Mutable Permissioned Blockchain-based System for Node Authentication in Distributed Networks

Nonlinear Phenomena in Complex Systems, vol. 28, no. 3 (2025), pp. 280 - 288 Mutable Permissioned Blockchain-based System for Node Authentication in Distributed Networks N. N. Shenets∗and A. S. Konoplev† Peter the Great St. Petersburg Polytechnic University, Sankt-Peterburg, RUSSIA (Received 12 June, 2025) The paper provides a comparative analysis of node authentication solutions in distributed networks. The advantages of symmetric cryptography usage are shown in conditions of limited network node resources. Different distributed ledger architectures for data storage identification are considered. There is a system proposed for node authentication in distributed networks based on mutable permissioned blockchain. AMS Subject Classification: 11T71 Keywords: distributed ledger, mutable blockchain, permissioned blockchain, node authentication DOI: https://doi.org/10.5281/zenodo.17241219 1. Introduction Distributed computer networks based on wireless connections and self-organization technologies are currently used everywhere and are increasingly replacing classical networks with centralized architecture. MANET (Mobile Ad hoc NETworks) are wireless networks consisting of mobile devices that can move freely and connect to each other without the need for a central infrastructure such as base stations or routers [1, 2]. Such networks are often used in situations where traditional infrastructure is unavailable or impractical, such as in emergency zones, war zones, or remote areas that are hard to reach. There are key features of MANET [3]: 1. Lack of centralized infrastructure. The devices in MANET interact directly with each other, forming a self-organizing (mesh) network. 2. Dynamic topology. The devices in a MANET can move freely, leading to frequent changes in the network topology. 3. Limited resources. Devices in a MANET ∗E-mail: shenets\[email protected] †E-mail: konoplev\[email protected] typically have limited resources, such as battery, memory, and computing power. 4. Multihop routing. Data packets may travel through multiple intermediate devices to reach their destination. The architectural and topological features of MANET create the conditions for a wide range of attacks on network nodes by a potential intruder. The most well-known computer attacks on such networks include [4]: •Black Hole Attack, in which a compromised node intercepts all transmitted data packets, but does not forward them to the destination node; •Sybil Attack, in which an attacker creates and controls multiple fake nodes in a network, forcing victim nodes to interact exclusively with nodes under his control, thereby gaining a "man-in-themiddle"position; •Wormhole Attack, in which the correct sequence of data transmission between different network nodes is disrupted, creating false routing. The underlying premise of the types of attack considered is that one or more false nodes 280 Mutable Permissioned Blockchain-based System for Node Authentication in Distributed Networks 281 controlled by the attacker manage to establish trust relationships with legitimate network nodes. Thus, it becomes obvious that the strategy to mitigate computer attacks in MANET should be based on effective mechanisms for mutual authentication of network nodes. Therefore, we propose a new identification and authentication system for ad hoc networks such as MANET/FANET that uses mutable permissioned blickchain and authenticated key pre-distribution [5] based on ideal additively homomorphic secret sharing. To do this, we replaced the classical Public Key Infrastructure (PKI) with a blockchain system. During registration, a new block of the blockchain network is generated for each party instead of a certificate. The mutability property allows for maintaining a fixed blockchain size even when participant "certificates"are revoked as exactly one block is allocated per participant in the network. The paper is organized as follows. In Section 2 we provide related works. Section 3 contains a short overview of blockchain technology. Section 4 describes the proposed identification and authentication system. Finally, we discuss it in conclusions. 2. Related works Confidence in interaction participants (nodes) in classical networks (which do not have the properties of self-organization and unclear structures) is traditionally determined by means of a mutual authentication mechanism. As a result, the security of routing protocols in selforganizing networks with dynamic architecture is generally provided by the introduction of cryptographic mechanisms, such as the hashing and digital signature of messages [6]. For the successful application of these methods, a selforganizing network must have a certification center and the use of cryptographic certificates (Public Key Infrastructure, PKI), which will ensure the parties authentication, data integrity and non-repudiation. However, the main PKI standard (X.509) has multiple weaknesses [7]. In addition, in most MANET networks, it is difficult to specify any central node which is expected to be the certification or authority center because of the high decentralization and mobility of such networks. In [8] it is proposed to use an extension of the OSPFv3 dynamic routing protocol for MANET, which has the property of adaptability to changes in the network, disruptions in communication between nodes and a high convergence rate. The control messages in the proposed solution are authenticated using public-key cryptography and a Web of Trust model. In [9] an adaptive topology management method is proposed that complements the OSPFv3 extension for MANET networks with the function of protecting link state messages and other control messages (authentication and reputation data, geotags, etc.), based on blockchain technology. In [10] a blockchain-decentralized PKI model was proposed as an alternative solution for the X.509 centralized PKI in decentralized architecture computing networks. A Secure Communication Protocol for AdHoc Wireless Sensor Networks is proposed in [11]. It is also based on a PKI and provides authentication of network nodes using the DiffieHellman protocol, as well as fast re-authentication using temporary certificates. Protection against replay attacks is implemented by generating a list of one-time keys for each message. Although this mechanism protects against the specified attack, it creates the preconditions for other attacks. In [12] a set of SPINS security protocols is proposed for mobile Ad-Hoc networks. The security in SPINS is entrusted by two protocols: µTESLA and SNEP. The first provides the authentication of messages on the broadcast channel. The second manages the secure communication channel and supports message authentication using MAC (message authentication code). An analysis of MANET security related Nonlinear Phenomena in Complex Systems Vol. 28, no. 3, 2025 282 N. N. Shenets and A. S. Konoplev works showed that for authentication protocols and pairwise key establishment, asymmetric cryptography on elliptic curves (ECDHE) is typically used. This is because elliptic curve point group authentication protocols have better performance than others protocols at the same level of security. In other words, they are better suited for devices with low computing power. This is especially important for mobile distributed networks belonging to the FANET (Flying Ad Hoc Network) class. It is a special type of peer-topeer self-organizing network based on unmanned aerial vehicles (UAV) [13]. Such networks, in comparison with other types of mobile distributed network, are characterized by a high frequency of topology changes (and as a consequence the need to interact with a large number of new nodes in the network), as well as a significant lack of computing resources of nodes, caused, among other things, by limited power supply. At the same time, there are a number of protecting means and protocols which are based only on symmetric cryptography. When such mechanisms are used, low-power devices consume an order of magnitude less energy. Therefore, we set ourselves the goal of organizing key management and ensuring the security of communications in networks using only symmetric methods. To solve this problem, in the paper [5] we proposed using protocols for preliminary key distribution based on an ideal additively homomorphic secret sharing scheme [14–20]. In this case, each network node receives a fixed-length share, and authentication and pairwise key establishment protocols provide perfect resistance to an external adversary. But we also need to develop an identification system that holds all public keys and the identifiers of the parties. In this paper, we propose a solution to this problem. 3. Overview of blockchain technology Blockchain is a distributed database that tracks a growing list of ordered records known as blocks [21]. Each block has a timestamp and a link to the previous block, forming a chain of blocks. This structure enables the database to be securely shared among multiple parties without needing centralized authority. Data on a blockchain are typically organized into a ledger, which is a record of all transactions that have occurred on the network. Each transaction is a digitally signed record of the transfer of value between two or more parties. One of the most important characteristics of a blockchain is that it is decentralized, which means that it is not controlled by a single authority. Instead, the network is maintained by a network of participating nodes, each of which holds a copy of the entire ledger. This decentralized structure provides greater security and transparency because it is much more difficult for a single entity to manipulate or censor the data on the blockchain. This also means that there is no single point of failure and that the ledger is impervious to tampering or censorship. To ensure the proper functioning of a blockchain, there are different (often overlapping) categories of network participants, each of which plays an important role: •Miners. These are the organizations responsible for ordering and packaging transactions into blocks, which are then submitted to the network for verification. If two valid blocks are produced at the same time, miners are responsible for determining which version of the chain is canonical (e.g., by the longest chain rule). A consensus algorithm is used to determine which miner is responsible for generating the next block in the block chain; •Full (stationary) nodes. This is the core of the blockchain network. The full nodes download and independently verify each Нелинейные явления в сложных системах Т. 28, № 3, 2025 Mutable Permissioned Blockchain-based System for Node Authentication in Distributed Networks 283 block proposed by the miners. If the block is considered valid (i.e. the protocol rules have been followed), the block is added to the full node’s private copy of the ledger, and the state of the blockchain is changed. Any invalid blocks that do not comply with the protocol rules are ignored and, accordingly, discarded without any changes; •Archive nodes. These are entities that store all the same information as full nodes, but also calculate and store previous states of the blockchain. Archive nodes are useful for querying arbitrary historical data, such as a user’s account balance at a certain block height in the past. A full node can be converted to an archive node at any time without having to download additional information from the network. Archive nodes tend to have high hardware requirements and are commonly used by service providers; •Lightweight (regular) nodes. This is a limited form of full nodes, where only the headers (that is, small unique cryptographic fingerprints) of the blocks are downloaded. Lightweight nodes can check whether a transaction was included in a block, but because they do not download and execute all the transactions in blocks, they implicitly trust that the majority of block producers are honest. •RPC Providers. These are full nodes that facilitate read/write access to the blockchain that other network participants connect to. RPC (Remote Procedure Call) nodes are often used by those who do not have or cannot run their own full or light node, greatly reducing the friction of accessing the blockchain. Any user connected to an RPC provider implicitly trusts it, since no self-verification work is performed; •End users. These are regular users who want to transact on the blockchain network. This category can include participants who run a full or light node, as well as those who are connected to an RPC provider. The blockchain exists to serve end users; otherwise, there is no other reason for the network to exist. Blockchain technology is available in a variety of forms today. Some blockchains have been designed to meet the needs of a small number of users with restricted network access. These are examples of permissioned or private blockchains. Other types of blockchains include the public blockchain, consortium blockchain, andmutable blockchain (redactable/editable). A public blockchain, such as Bitcoin, is one in which anyone can join and participate. In contrast, in a private blockchain, an organization governs the network, deciding who can participate, running a consensus protocol, and maintaining the shared ledger. Businesses that create a private blockchain typically create a permissioned blockchain network. This limits who is permitted to participate in the network and in what transactions. Participants must obtain an invitation or permission to participate. A consortium blockchain is ideal for a business situation in which all participants must be authorized and share responsibility for the blockchain. Usually, the chain of blocks on the blockchain is created in such a way that it is impossible to forge it or replace any block. However, in some situations, it is convenient to have the opportunity to update information about a transaction. For these purposes, a mutable (editable) blockchain has been developed. In such a system, the right to edit is granted to a subset of selected participants. The network uses a consensus mechanism to agree on the state of the ledger to maintain its integrity. This usually entails a complex process of verifying transactions and adding them to the ledger in a difficult-to-reverse manner. This ensures that once a transaction has been added to the ledger, it cannot be changed or Nonlinear Phenomena in Complex Systems Vol. 28, no. 3, 2025 284 N. N. Shenets and A. S. Konoplev deleted without the network’s approval. The most common consensus algorithms are Proofof-Work (PoW), Proof-of-Stake (PoS) and Proofof-Identity (also known as Proof-of-Authority, PoAuth), but there are a number of other algorithms specified for different purposes. In PoW, miners compete against each other to solve extremely complex computational puzzles using powerful computers. The first to find a 64digit hexadecimal number (hash) wins the right to form a new block and confirm transactions. The successful miner is also rewarded with a predetermined amount of cryptocurrency, known as the "block reward". In a proof-of-stake (PoS) system, miners must put up their "stake"in the form of digital currency to have a chance of being randomly selected as a validator. Unlike PoW, where miners are incentivized by block rewards, those who contribute to a PoS system simply receive a transaction fee. PoAuth works by selecting its validators based on reputation. In PoAuth, validators do not "stake"in staking. Instead, they must stake their reputation for the right to validate blocks. This is very different from most blockchain protocols, which typically do not require revealing oneвЂTMs identity to participate. Since this mechanism requires virtually no computing power, it is much less resource-intensive than some of its predecessors, particularly PoW. The blockchain’s ability to provide verifiable, tamper-evident transaction records is made possible through the use of cryptographic techniques such as digital signatures and hashes, which allow each network participant to validate the authority and integrity of the data on the blockchain. 4. Blockchain-based system for node authentication in distributed networks Most of the approaches considered aimed to mutual node authentication in MANET are based on asymmetric cryptography. However, MANET nodes are characterized by limited computing capabilities and a limited power supply. For these reasons, to ensure the security of communications (including protection of transmitted data between network nodes from interception and alteration, mutual authentication of network nodes, and protection from impersonation attacks) in such networks, a lightweight cryptography should be applied. Lightweight cryptography is a branch of cryptography that aims to develop algorithms for use in devices that cannot provide most existing ciphers with sufficient resources (memory, power supply, size) for their operation. Lightweight cryptography is concerned with providing cryptographic solutions that use less memory, less computing resources, and less power supplies to perform the required cryptographic operations while maintaining strong security measures. Due to the high decentralization and mobility of MANET nodes, secure distributed ledger technology (blockchain) can be used. The blockchain is a distributed database that provides trusted data exchange between network devices. The storage devices are not connected to a common server, but are a peer-to-peer network with decentralized architecture. The blockchainbased database is presented as blocks that are linked to each other through cryptographic verification. The data in the blockchain has a chronological sequence, as it is impossible to make changes to blocks or delete them. Lightweight algorithms for blockchain-based MANET architecture should include: 1. Lightweight hash functions. Hash functions should provide the ability to construct lightweight Merkle trees (e.g. PHOTON, SPONGENT, Quark). 2. Lightweight storage. Several types of nodes should store different amount of data (e.g. Simplified Payment Verification): •stationary nodes (verifiers) store the whole blockchain; Нелинейные явления в сложных системах Т. 28, № 3, 2025 Mutable Permissioned Blockchain-based System for Node Authentication in Distributed Networks 285 •mobile (regular) nodes store only the headers of the blocks. 3. Lightweight consensus algorithm. Regular nodes should not use resourceintensive cryptographic algorithms to verify transactions and add new blocks. Refusing to use asymmetric cryptographic algorithms in MANET leads to the fact that network nodes cannot independently verify the electronic digital signature. Therefore, it makes sense to replace the signature verification procedure with a formal check of the presence of an identifier on the blockchain. Unlike PKI, where each node stores only the root certificate, in a blockchain-based network, each node stores the entire chain of blocks and trusts only those nodes that form it. For very low-power constrained devices like UAVs we recommend also to keep only one block containing party identity and credentials. The more powerful nodes, such as base stations and leader nodes, can verify the identities of vehicles during the process of connecting them to the network and provide all the necessary information for communication with others. We see this approach as particularly appropriate in high dynamic networks such as FANET. It is proposed to use mutable permissioned blockchain technology as an identification and authentication system to replace PKI in distributed networks such as MANET (Fig 1) where: OP =REG ∪REV ∪UP D– the list of operations (blockchain transactions): REG ⊂ID ×KEY S– register node with the identifier idi∈ID and key ki∈KEY S, REV ⊂ID– revoke information about the node with identifier idi∈ID, UP D ⊂ID– update information about the registered node with identifier idi∈ID. Permissioned blockchains are blockchain networks that require authorization to participate in. They have a management layer running on top of the blockchain that regulates the actions performed by authorized participants [22]. Permissioned blockchains are designed to take advantage of blockchains without sacrificing the management aspect of a centralized system. The ability to edit such a blockchain is important for "revoking"a node from the network if it is compromised, fails, or if the majority of other nodes do not trust him. The owner of a MANET is usually a specific organization, so only it is responsible for adding or removing devices (their identifiers from the blockchain). For this reason, it seems logical to use a mutable blockchain. The access rights to edit the blockchain should be split between different nodes to eliminate a single point of failure. In addition, this approach increases the network’s security against attacks aimed at compromising control nodes (verifiers). As a mechanism for implementing such a division, it is proposed to use secret sharing schemes. As a consensus algorithm, it is proposed to use Proof-of-Authority. Proof-of-Authority (PoA) is a consensus algorithm in which block and transaction validation is assigned only to trusted nodes (verifiers) [23]. Unlike Proof-of-Work (PoW) and Proof-of-Stake (PoS), PoA does not require energy-intensive computations or token staking. Instead, it relies on the reputation and identification of participants, making it ideal for enterprise, private, and permissioned blockchains. The key advantage of this consensus algorithm in terms of its application in MANET is the Nonlinear Phenomena in Complex Systems Vol. 28, no. 3, 2025 286 N. N. Shenets and A. S. Konoplev FIG. 1: Mutable permissioned blockchain with node authentication data for MANET. absence of a resource-intensive “miningвЂ´к procedure, leading to almost zero energy costs. In addition, it increases the resilience of the network to a number of attacks specific to blockchain technology. In particular, there are no forks since the validator nodes are known in advance. Only trusted verifiers can make changes to the blockchain, including adding new blocks. As a solution for lightweight storage of MANET node data in the blockchain, a combination of Simplified Payment Verification (used in the Bitcoin network, in which resourceconstrained nodes store the headers of the blockchain blocks instead of full blocks) and a blockchain with floating genesis block [24] is proposed. The second is applicable only for networks where transactions have a limited validity period, which corresponds to data transmission in MANET. The complete blockchain can be stored and processed on verifiers, forming the stationary part of the MANET infrastructure. We stress that our key establishment protocol [5] allows one not to worry about impersonation attacks. This is due to the binding between the shares and the public keys (associated with identifiers) of the parties. An adversary cannot impersonate the other party Нелинейные явления в сложных системах Т. 28, № 3, 2025 Mutable Permissioned Blockchain-based System for Node Authentication in Distributed Networks 287 without completely compromising it. Thus, we provide secure communication between nodes using only lightweight symmetric algorithms and protocols. 5. Conclusions In this paper, we propose a new identification and authentication system based on mutable permissioned blockchain that also integrates with authenticated key establishment protocols based on secret sharing. The advantages of our solution are as follows: 1. First, we develop a key management and communication protection system that uses only symmetric cryptographic algorithms. This leads to better performance and savings in device resources. 2. Our identification system replaces PKI with a blockchain that supports fully decentralization. 3. In contrast to other blockchain-based identification system, ours ensures a constant blockchain size, that is, the number of blocks is a quantity of the order O(n), where nis the number of network nodes. 4. We provide anonymity of the parties in the sense that they know only the identifiers and net addresses of each other. Of course, they can introduce themselves to each other in private correspondence. However, their identity will not be confirmed in any way unless they exchange personal data and identification documents. 5. Our key establishment protocols [5] eliminate man-in-the-middle attacks and impersonation attacks due to the binding between the shares and the public keys (associated with identifiers) of the parties. 6. Proof-of-Authority consensus mechanism, which we have chosen, allows us to support any reputation (trust) management system with a very small computational and communication cost. Acknowledgments This work is supported by the Russian Science Foundation (RSF), project number 24-21-00277, https://rscf.ru/project/ 24-21-00277/. References [1] R. Agrawal, N. Faujdar, C. A. T. Romero, O. Sharma, G. M. Abdulsahib, O. I. Khalaf, R. F. Mansoor, and O. A. Ghoneim, Egyptian Informatics Journal 24, 1 (2023) [2] MANET technologies in Russia. Wavenet., electronic Resource: https://leo.ru/faq/articles/manet-tekhnologii-vrossii-volnovaya-set (Access Data 20.05.2025), in Russian. [3] A. Mikov, E. Zamyatina, and S. Kalashnikov, Information technologies 10 53 (2018), in Russian. [4] R. A. Belfer, Bulletin of Bauman Moscow State Technical University. Series: "Instrument Engineering"(2011). [5] N. Shenets, Int. J. Journal Nonlinear Phenomena in Complex System 27, 301 (2024). [6] M. G. Zapata, SIGMOBILE Mob. Comput. Commun. Rev. 6, 106 (2002) [7] A. S. Konoplev and M. O. Kalinin, Int. J. Nonlinear Phenomena in Complex System 22, 277 (2019). [8] R. G. Ogier and P. A. Spagnolo, RFC 5614, 1 (2009), Nonlinear Phenomena in Complex Systems Vol. 28, no. 3, 2025 288 N. N. Shenets and A. S. Konoplev https://api.semanticscholar.org/CorpusID:7804643. [9] A. G. Busygin, A. S. Konoplev, and D. P. Zegzhda, Problems of information security. Computer systems 137 (2018), (in Russian). [10] A. S. Konoplev, A. G. Busygin, and D. P. Zegzhda, Automatic Control and Computer Sciences 52, 1017 (2018). [11] C. Pearce, V. Yin-Man Ma, and P. Bertok. In Proceedings of the 2004 Intelligent Sensors, Sensor Networks and Information Processing Conference, 2004. (2004), pp. 79–84. [12] A. Perrig, R. Szewczyk, J. Tygar, V. Wen, and D. E. Culler, Wireless Networks 8, 521 (2002). [13] A. Gupta, A. Barthwal, H. Vardhan, S. Kakria, S. Kumar, and A. S. Parihar, Multimedia Tools and Applications 82, 42311 (2023). [14] C. Asmuth and J. Bloom, IEEE Trans. on Inf. Theory 29(2), 208 (1983). [15] A. Biemel, in 3-rd International Conference on Coding and Cryptology (IWCC 2011) (Qingdao, China, 2011), vol. 189, pp. 11–46. [16] G. R. Blakely, in National Computer Conference (AFIPS 1979) (Monval, USA, 1979), pp. 313– 317. [17] M. Mignotte, in EUROCRYPT, edited by T. Beth (LNCS, Springer, 1982), vol. 189, pp. 371–375. [18] A. Shamir, Communications of the ACM 22(11), 612 (1979). [19] V. Attasena, J. Darmont, and N. Harbi, The VLDB Journal 26, 657 (2017). [20] N. N. Shenets, Journal of Computer Virology and Hacking Techniques 20, 765 (2024). [21] D. A. Dua and G. Kumar, Mastering ZeroKnowledge Proofs. Practical study of security, scalability, and privacy in blockchain and modern systems (BPB Publications, India, 2024), chap. 1, 1st ed. [22] Introduction to Permissioned Blockchains, electronic Resource: https://101blockchains.com/permissionedblockchain/ (Access Data 13.05.2025). [23] Comsensus algorithm Proof of Authority, electronic Resource: https://docs.wavesenterprise.com/ru/1.1.2/howthe-platform-works/consensus/PoA.html (Access Data 15.05.2025). [24] A. Busygin, A. Konoplev, M. Kalinin, and D. Zegzhda, in Proceedings of the 11th International Conference on Security of Information and Networks (Association for Computing Machinery, New York, NY, USA, 2018). Нелинейные явления в сложных системах Т. 28, № 3, 2025