Recommendation. Available online: https:\/\/www.w3.org\/TR\/did\/."},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"154066","DOI":"10.1109\/ACCESS.2024.3484522","article-title":"A Zero-Trust Authentication Scheme With Access Control for 6G-Enabled IoT Environments","volume":"12","author":"Son","year":"2024","journal-title":"IEEE Access"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"3321","DOI":"10.1109\/JIOT.2021.3098007","article-title":"Blockchain-Based Secure and Lightweight Authentication for Internet of Things","volume":"9","author":"Yang","year":"2022","journal-title":"IEEE Internet Things J."},{"key":"ref_10","unstructured":"O\u2019Connor, J., Aumasson, J.-P., Neves, S., and Wilcox-O\u2019Hearn, Z. (2026, July 28). BLAKE3: One Function, Fast Everywhere; Author-Published Specification, 2020. Available online: https:\/\/github.com\/BLAKE3-team\/BLAKE3-specs."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"9599","DOI":"10.1109\/JIOT.2023.3323614","article-title":"Security-Enhanced Lightweight and Anonymity-Preserving User Authentication Scheme for IoT-Based Healthcare","volume":"11","author":"Zhou","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"3348","DOI":"10.1109\/JIOT.2023.3297237","article-title":"BSRA: Blockchain-Based Secure Remote Authentication Scheme for Fog-Enabled Internet of Things","volume":"11","author":"Guo","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"36379","DOI":"10.1109\/ACCESS.2023.3265349","article-title":"TABI: Trust-Based ABAC Mechanism for Edge-IoT Using Blockchain Technology","volume":"11","author":"Pathak","year":"2023","journal-title":"IEEE Access"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"118618","DOI":"10.1109\/ACCESS.2024.3450313","article-title":"Blockchain-Enhanced Zero Knowledge Proof-Based Privacy-Preserving Mutual Authentication for IoT Networks","volume":"12","author":"Pathak","year":"2024","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"5888","DOI":"10.1109\/TNSM.2024.3438621","article-title":"SATI: Sidechain-Based Access Control & Trust Mechanism for IoT Networks","volume":"21","author":"Pathak","year":"2024","journal-title":"IEEE Trans. Netw. Serv. Manag."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Ramirez-Gordillo, T., Macia-Lillo, A., Pujol, F.A., Garcia-D\u2019Urso, N., Azorin-Lopez, J., and Mora, H. (2025). Decentralized Identity Management for Internet of Things (IoT) Devices Using IOTA Blockchain Technology. Future Internet, 17.","DOI":"10.3390\/fi17010049"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"48","DOI":"10.1007\/s43926-025-00104-w","article-title":"Intrusion Detection in IoT Networks Using Machine Learning and Deep Learning Approaches for MitM Attack Mitigation","volume":"5","author":"Ali","year":"2025","journal-title":"Discov. Internet Things"},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"649","DOI":"10.1016\/j.aim.2018.09.005","article-title":"Set-theoretic solutions of the Yang\u2013Baxter equation, braces and symmetric groups","volume":"338","year":"2018","journal-title":"Adv. Math."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"539","DOI":"10.1016\/j.bulsci.2017.06.001","article-title":"Brauer configuration algebras: A generalization of Brauer graph algebras","volume":"141","author":"Green","year":"2017","journal-title":"Bull. Des Sci. Math."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"107714","DOI":"10.1016\/j.future.2025.107714","article-title":"Enhancing IoT security: Assessing instantaneous communication trust to detect man-in-the-middle attacks","volume":"166","author":"Basri","year":"2025","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"20562","DOI":"10.1109\/JIOT.2024.3370375","article-title":"Privacy-Preserving Scheme With Bidirectional Option for Blockchain-Enhanced Logistics Internet of Things","volume":"11","author":"Li","year":"2024","journal-title":"IEEE Internet Things J."},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Nie, S., Ren, J., Wu, R., Han, P., Han, Z., and Wan, W. (2025). Zero-Trust Access Control Mechanism Based on Blockchain and Inner-Product Encryption in the Internet of Things in a 6G Environment. Sensors, 25.","DOI":"10.3390\/s25020550"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Kim, T., Kwon, D., Park, Y., and Park, Y. (2025). Blockchain-Based Secure Authentication Protocol for Fog-Enabled IoT Environments. Mathematics, 13.","DOI":"10.3390\/math13132142"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Wang, J., Huang, N., Wang, B., Ao, R., Fu, Q., and Guo, X. (2025). ZT-IoTrust: A Quantum-Resistant Zero Trust Framework for Secure IoT Access Control. Electronics, 14.","DOI":"10.3390\/electronics14224469"},{"key":"ref_25","doi-asserted-by":"crossref","unstructured":"Saleh, O.A., and Cevik, M. (2025). Blockchain-Integrated Secure Authentication Framework for Smart Grid IoT Using Energy-Aware Consensus Mechanisms. Sensors, 25.","DOI":"10.3390\/s25216622"},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"48047","DOI":"10.1109\/ACCESS.2025.3551261","article-title":"Lightweight Blockchain for Authentication and Authorization in Resource-Constrained IoT Networks","volume":"13","author":"Gutierrez","year":"2025","journal-title":"IEEE Access"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Tariq, N., Asim, M., Al-Obeidat, F., Farooqi, M.Z., Baker, T., Hammoudeh, M., and Ghafir, I. (2019). The Security of Big Data in Fog-Enabled IoT Applications Including Blockchain: A Survey. Sensors, 19.","DOI":"10.3390\/s19081788"},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Dang, Q.H. (2012). Recommendation for Applications Using Approved Hash Algorithms, NIST Special Publication 800-107 Revision 1.","DOI":"10.6028\/NIST.SP.800-107r1"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"401","DOI":"10.1007\/978-3-540-24676-3_24","article-title":"Hash Function Balance and Its Impact on Birthday Attacks","volume":"Volume 3027","author":"Cachin","year":"2004","journal-title":"Advances in Cryptology\u2014EUROCRYPT 2004"},{"key":"ref_30","doi-asserted-by":"crossref","first-page":"617","DOI":"10.1007\/978-3-540-45146-4_36","article-title":"Making a faster cryptanalytic time-memory trade-off","volume":"Volume 2729","author":"Boneh","year":"2003","journal-title":"Advances in Cryptology\u2014CRYPTO 2003"},{"key":"ref_31","unstructured":"Bellare, M., and Rogaway, P. (2005). The birthday problem. Introduction to Modern Cryptography, University of California, Davis. Appendix A."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1109\/MC.2017.9","article-title":"The emergence of edge computing","volume":"50","author":"Satyanarayanan","year":"2017","journal-title":"Computer"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"99","DOI":"10.1007\/BF00196791","article-title":"How to time-stamp a digital document","volume":"3","author":"Haber","year":"1991","journal-title":"J. Cryptol."},{"key":"ref_34","unstructured":"Menezes, A.J., van Oorschot, P.C., and Vanstone, S.A. (1996). Handbook of Applied Cryptography, CRC Press."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Rescorla, E. (2026, July 28). The Transport Layer Security (TLS) Protocol Version 1.3. Internet Engineering Task Force, RFC 8446. Available online: https:\/\/www.rfc-editor.org\/info\/rfc8446\/.","DOI":"10.17487\/RFC9846"},{"key":"ref_36","unstructured":"Tschofenig, H., and Fossati, T. (2026, July 28). Transport Layer Security (TLS)\/Datagram Transport Layer Security (DTLS) Profiles for the Internet of Things. Internet Engineering Task Force, RFC 7925. Available online: https:\/\/www.rfc-editor.org\/info\/rfc7925\/."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Fagan, M., Megas, K.N., Scarfone, K., and Smith, M. (2020). IoT Device Cybersecurity Capability Core Baseline, NISTIR 8259A.","DOI":"10.6028\/NIST.IR.8259a"},{"key":"ref_38","unstructured":"Banks, A., Briggs, E., Borgendale, K., and Gupta, R. (2019). MQTT Version 5.0, OASIS Standard."},{"key":"ref_39","unstructured":"Shelby, Z., Hartke, K., and Bormann, C. (2026, July 28). The Constrained Application Protocol (CoAP). Internet Engineering Task Force, RFC 7252. Available online: https:\/\/www.rfc-editor.org\/info\/rfc7252\/."},{"key":"ref_40","unstructured":"Rescorla, E., Tschofenig, H., and Modadugu, N. (2026, July 28). The Datagram Transport Layer Security (DTLS) Protocol Version 1.3. Internet Engineering Task Force, RFC 9147. Available online: https:\/\/www.rfc-editor.org\/info\/rfc9147\/."},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"599","DOI":"10.1016\/j.future.2008.12.001","article-title":"Cloud computing and emerging IT platforms: Vision, hype, and reality for delivering computing as the 5th utility","volume":"25","author":"Buyya","year":"2009","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_42","unstructured":"Wood, G. (2025, February 04). Ethereum: A Secure Decentralised Generalised Transaction Ledger. Ethereum Project Yellow Paper. Available online: https:\/\/ethereum.github.io\/yellowpaper\/paper.pdf."},{"key":"ref_43","unstructured":"Law, A.M. (2015). Simulation Modeling and Analysis, McGraw-Hill. [5th ed.]."},{"key":"ref_44","unstructured":"Jain, R. (1991). The Art of Computer Systems Performance Analysis: Techniques for Experimental Design, Measurement, Simulation, and Modeling, Wiley."},{"key":"ref_45","unstructured":"Montgomery, D.C. (2017). Design and Analysis of Experiments, Wiley. [9th ed.]."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Julio, Y.R., Pinto Mangones, A., Torres Tovio, J., G\u00f3mez-\u00c1lvarez, M.C., and Salcedo, D. (2025). Integration of OWL Password-Authenticated Key Exchange Protocol to Enhance IoT Application Protocols. Sensors, 25.","DOI":"10.3390\/s25082468"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5960\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,24]],"date-time":"2026-09-24T04:14:25Z","timestamp":1790223265000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/26\/18\/5960"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,9,20]]},"references-count":46,"journal-issue":{"issue":"18","published-online":{"date-parts":[[2026,9]]}},"alternative-id":["s26185960"],"URL":"https:\/\/doi.org\/10.3390\/s26185960","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,9,20]]}}}