A Threshold Homomorphic Blockchain Architecture for Secure and Scalable IoT Sensor Data Aggregation

A T HRESHOLD H OMOMORPHIC B LOCKCHAIN A RCHITECTURE FOR S ECURE AND S CALABLE I OT S ENSOR DATA AGGREGATION

arXiv:2608.23396v1 [cs.CR] 24 Aug 2026

Narendra Kumar Dewangan LTCI, Department of Computer Science and Networks (INFRES), Telecom Paris, Institut Polytechnique de Paris, France Mounira Msahli LTCI, Department of Computer Science and Networks (INFRES), Telecom Paris, Institut Polytechnique de Paris, France mounira.msahli@telecom-paris.fr

August 25, 2026

A BSTRACT Homomorphic-encryption blockchain frameworks for IoT sensor data aggregation typically rely on classical cryptographic hardness assumptions to provide on-chain data confidentiality, while rarely considering network topology as a factor affecting liveness and performance. This work introduces Φ-PHE-BC, a topology-aware homomorphic blockchain architecture for secure, privacy-preserving IoT sensor data aggregation, employing threshold Paillier decryption and graph-parameterized performance analysis. Using a network graph G, device capability class D, aggregation function Φ, cryptographic parameter set Λ, and consensus parameters Π, the framework defines a protocol instantiation whose security and performance properties are explicitly connected to the validator graph. We demonstrate that on-chain Paillier ciphertexts enable homomorphic aggregation of sensor readings while achieving standard classical security: IND-CPA security under the Decisional Composite Residuosity (DCR) assumption for aggregation confidentiality, and EUF-CMA security for transaction integrity via authentication signatures. Threshold partial-decryption shares are further protected by a noise-flooding wrapper whose privacy guarantee is information-theoretic under the configured statistical-hiding condition. Under partial synchrony and Byzantine fault-tolerance assumptions, protocol liveness is determined by the validator subgraph satisfying κ(Gv ) ≥ f +1. We further derive topology-parameterized bounds on throughput across tree, star, mesh, and scale-free deployment models, along with an explicit per-block communication-cost model. Our game-theoretic analysis shows that honest participation is a dominant strategy for each validator, yielding an all-honest Nash equilibrium under the stated utility model. The proposed architecture is practical, achieving consistently lower end-to-end latency than the selected traditional PHE-blockchain baseline while maintaining controllable threshold-decryption overhead in Hyperledger Fabric 2.5. The experimental configurations are consolidated in a benchmark table that distinguishes topology scaling, validator sensitivity, threshold decryption, and Byzantine-load experiments. The results indicate that Φ-PHEBC provides a practical solution for secure, privacy-preserving, and topology-aware IoT sensor data aggregation. Keywords: Blockchain; Internet of Things (IoT); Homomorphic Encryption; Threshold Decryption; Network Topology; Byzantine Fault Tolerance; Privacy-Preserving Sensor Data Aggregation.

1

Introduction

Blockchain technology can provide transparency and privacy simultaneously; however, data generated by Internet of Things (IoT) devices may contain highly sensitive information about their owners and may be transmitted over open

A PREPRINT - AUGUST 25, 2026

communication channels. Modern distributed ledger platforms have introduced lighter-weight consensus algorithms and more efficient implementations, yet blockchain security remains challenged by the increasing computational capabilities of adversaries and the continuous advancement of specialized hardware for cryptographic attacks [1]. The Bitcoin protocol [2], for example, employs the Proof-of-Work (PoW) consensus mechanism, which requires substantial computational resources and time for transaction confirmation and block generation. The rapid proliferation of IoT deployments across critical infrastructure domains, including industrial control systems, healthcare monitoring, smart energy grids, and intelligent transportation networks, has generated unprecedented volumes of sensitive operational data that must be processed across distributed network environments [1, 3, 4]. A fundamental tension characterizes this landscape: although the utility of IoT data is maximized through aggregation and cross-organizational analysis, the sensitivity of individual device readings requires raw data to remain confidential, potentially even from infrastructure operators. Blockchain technology has consequently emerged as a promising substrate for IoT data management because of its tamper-resistant ledger, decentralized governance, and programmable smart-contract capabilities [2, 5]. However, the transparency inherent in blockchain architectures—the very property that enables auditability—directly conflicts with data confidentiality requirements, thereby creating a privacy paradox that conventional blockchain deployments cannot adequately resolve. Partially Homomorphic Encryption (PHE), particularly the Paillier cryptosystem, provides a principled approach to addressing this challenge by enabling arithmetic computations directly over ciphertexts without requiring decryption [6, 7]. Under Paillier encryption, a blockchain network can aggregate IoT sensor readings, compute weighted statistics, and verify aggregated results while individual sensor values remain encrypted on the distributed ledger. This approach has been explored in federated learning [8–10], healthcare data sharing [1, 11], carbon accounting [12], cross-chain interoperability [6, 13], and transportation IoT networks [3, 14]. Fully Homomorphic Encryption (FHE) schemes, including Brakerski/Fan-Vercauteren (BFV) and Cheon–Kim–Kim–Song (CKKS), further extend the class of supported computations to arbitrary polynomial operations and approximate floating-point arithmetic [7, 15, 16], thereby enabling richer analytics at the cost of substantially greater computational overhead. Despite this body of work, two important limitations remain insufficiently addressed in existing PHE-blockchain systems. First, long-lived IoT data streams, including patient health records, energy-consumption patterns, and industrial process parameters, may be stored and retained for extended periods. This raises the broader question of how such deployments should evolve as cryptographic standards advance. We revisit this issue in Section 8.5 as a direction for future work rather than as a problem solved by the present architecture. Second, and more importantly, the network topology of IoT blockchain deployments, which fundamentally influences both security resilience and system performance, is largely ignored in existing protocol designs and analyses. Prior schemes commonly treat the validator and device network as an abstract or ideal communication channel and consequently derive no guarantees concerning liveness, throughput, or Byzantine fault tolerance as explicit functions of the underlying graph structure. In practical IoT deployments, network structures differ substantially across application domains. Hierarchical tree topologies may arise in smart-grid metering infrastructures, star configurations in hospital sensor networks, mesh interconnections on industrial floors, and scale-free structures in smart-city deployments. These topological differences directly affect communication paths, connectivity, fault propagation, consensus delays, and resilience against validator failures or adversarial disruption. Nevertheless, their security and performance implications have not been systematically incorporated into existing homomorphic blockchain architectures. To address this gap, this paper presents Φ-PHE-BC, a domain-agnostic and topology-aware homomorphic aggregation framework for IoT blockchain networks. The framework provides classical confidentiality for on-chain Paillier aggregation, information-theoretic protection for threshold-decryption shares, and standard signature-based transaction integrity, while deriving liveness, throughput guarantees and communication-cost bounds as explicit functions of the deployment topology. Given a network graph G, device capability class D, aggregation function Φ, cryptographic parameter set Λ, and consensus parameters Π, the framework produces a protocol instantiation whose security guarantees and performance bounds are parameterized by graph-theoretic properties of G. The main contributions of this work are as follows: • We prove that protocol liveness under a Byzantine adversary A(λ, f, qe , qh ) is characterized by the condition that the vertex connectivity of the validator subgraph satisfies κ(Gv ) ≥ f + 1. We establish this result uniformly across the topology classes T = {Ttree , Tstar , Tmesh , Tsf }. We further derive closed-form bounds for throughput TPS(G) and per-block communication cost parameterized by validator-network diameter, link latency, block size, and BFT voting cost (Theorem 10 and Proposition 11). • We establish the classical and information-theoretic security foundations of the protocol stack. Specifically, we prove IND-CPA security of on-chain Paillier aggregation under the Decisional Composite Residuosity (DCR) assumption (Theorem 4), information-theoretic protection of threshold partial-decryption shares through noise 2

A PREPRINT - AUGUST 25, 2026

Table 1: Comparison with the closest prior schemes. Scheme Lakhan et al. [3] Jiang et al. [14] Si et al. [6] Wu et al. [15] Latif et al. [17] This work

Formal Security Analysis × × × × × ✓

Topology-Aware × × × × × ✓

Threshold Decryption × × ✓ × × ✓

✓ = property satisfied; × = property not satisfied.

flooding against computationally unbounded adversaries (Theorem 5), and EUF-CMA transaction integrity under standard digital-signature assumptions (Theorem 7). • We prove that honest validator participation remains the dominant Nash-equilibrium strategy for validators and show that this conclusion is invariant to the magnitude of the per-transaction cryptographic cost multiplier. • We implement Φ-PHE-BC on Hyperledger Fabric and evaluate throughput, end-to-end latency, and thresholddecryption overhead across four topology classes, benchmarking the proposed framework against the closest classical PHE-blockchain baselines. Table 1 positions Φ-PHE-BC with respect to the closest prior schemes. Lakhan et al. [3] integrate homomorphic encryption with blockchain for transportation IoT applications but do not provide a formal end-to-end security analysis or topology-aware analysis. Jiang et al. [14] propose a DAG-blockchain PHE scheme for vehicular networks without formally modeling the effects of network topology. Si et al. [6] employ threshold Paillier encryption for cross-chain access control and represent the closest antecedent to our threshold-decryption component; however, their framework assumes an ideal network and provides no topology-parameterized guarantees. Wu et al. [15] integrate FHE into an Ethereum-based environment but do not provide either a formal end-to-end security analysis for the complete protocol stack or explicit network-topology analysis. Latif et al. [17] present a blockchain-based authentication system for e-health incorporating multi-factor authentication, hybrid RBAC–ABAC access control, and post-quantum digital signatures; however, their work does not address homomorphic aggregation or topology-aware guarantees for liveness, throughput, and resilience. Based on the literature reviewed in this study, we did not identify prior work that jointly combines a formal end-to-end security treatment for threshold homomorphic aggregation with topology-aware liveness and throughput guarantees, together with connectivity-based fault-tolerance and communication-cost analysis, within a single IoT blockchain architecture. The remainder of this paper is organized as follows. Section 3 formalizes the network graph model, device capability classes, adversary model, and security objectives. Section 4 presents the Φ-PHE-BC framework design, including the cryptographic-layer selection algorithm and the Paillier–BFV bridge. Section 5 establishes the end-to-end classical and information-theoretic security guarantees of the protocol stack. Section 6 derives topologyparameterized bounds for liveness, throughput, and communication cost. Section 7 analyzes game-theoretic validator stability. Section 8 presents the implementation and experimental evaluation. Finally, Section 9 concludes the paper.

2

Literature Review

A substantial body of work addresses the foundations, implementation, and security of homomorphic encryption (HE). Paillier’s additive cryptosystem provides the classical PHE basis used in this paper [7], while recent surveys and bibliometric studies map the evolution, capabilities, and open challenges of modern HE systems [16, 18, 19]. Work on integrating FHE with blockchain and smart contracts highlights both the expressiveness of schemes such as BFV/CKKS and their implementation complexity [15, 20]. Public verification of FHE computations, formal verification of FHE toolchains, homomorphic signatures, and implementation-safety benchmarking further emphasize that practical HE systems require more than encryption alone [21–24]. Selective and application-oriented HE designs continue to broaden the practical space, including privacy-preserving face-recognition pipelines [25]. A second major cluster combines HE with blockchain-assisted federated learning and distributed analytics. CoPiFL studies collusion resistance and privacy-preserving crowdsourcing [8]; reputation and auditing mechanisms are incorporated into blockchain-based FL in [9, 26]; and PBFL employs homomorphic encryption with single masking for privacy-preserving model aggregation [10]. Healthcare and IoT deployments demonstrate the use of blockchain and HE in regulated, sensitive-data settings [4, 11, 27], while transportation-oriented FL and intrusion-detection designs 3

A PREPRINT - AUGUST 25, 2026

show the same pattern in highly distributed environments [28]. Collectively, these works demonstrate the feasibility of blockchain–HE integration, but they typically do not connect validator-network graph structure to formal liveness and throughput guarantees. HE–blockchain designs have also been investigated directly for IoT, transportation, and cross-domain data sharing. Lakhan et al. propose a homomorphic blockchain scheme for intelligent transport services in fog/cloud and IoT networks [3]; Jiang et al. combine homomorphic encryption with a DAG blockchain for vehicular networks [14]; and He et al. apply blockchain-based protected accounting to carbon-emission data [12]. Cross-chain and searchableencryption systems extend encrypted processing to interoperable or attribute-controlled data-sharing settings [13, 29]. The blockchain-security survey of Xu et al. provides broader context for the fusion of cryptographic protection with distributed ledgers [5]. Threshold decryption and privacy-preserving healthcare analysis are especially relevant to the proposed architecture. Si et al. use threshold Paillier in a cross-chain access-control mechanism [6]; Guan et al. protect healthcare-IoT data with blockchain-enhanced privacy mechanisms [1]; and PriCollabAnalysis combines blockchain, homomorphic encryption, secret sharing, and secure multiparty computation for collaborative healthcare analytics [30]. A smaller but important body of work considers HE beyond blockchain-centric IoT aggregation. Ci et al. study privacypreserving word-vector learning using PHE [31], while AlShaikh et al. combine partial homomorphic processing with authenticated cloud-computing mechanisms [32]. These studies reinforce the broader utility of PHE for privacypreserving computation, but they do not address the topology-dependent BFT guarantees that are central to the present work. 2.1

Research Gaps and Motivation

The reviewed literature reveals four gaps that motivate Φ-PHE-BC. First, existing HE–blockchain systems generally select a single cryptographic computation model for the full workflow. Additive PHE is attractive for frequent linear aggregation because of its lower cost, whereas BFV/CKKS support richer computations with greater overhead [15, 16]. The proposed architecture therefore uses Paillier as the primary on-chain aggregation path and treats the TEE-assisted Paillier–BFV bridge as an optional extension for non-linear functions rather than as a requirement for the evaluated baseline. Second, prior IoT and vehicular blockchain schemes do not explicitly derive BFT liveness and throughput from validator-graph properties. Transportation and vehicular schemes such as [3, 14, 28] model distributed operation but do not establish a necessary-and-sufficient validator-connectivity condition of the form proved in Section 6. The present work narrows the scope to this directly analyzed problem; dynamic membership and mobility-aware rekeying remain outside the formal model. Third, computation-validity mechanisms are often treated separately from the complete aggregation workflow. Publicverification and SoK results identify verification as an important open implementation dimension [20, 21]. Accordingly, the framework includes an optional Fiat–Shamir ciphertext-validity proof for capable devices. This mechanism proves the configured plaintext/randomness relation for a submitted ciphertext; it is not claimed to provide a constant-time proof of correctness for the complete aggregate. Fourth, incentive alignment and network topology are rarely analyzed jointly in HE-enabled blockchain systems. Blockchain-based FL schemes introduce reputation or audit mechanisms [9, 26], but do not derive the validator penalty condition studied in Section 7. Likewise, the reviewed threshold-Paillier and IoT systems [1, 4, 6] do not parameterize liveness and throughput by validator vertex connectivity and diameter. This omission is the central gap addressed in Section 6. For future cryptographic migration, the standardized ML-KEM and ML-DSA primitives provide relevant post-quantum key-establishment and signature candidates [33,34]; SLH-DSA provides an additional standardized hash-based signature option [35]. These standards are cited only as future-work candidates and are not implemented or claimed as security properties of the present Φ-PHE-BC system.

3

System Model

The list of symbols used in this paper is given in Table 2 in the Appendix. 3.1

Network Graph Model

We model the IoT blockchain network as a weighted undirected graph. 4

A PREPRINT - AUGUST 25, 2026

Definition 1 (IoT Blockchain Network Graph). An IoT blockchain network is a tuple G = (V, E, W ), where: • V = Vd ∪ Vv ∪ Vp is a finite node set partitioned into IoT device nodes Vd , validator nodes Vv , and blockchain peer nodes Vp , with |Vd | = nd , |Vv | = nv , |Vp | = np ; • E ⊆ V × V is a set of authenticated point-to-point channels; and • W : E → R>0 assigns a propagation latency τuv to each link (u, v) ∈ E. The validator subgraph Gv = G[Vv ] is the subgraph induced by the validator nodes. The maximum number of Byzantine validators tolerated by the protocol is   nv − 1 , f= 3 consistent with standard BFT assumptions [2]. Two graph-theoretic quantities govern the security and performance analysis throughout this paper. The vertex connectivity κ(Gv ) is the minimum number of validator nodes whose removal disconnects Gv ; it characterizes fault tolerance. The algebraic connectivity (Fiedler value) λ2 (Gv ) is the second-smallest eigenvalue of the Laplacian of Gv ; it quantifies how quickly information spreads across the validator subgraph. We consider four topology classes that cover the principal IoT deployment archetypes identified in the literature [1, 3]: • Ttree : hierarchical tree, with diam(G) = O(log nd ),

κ(Gv ) ≥ 1,

representing smart-grid metering hierarchies; • Tstar : hub-and-spoke topology, with diam(G) = 2,

κ(Gv ) = 1,

representing hospital sensor networks; • Tmesh : regular grid or torus, with √ diam(G) = O( nv ),

κ(Gv ) ≥ 4,

representing industrial-floor sensor meshes; and • Tsf : Barabási–Albert scale-free graph, with diam(G) = O(log nv ), and variable κ(Gv ), representing smart-city deployments. Remark 1. Star and tree topologies have κ(Gv ) = 1, which violates the liveness condition derived in Section 6. In such deployments, the validator subgraph must be augmented independently of the device-layer topology so that the required condition κ(Gv ) ≥ f + 1 is satisfied. The device and validator sub-topologies are therefore treated separately throughout the paper. We assume authenticated-path routing among validators: a message between two validators may be forwarded along a path in Gv , and an honest validator forwards correctly received protocol messages. Consequently, after the removal of Byzantine validators, connectivity of the remaining honest validator subgraph implies mutual communication among honest validators. 5

A PREPRINT - AUGUST 25, 2026

3.2

Device Capability Model

IoT devices span a wide range of computational resources. We classify them by sustained cryptographic throughput, following classifications used in related IoT security work [1, 11]. Definition 2 (Device Capability Class). A device d ∈ Vd belongs to a class D(d) ∈ {DI , DII , DIII } according to: • DI (constrained): CPU < 100 MHz and RAM < 256 KB. Supports Paillier encryption only and cannot execute the full signature and zero-knowledge-proof stack on-device. • DII (moderate): 100 MHz ≤ CPU < 1 GHz and RAM ≥ 1 MB. Supports Paillier encryption, session-key establishment, and standard digital signatures for transaction authentication. • DIII (capable): CPU ≥ 1 GHz and RAM ≥ 64 MB. Supports the full cryptographic layer stack, including standard digital-signature generation and zero-knowledge-proof generation. The device class directly drives the selection of the cryptographic-layer algorithm presented in Section 4.3. We note that the specific signature and key-establishment primitives assigned to DII and DIII devices are implementation choices rather than fixed requirements of the framework. 3.3

Adversary Model

We define a parameterized Byzantine adversary consistent with standard partial-synchrony BFT analysis. Definition 3 (Byzantine Adversary). The adversary A = A(λ, f, qe , qh ) is characterized by: • a security parameter λ ∈ N; • Byzantine control of at most f validator nodes, which may collude and deviate arbitrarily from the protocol; • at most qe encryption-oracle queries and qh random-oracle (hash) queries; and • full Dolev–Yao control of all network channels: A may eavesdrop on, replay, delay, and inject messages on any link (u, v) ∈ E. The adversary A is computationally bounded in the standard sense used for the classical hardness assumptions invoked in Section 5, namely the Decisional Composite Residuosity (DCR) assumption for Paillier encryption and the hardness assumption underlying the chosen digital signature scheme.

4

Framework Design

4.1

Framework Parameterization

Definition 4 (Φ-PHE-BC Framework Instance). A Φ-PHE-BC instance is a tuple F = (G, D, Φ, Λ, Π), where: • G is a network graph as defined in Definition 1; • D ∈ {DI , DII , DIII } is the device capability class as defined in Definition 2; • Φ : Znd → Z is the target aggregation function, classified as linear, polynomial of degree ℓ, or floating-point; 6

A PREPRINT - AUGUST 25, 2026

Table 2: Notation and symbols used in the system model. Symbol Description G = (V, E, W ) Weighted IoT blockchain network graph V Set of all network nodes Vd Set of IoT device nodes Vv Set of validator nodes Vp Set of blockchain peer nodes nd Number of IoT device nodes, |Vd | nv Number of validator nodes, |Vv | np Number of blockchain peer nodes, |Vp | E Set of authenticated communication links W Edge-weight function representing propagation latency τuv Propagation latency of link (u, v) Gv Validator-induced subgraph G[Vv ] f Maximum number of tolerated Byzantine validators κ(Gv ) Vertex connectivity of the validator subgraph λ2 (Gv ) Algebraic connectivity (Fiedler value) of Gv diam(G) Diameter of graph G Ttree Hierarchical tree topology class Tstar Hub-and-spoke topology class Tmesh Mesh/grid topology class Tsf Scale-free topology class D(d) Capability class of device d DI Constrained device capability class DII Moderate device capability class DIII Capable device capability class A Byzantine adversary λ Cryptographic security parameter εnf Statistical-hiding target for the flooding layer qe Number of encryption-oracle queries qh Number of random-oracle/hash queries • Λ = (n, NBFV , q, t, σ, λ, εnf ) is the cryptographic parameter tuple, where n is the Paillier modulus, NBFV is the BFV ring dimension, q is the ciphertext modulus, t is the plaintext modulus, σ is the Gaussian standard deviation, and λ is the security parameter, while εnf is the configured statistical-hiding target for the flooding layer; • Π = (f, τthresh , B, τttl ) specifies the Byzantine threshold f , the number of required threshold shares τthresh , the block size B, and the nonce time-to-live τttl . The key design principle of Φ-PHE-BC is that every security guarantee and performance bound derived in Sections 5–6 is an explicit function of the components of F and, in particular, of the graph-theoretic properties of G. 4.2

Cryptographic Primitives

The framework comprises the following cryptographic building blocks. Full parameter specifications are given by Λ. Paillier PHE.

Let n = pq, where p and q are primes, and let g = n + 1. Define λP = lcm(p − 1, q − 1), 7

A PREPRINT - AUGUST 25, 2026

µ = L g λP mod n2

−1

mod n,

where L(x) =

x−1 . n

The Paillier encryption of a message m ∈ Zn is Enc(m; r) = g m rn mod n2 ,

$

r← − Z∗n ,

(1)

and decryption is
Dec(c) = L cλP mod n2 µ mod n.

(2)

Homomorphic addition follows from Dec(c1 c2 mod n2 ) = m1 + m2 , and scalar multiplication follows from Dec(ck mod n2 ) = km. The confidentiality of Paillier encryption is based on the Decisional Composite Residuosity (DCR) assumption. Transaction Authentication. Each device signs its transaction using a standard EUF-CMA-secure digital signature scheme. The signature binds the device identity, ciphertext, weight, timestamp, and nonce, as specified in Section 4.4. The specific signature scheme is an implementation parameter of Λ and is treated abstractly in the security analysis. Section 8.5 discusses a possible migration to lattice-based signatures as future work; such a migration is not an achieved security property of the present architecture. BFV Fully Homomorphic Encryption.

BFV operates in the polynomial ring Rq = Zq [X]/(X NBFV + 1).

Encryption embeds a plaintext m ∈ Zt using ∆=

jq k t

.

A ciphertext may be represented as c = (bu + e1 + ∆m, au + e2 ) , where the error and masking terms are sampled according to the configured BFV distributions. BFV supports both homomorphic addition and multiplication, enabling evaluation of aggregation functions of polynomial degree up to   log2 (q/t) , Lmax = log2 (Bχ + 1) where Bχ = 6σ is the configured noise bound. Noise Flooding. The threshold-share privacy layer is modeled through a configurable flooding transformation. For validator Vi , let ei denote the secret-dependent exponent used by the threshold-decryption procedure and let Fnf be the configured integer-valued flooding distribution. For any two admissible exponents e, e′ in the configured exponent domain, the deployment parameters must satisfy the statistical-hiding condition SD(Fnf + e, Fnf + e′ ) ≤ εnf ,

(3)

where εnf is an explicit deployment parameter. This condition is information-theoretic: it is stated directly in statistical distance and does not invoke a computational hardness assumption. The present paper does not claim a universal closed-form value of εnf from a Gaussian width alone; parameter selection must be justified for the concrete flooding construction used by an implementation. 8

A PREPRINT - AUGUST 25, 2026

Algorithm 1 L AYER S ELECT(D, Φ, λ) Require: Device class D, aggregation function Φ, security parameter λ Ensure: Ordered cryptographic layer set L 1: L ← {PAILLIER, N OISE F LOODING} 2: if Φ ∈ / Flinear then 3: L ← L ∪ {BFV-B RIDGE} 4: end if 5: if Φ requires floating-point arithmetic then 6: L ← L ∪ {CKKS} 7: end if 8: if D ≥ DII then 9: L ← L ∪ {S IGNATURE -AUTH} 10: end if 11: if D = DIII then 12: L ← L ∪ {ZKP} 13: end if 14: return L 4.3

Cryptographic Layer Selection

A key contribution of Φ-PHE-BC is the L AYER S ELECT algorithm, which automatically determines the minimal cryptographic layer set required to achieve the security goals defined in Section 5 for a given device class and aggregation function. This avoids both under-provisioning, which may leave a required protection mechanism absent, and over-provisioning, which may impose unnecessary cryptographic overhead on constrained devices. Proposition 1 (Completeness of L AYER S ELECT). For any (D, Φ, λ), the layer set L = L AYER S ELECT(D, Φ, λ) is sufficient to instantiate the protection mechanisms required by the framework security goals. Proof sketch. Transaction integrity is provided through an EUF-CMA-secure signature mechanism whenever D ≥ DII , while the constrained device class uses the framework’s corresponding ciphertext-binding and validation mechanisms. Confidentiality of individual readings is provided by Paillier encryption under the DCR assumption, while noise flooding protects the published threshold-decryption shares under the statistical assumptions of the protocol. The BFV bridge is required only when Φ∈ / Flinear , because Paillier alone supports additive operations and scalar multiplication but does not directly support ciphertext– ciphertext multiplication required for general polynomial functions of degree at least two. 4.4

Protocol Phases

A Φ-PHE-BC instance executes the following nine phases. The complete Hyperledger Fabric chaincode realization is described in Section 8. Each device di ∈ Vd generates a signature key pair (ski , pki ) ← KeyGen() and submits a certificate-signing request to the registration authority (RA). The RA issues Certi = SignRA (pki , IDi ), and the chaincode stores Certi under the key device:IDi in the Fabric world state. Phase 1: Device Registration.

Phase 2: Sensing and Encryption.

Device di reads a sensor value vi ∈ [0, n − 1]

and computes cti = Enc(vi ; ri ) according to Equation (1). For DII and DIII devices, a session key Kij may be established with the target validator Vj using an authenticated key-establishment mechanism. The ciphertext is then transmitted inside the corresponding protected communication channel. 9

A PREPRINT - AUGUST 25, 2026

Phase 3: Transaction Submission.

Device di constructs Ti = (IDi , cti , wi , ts, nonce, σi ),

where wi is an integer-encoded weight, $

nonce ← − {0, 1}128 is a fresh nonce, and σi = Signski (H(IDi ∥cti ∥nonce)) . Phase 4: Validator Verification.

Upon receiving Ti , validator Vj verifies:

1. Verify (pki , σi , H(IDi ∥cti ∥nonce)) = 1; 2. Certi is valid under the RA public key; 3. nonce ∈ / N, where N denotes the set of previously recorded nonces; and 4. |ts − tnow | ≤ τttl . Transactions satisfying all checks are forwarded to the block-proposal phase. The verification procedure is given in Algorithm 2. Phase 5: On-Chain Homomorphic Aggregation. The leader validator invokes the aggregation chaincode to compute ! nd nd Y X wi 2 ctagg = cti mod n ≡ Enc wi vi . i=1

i=1

The computation is performed over ciphertexts, and individual plaintext sensor readings are not stored in the blockchain world state. Phase 6: BFT Consensus.

The leader broadcasts the proposed block Bk = (Hk , T1 , . . . , Tnd ),

where Hk = (H(Bk−1 ), MerkleRoot(T1 , . . . , Tnd ), ts, ctagg , σleader ) . Validators execute the configured PBFT-style consensus procedure. Under the stated protocol assumptions, a block is committed after the required prepare and commit quorums are obtained. Phase 7: Threshold Decryption. The Paillier private key is distributed among validators using a degree-(τthresh − 1) polynomial over the configured field. Each validator Vi first computes the ordinary threshold-decryption exponent ei = 2δski ,

δ = nv !,

and the deployment’s flooding wrapper produces the published share transcript from an exponent distributed as ei + Fnf . Reconstruction combines at least τthresh valid shares using the corresponding integer-scaled Lagrange coefficients. Theorem 5 concerns the privacy of the published flooded transcript only. The flooding wrapper is implemented using a correctness-preserving mask-cancellation mechanism. Let the flooded exponent used by validator Vi be eei = ei + fi ,

(4)

where ei = 2δski is the ordinary threshold-decryption exponent and fi is the locally generated flooding mask. The published partial-decryption share is e ei dei = ctagg mod n2 .

(5)

Before final plaintext recovery, the reconstruction procedure removes the aggregate masking contribution according to the implemented mask-cancellation rule. Denoting the integer-scaled Lagrange coefficient of validator Vi by λi , the combined masking term is X Fcomb = λi fi , (6) i∈S

10

A PREPRINT - AUGUST 25, 2026

Algorithm 2 Transaction Verification Require: Signed transaction Ti = (IDi , cti , wi , ts, nonce, σi ); nonce set N ; RA public key pkRA ; current time tnow ; nonce time-to-live τttl Ensure: Ti admitted to the proposal pool or rejected with an error 1: if Verify(pki , σi , H(IDi ∥cti ∥nonce)) ̸= 1 then 2: return ERR_INVALID_SIGNATURE 3: end if 4: if VerifyRA(pkRA , Certi ) ̸= 1 then 5: return ERR_INVALID_CERTIFICATE 6: end if 7: if nonce ∈ N then 8: return ERR_REPLAY 9: end if 10: if |ts − tnow | > τttl then 11: return ERR_STALE_TIMESTAMP 12: end if 13: N ← N ∪ {nonce} 14: return ADMITTED where S is the set of participating validators. The implementation cancels or removes the contribution corresponding to Fcomb before applying the final Paillier recovery function. Consequently, the reconstructed value is identical to that obtained from the unflooded threshold shares, while the individually published shares remain statistically hidden according to the condition of Theorem 5. Phase 8: ZKP Verification. For deployments involving DIII devices, a device may generate a Fiat–Shamir proof πi demonstrating knowledge of (vi , ri ) such that Enc(vi ; ri ) = cti . The aggregation chaincode verifies the configured proofs before aggregation, thereby rejecting malformed ciphertexts according to the protocol rules. Phase 9: Result Retrieval.

An authorized querier invokes QueryLedger(ID, hlo , hhi ),

which returns the committed result and any associated verification proof, enabling offline verification without repeating the complete decryption procedure. 4.5

The Paillier–BFV Bridge

When the target aggregation function is not expressible using Paillier’s additive homomorphism, namely when Φ∈ / Flinear , the L AYER S ELECT algorithm adds the BFV bridge to L. Definition 5 (Paillier–BFV Bridge). The bridge B = (Gen, ReEnc, Verify) consists of: • Gen: executed inside a trusted execution environment (TEE) and producing a re-encryption key rkP→B = BFV. Enc(H(skP ); pkB ); • ReEnc: given a Paillier ciphertext ctP , decrypting it inside the TEE boundary and producing ctB = BFV. Enc (Paillier. Dec(ctP ); pkB ) ; • Verify: a zero-knowledge verification mechanism attesting that the configured re-encryption procedure was executed correctly without revealing the underlying plaintext. 11

A PREPRINT - AUGUST 25, 2026

Proposition 2 (Bridge Necessity). There exists an aggregation function Φ of polynomial degree at least two that is not computable under Paillier alone. Consequently, a mechanism enabling transition to a multiplication-capable homomorphic scheme is required for complete support of such functions. Proof. Paillier supports additive homomorphism. For ciphertexts c1 and c2 , c1 c2 mod n2 decrypts to m1 + m2 , but this operation does not directly produce an encryption of m1 m2 . Thus, Φ(m1 , m2 ) = m1 m2 is not directly computable using Paillier’s additive operations alone. BFV supports homomorphic multiplication and can therefore evaluate such polynomial computations subject to its parameter and noise budget. The bridge enables the transition of the protected value to the BFV computation domain. Proposition 3 (Bridge IND-CPA Security Conditional on TEE Integrity). If the TEE hardware and attestation mechanism are not compromised by the out-of-scope attack classes defined in the TEE threat model, and the BFV encryption scheme satisfies IND-CPA security under its underlying lattice-based hardness assumption, then the bridge provides IND-CPA confidentiality against the adversary model of Definition 3, subject to the stated TEE trust assumption. Proof sketch. The output ctB is a BFV encryption under pkB . The intermediate plaintext m = Paillier. Dec(ctP ) remains within the trusted execution boundary. The adversary observes only the resulting ciphertext and the configured verification proof. Under the stated zero-knowledge and encryption-security assumptions, these observations do not reveal the plaintext beyond the information permitted by the protocol. TEE Threat Model. The Paillier–BFV bridge relies on a trusted execution environment, such as an Intel SGX- or ARM TrustZone-class environment, to perform R E E NC without exposing the intermediate plaintext. The in-scope adversary includes a network-level adversary with Dolev–Yao control of communication channels and a compromised host operating system, hypervisor, or Fabric peer process attempting to inspect protected enclave memory, intercept the re-encryption process, or tamper with the bridge control flow. The following attacks are outside the security guarantee of the bridge: classical enclave side-channel attacks, including cache-timing, power-analysis, and speculative-execution attacks; physical fault injection or voltage glitching targeting the enclave hardware; and rollback attacks that replay stale enclave state when no trusted monotonic counter or equivalent rollback protection is available. Proposition 3 is therefore conditional on the integrity and confidentiality properties provided by the TEE and its attestation mechanism against the assumed attack model. 4.6

System Architecture Overview

Figure 1 illustrates the end-to-end system architecture of a Φ-PHE-BC instance. IoT devices form the bottom layer and encrypt sensor readings using Paillier before submitting authenticated transactions. Validator nodes form the middle layer: they verify transactions, execute on-chain homomorphic aggregation through Fabric chaincode, participate in BFT consensus, and contribute threshold-decryption shares. The Fabric ordering service and peer nodes form the blockchain layer and persist committed blocks and the encrypted world state. The optional Paillier–BFV bridge is activated only when Φ∈ / Flinear , and operates within a TEE associated with a designated validator. Result consumers interact through the retrieval interface and obtain the committed aggregate together with any configured verification evidence. Figure 2 shows the operation of the proposed system. During setup and registration, IoT devices generate key pairs and certificate-signing requests, after which the certification and registration authority issues identity-bound certificates and publishes the public parameters required for protocol execution. Each device encrypts its sensed value vi as cti = Enc(vi ; ri ) and transmits Ti = (IDi , cti , wi , ts, nonce, σi ), where the identity, freshness, weighting, and authentication metadata support secure transaction validation. 12

A PREPRINT - AUGUST 25, 2026

IoT Devices / Sensors

Adversary

Off-Chain FHE Engine Blockchain Network (Permissioned Consensus)

Paillier Encryption

Validator Node 1

Proxy Re-encryption

Transaction Pool

FHE Computation Validator Node 2

Consensus Layer Smart Contract

Validator Node 3

Results and ZKP Proof

Distributed Ledger Validator Node n

Auditor

Verification

Results (Encrypted)

ZKP Verified

Key Management Data Flow Attack Flow CA

Key Pair

Re-encryption Key

Control Path

Figure 1: End-to-end system architecture of the proposed Φ-PHE-BC framework, showing the IoT device layer, validator layer, Hyperledger Fabric blockchain layer, optional TEE-based Paillier–BFV bridge, threshold-decryption process, and result-retrieval interface. After identity and transaction verification, validators compute ctagg =

nd Y

2 i ctw i mod n ,

i=1

thereby performing weighted aggregation over encrypted data without disclosing individual sensor readings. When the target function is outside the linear computation domain, the workflow activates the optional BFV bridge within the TEE to support subsequent homomorphic computation. The resulting aggregate is committed to the blockchain together with block metadata, Merkle-root integrity information, timestamps, and leader authentication data. Network agreement follows the configured PBFT-style consensus procedure. Finally, an authorized querier obtains the aggregate through threshold decryption and may receive associated zeroknowledge verification evidence, where such verification is enabled.

5

Security Analysis

We establish the confidentiality and transaction-integrity properties of every Φ-PHE-BC instance satisfying L = LAYERSELECT(D, Φ, λ) against the adversary A(λ, f, qe , qh ) defined in Section 3.3. The security guarantees in this section are deliberately separated according to their underlying assumptions. In particular, confidentiality of Paillier 13

A PREPRINT - AUGUST 25, 2026

Phase 1 Device registration and certificate issuance

Phases 3-4 Signed transaction submission and verification

Phase 2 Paillier sensing and encryption

Phase 5 On-chain homomorphic aggregation

authenticated channel

Phase 9 Authorized result retrieval

Phase 8 Optional ciphertext-validity ZKP verification

Phase 7 Noise-flooded threshold partial decryption

Phase 6 PBFT-style consensus and block commitment

Optional Paillier-BFV bridge: activated only for Φ not in F_linear and executed under the TEE trust assumptions of Section 4.5.

Figure 2: Operational workflow of the evaluated Φ-PHE-BC architecture. The present implementation uses classical transaction authentication and key establishment ciphertexts and transaction integrity rely on classical computational assumptions, whereas the statistical protection provided by the noise-flooding mechanism is independent of the computational power of the adversary. Theorem 4 (Paillier IND-CPA Security). For any probabilistic polynomial-time classical adversary A0 , the IND-CPA advantage against the Paillier cryptosystem is bounded by DCR AdvIND-CPA (A′0 ), Paillier (A0 ) ≤ 2 Advn

(7)

where A′0 is an adversary against the Decisional Composite Residuosity (DCR) assumption with comparable running time, up to the overhead of the reduction. Theorem 4 establishes the confidentiality baseline for on-chain homomorphic aggregation. Under the DCR assumption, an efficient classical adversary cannot distinguish encryptions of two chosen plaintexts with non-negligible advantage. Consequently, the individual ciphertexts ct i and the aggregate ciphertext ct agg remain confidential against classical polynomial-time adversaries. Theorem 5 (Noise-Flooding Protection). Let e0 and e1 be any two admissible secret-dependent threshold exponents, and let Fnf be a flooding distribution satisfying Eq. (3). Define ebb = eb + f,

f ← Fnf ,

b ∈ {0, 1}.

(8)

Then SD(Deb0 , Deb1 ) ≤ εnf .

(9)

bb dbb = cteagg mod n2 .

(10)

For any fixed aggregate ciphertext ctagg , let Then the corresponding published partial-decryption distributions satisfy   SD Ddb0 , Ddb1 ≤ εnf .

(11)

Proof. The first inequality is exactly the configured statistical-hiding condition of Eq. (3). The map x 7→ ctxagg mod n2 is deterministic. By the data-processing inequality for statistical distance, deterministic post-processing cannot increase statistical distance. Therefore, applying this map to the two flooded exponent distributions preserves the upper bound εnf . 14

A PREPRINT - AUGUST 25, 2026

Remark 2. Theorem 5 is an information-theoretic privacy statement: its conclusion is expressed in statistical distance and therefore does not rely on DCR, ECDSA, or any computational limitation of the adversary. It applies only to the flooded threshold-share transcript under the explicitly configured condition in Eq. (3). Theorem 6 (End-to-End Classical Confidentiality Bound). Let F = (G, D, Φ, Λ, Π)

(12)

be a Φ-PHE-BC instance with L = LAYERSELECT(D, Φ, λ). (13) For any probabilistic polynomial-time classical adversary A(λ, f, qe , qh ), the confidentiality advantage is bounded by AdvFIND-CPA (A) ≤ AdvnDCR (A′ ) + nv εnf + negl(λ).

(14)

Proof. We consider a sequence of hybrid games. Hybrid H0 . This is the real Φ-PHE-BC execution. The adversary submits challenge readings (m0 , m1 ), and the challenger encrypts mb for a uniformly chosen bit b ∈ {0, 1}. Hybrid H1 . We replace the threshold-decryption outputs associated with the challenge execution by their noise-flooded counterparts. By Theorem 5, the statistical distance between the corresponding transcript distributions is bounded by εnf for each admissible threshold share. Applying the union bound over at most nv published validator shares gives |Pr[H0 ] − Pr[H1 ]| ≤ nv εnf .

(15)

If the deployment chooses εnf negligible in the security parameter λ and nv is polynomially bounded in λ, then nv εnf is also negligible. Hybrid H2 . We replace the Paillier challenge ciphertext with an encryption of zero. By Theorem 4, any probabilistic polynomial-time distinguisher between H1 and H2 can be used to construct an adversary against the Decisional Composite Residuosity assumption. Hence, |Pr[H1 ] − Pr[H2 ]| ≤ AdvDCR (A′ ). n

(16)

In H2 , the challenge ciphertext is independent of the challenge bit b except with negligible probability arising from the remaining protocol abstractions. Therefore, AdvIND-CPA (A) ≤ AdvDCR (A′ ) + nv εnf + negl(λ). F n

(17)

Thus, under the DCR assumption and the configured statistical-hiding condition for the flooding layer, the aggregation path satisfies the stated classical confidentiality bound. Theorem 7 (Transaction Integrity). Assume that the digital signature scheme configured for the deployment is EUFCMA secure. Then no probabilistic polynomial-time classical adversary can forge a valid transaction Ti = (IDi , ct i , wi , ts, nonce, σi )

(18)

for an uncompromised device di , except with negligible probability in λ. Proof. The signature σi = Signski (H(IDi ∥ ct i ∥ nonce)) (19) binds the device identity, ciphertext, and freshness value to the transaction. A successful forgery for an uncompromised signing key therefore implies a successful forgery against the EUF-CMA security of the configured digital signature scheme. In addition, replay is prevented by checking that nonce ∈ / Ledger,

(20)

timestamp validation enforces the freshness condition |ts − tnow | ≤ τttl ,

(21)

and certificate verification binds the public key to the registered device identity. Therefore, an adversary cannot create or replay an accepted transaction without either forging a valid signature or violating one of the corresponding verification conditions.

15

A PREPRINT - AUGUST 25, 2026

6

Network Resilience and Performance Analysis

We derive topology-dependent conditions and bounds for protocol liveness, block latency, throughput, and communication cost. All results are explicit functions of graph-theoretic properties of the validator subgraph Gv introduced in Section 3.1. In particular, the analysis establishes a graph-connectivity condition for Byzantine liveness and quantifies the effect of validator-network diameter on latency and throughput. The analysis distinguishes the topology of the IoT device layer from that of the validator layer. A device deployment may follow a tree, star, mesh, or scale-free topology, while the validator subgraph can be independently augmented to satisfy the connectivity required for Byzantine fault tolerance. Thus, low-connectivity device-side topologies do not by themselves determine the liveness of the validator consensus protocol. Definition 6 (Protocol Liveness). A Φ-PHE-BC instance achieves liveness if, for every admissible execution containing at most f Byzantine validators, every transaction submitted by an honest device is eventually included in a committed block after a finite number of BFT rounds, under the assumed partial-synchrony model. Theorem 9 (Topology–Liveness Equivalence). A Φ-PHE-BC instance achieves liveness under adversary A(λ, f, qe , qh ) if and only if κ(Gv ) ≥ f + 1, (22) where κ(Gv ) denotes the vertex connectivity of the validator subgraph. The result holds for the considered deployment topology classes under the authenticated-path routing model, provided that the validator subgraph itself satisfies Eq. (22). Proof. We prove necessity and sufficiency. Necessity.

Suppose that κ(Gv ) ≤ f.

(23)

By the definition of vertex connectivity, there exists a vertex cut S ⊆ Vv such that |S| ≤ f

(24)

and removing S disconnects Gv into at least two nonempty components, denoted by C1 and C2 . Because the adversary controls at most f validators, it can corrupt every validator in S. The corrupted validators can suppress, delay, or equivocate on protocol messages that would otherwise pass through the cut. Since S is a vertex cut, after its removal there is no honest communication path between C1 and C2 . Consequently, validators in the disconnected components cannot reliably exchange the messages required to establish the necessary BFT quorum across the partition. Therefore, there exists an admissible execution with at most f Byzantine validators in which progress can be prevented indefinitely. Hence liveness requires

Sufficiency.

κ(Gv ) ≥ f + 1.

(25)

κ(Gv ) ≥ f + 1.

(26)

Suppose that

Then removal of any set of at most f Byzantine validators leaves the remaining honest validator subgraph connected. Since the protocol assumes nv ≥ 3f + 1, (27) at least nv − f ≥ 2f + 1

(28)

honest validators remain. Under authenticated-path routing, every pair of honest validators can communicate through paths consisting entirely of honest validators. Under the assumed partial-synchrony conditions, the standard BFT quorum argument therefore permits an honest quorum of at least 2f + 1 validators to participate in progress and commit a block. Hence every transaction submitted by an honest device is eventually included in a committed block. Remark 3. The condition κ(Gv ) ≥ f + 1 is determined exclusively by the validator subgraph. A tree or star deployment of IoT devices may therefore coexist with a separately connected validator overlay satisfying the liveness condition. Conversely, a validator subgraph that itself has κ(Gv ) = 1 cannot tolerate the removal of even one critical validator when f ≥ 1. 16

A PREPRINT - AUGUST 25, 2026

6.1

Throughput Bounds

Definition 7 (Protocol Latency). The end-to-end latency for processing and committing one block is modeled as L(G) = diam(Gv ) τ + τagg + τthresh ,

(29)

where τ is the mean per-hop communication latency, τagg is the homomorphic aggregation time, and τthresh is the threshold-decryption latency. For the Paillier-based aggregation layer, the aggregation time depends on the number of ciphertext operations and the Paillier modulus size. Accordingly, we write τagg = O(nd log n),

(30)

where log n denotes the bit-length of the Paillier modulus. The threshold term τthresh captures the cost of generating and combining the required τthresh threshold-Paillier shares and is kept explicit because its implementation cost depends on the selected threshold parameters and arithmetic implementation. Theorem 10 (Topology-Parameterized Throughput). For a Φ-PHE-BC instance with block size B, the throughput is B . L(G)

(31)

B . diam(Gv )τ + τagg + τthresh

(32)

TPS(G) = Substituting Eq. (29) yields TPS(G) =

For the considered topology classes, the corresponding asymptotic bounds are B , O(log nv )τ + τagg + τthresh B TPS(Tstar ) = , 2τ + τagg + τthresh B TPS(Tmesh ) = , √ O( nv )τ + τagg + τthresh B TPS(Tsf ) = . O(log nv )τ + τagg + τthresh TPS(Ttree ) =

(33) (34) (35) (36)

Proof. Equation (31) follows from the definition of throughput as the number of transactions committed per block divided by the end-to-end block-processing time. Substituting the topology-dependent diameter values into Eq. (29) gives the stated bounds. For a balanced tree, diam(Ttree ) = O(log nv ).

(37)

diam(Tstar ) = 2.

(38)

√ diam(Tmesh ) = O( nv ).

(39)

For a star, For a two-dimensional mesh,

For the considered scale-free deployment model, the characteristic path length and effective diameter scale logarithmically under the adopted asymptotic model, giving diam(Tsf ) = O(log nv ).

(40)

Substitution into Eq. (32) proves the result. A star-shaped validator topology has the smallest diameter among the listed structures and therefore the smallest communication component in the latency model. However, for Byzantine fault tolerance it must still satisfy Theorem 9; consequently, a device-layer star should not be interpreted as requiring a single hub validator. 17

A PREPRINT - AUGUST 25, 2026

6.2

Per-Block Communication Cost

Proposition 11 (Per-Block Communication Cost). The total communication volume per committed block can be expressed as b + |Bk |, C(G, nd , nv , B) = nd |T | + n2v |Vote| + τthresh |d| (41) b and |Bk | denote, respectively, the byte sizes of a transaction, a BFT vote, a noise-flooded where |T |, |Vote|, |d|, partial-decryption message, and the committed block metadata. Proof. The first term accounts for the submission of nd device transactions. The second term captures the dominant all-to-all BFT voting component, which requires O(n2v ) vote transmissions under the adopted broadcast model. The third term accounts for the τthresh threshold-decryption shares required for reconstruction, and the final term represents block metadata and associated commitment information. Summing these contributions yields Eq. (41). Remark 4. The dominant communication term is generally n2v |Vote|,

(42)

which reflects the quadratic communication cost of the PBFT-style voting procedure. A hierarchical or Merkle-based aggregation mechanism can reduce the communication burden associated with collecting device submissions, but it does not remove the quadratic validator-voting component of the adopted BFT protocol. The results of this section establish topology-dependent guarantees for validator connectivity, liveness, communication delay, throughput, and per-block communication cost. The analysis does not claim, in its present form, a separate closed-form resilience metric based on the Fiedler value λ2 (Gv ) or the maximum degree ∆(Gv ). Such a metric should be introduced only if it is formally defined and proved in a subsequent theorem. The experimental consequences of the topology-dependent bounds are evaluated in Section 8.

7

Game-Theoretic Stability

We model validator participation as a strategic-form game and derive the conditions under which honest participation is the dominant strategy. The analysis is deliberately parameterized by a generic cryptographic-cost multiplier so that the incentive result applies to the classical cryptographic stack evaluated in Section 8 as well as to heavier cryptographic stacks that may be considered in future work. Definition 8 (Validator Utility). The utility of validator Vi is  Ri − αCi , if si = honest, Ui (si ) = Gi − αCi − Pi , if si = deviate,

(43)

where Ri > 0 is the block reward for honest participation, Ci > 0 is the computational cost of executing one block’s cryptographic operations, α ≥ 1 is a generic cryptographic-cost multiplier relative to a lightweight baseline, Gi ≥ 0 is the expected gain from a successful deviation, and Pi > 0 is the penalty imposed upon detection. Theorem 12 (Nash Equilibrium Stability). Honest participation is the dominant strategy for every validator if and only if Pi > Gi − Ri , ∀i ∈ Vv . (44) Moreover, the cryptographic-cost multiplier α does not appear in Eq. (44); therefore, within the utility model of Eq. (43), changing the common per-block cryptographic overhead does not by itself require redesign of the reward-and-penalty condition. Proof. Honest participation is dominant if and only if Ui (honest) > Ui (deviate). Using Eq. (43), Ri − αCi > Gi − αCi − Pi , Ri > Gi − Pi , Pi > Gi − Ri .

(45) (46) (47)

The terms αCi cancel identically, proving Eq. (44) and the claimed independence from the common cryptographic-cost multiplier. 18

A PREPRINT - AUGUST 25, 2026

Table 3: Unified benchmark configurations used in the evaluation. Distinct validator sets correspond to distinct experimental objectives and should not be interpreted as one common sweep. Experiment Network size Trials / latency Fixed parameters and objective Topology scaling PBFT validator sensitivity Threshold decryption Byzantine-load sensitivity

nv ∈ {4, 8, 16, 32, 64}; nd = 200

20 trials; τ = 5 or 50 ms

Block size B = 100; topologydependent latency/throughput sensitivity nv ∈ 20 trials; τ = 5 ms Measured TPS series reported in {4, 5, 6, 7, 8, 10, 12, 16} Table 5 nv = 16; nd = 200 1000 trials 2048-bit Paillier modulus; nominal 128-bit classical security level nv = 7, f = 2; nbyz ∈ Recorded fault- Consensus latency and decryption {0, 1, 2} tolerant trials success within the admissible fault regime

The minimum penalty that maintains strict preference for honest participation is therefore Pi∗ = Gi − Ri + ε,

ε > 0.

(48)

Consequently, a protocol operator changing the cryptographic stack needs only to verify that the deployed penalty still satisfies Eq. (44), provided that the additional cryptographic cost is incurred symmetrically by the honest and deviating strategies as assumed in Eq. (43). This qualification is important: the theorem does not cover deviations that selectively avoid part of the prescribed cryptographic workload. The validator utility may also depend on network position. Under a reward-allocation model in which a validator’s effective processing opportunity increases with its degree, we write Ri ∝ degi B runit ,

(49)

where degi is the degree of validator Vi in Gv , B is the block size, and runit is the per-transaction reward. Under this model, substitution of Eq. (49) into Eq. (44) implies that a larger effective reward reduces the minimum penalty required by Eq. (48). Dense validator connectivity is independently beneficial to liveness because Theorem 9 requires κ(Gv ) ≥ f + 1, as established in Section 6. The game-theoretic argument should therefore be interpreted as complementary to, rather than a replacement for, the graph-theoretic resilience analysis of Section 6.

8

Implementation and Evaluation

The evaluation considers multiple benchmark configurations to assess performance and security–performance tradeoffs of the classical Φ-PHE-BC implementation. For topology and throughput analysis, the validator population is varied over nv ∈ {4, 8, 16, 32, 64} with a fixed device population of 200 and a block size of 100 transactions, and results are averaged over 20 trials. The emulated network conditions include an intra-data-center mean link latency of 5 ms and a wide-area mean link latency of 50 ms. Threshold-decryption overhead is evaluated at nv = 16 and 200 devices using 1000 trials per configuration, a 2048-bit Paillier modulus, and a nominal 128-bit classical security level. Byzantine resilience is evaluated at nv = 7, for which f = 2, with nbyz ∈ {0, 1, 2}. Thus, the empirical Byzantine experiments remain inside the configured fault-tolerant regime. Behavior outside that regime is treated analytically through Theorem 9, rather than being inferred from unperformed partition-attack experiments. 8.1

Implementation

The experiments in this section evaluate the primary Paillier threshold-aggregation path with classical ECDSA-256 transaction authentication. The optional BFV/CKKS bridge and optional ZKP configurations described in Section 4 are architectural extensions and are not benchmarked as part of the reported baseline unless explicitly stated. The experimental environment is built on Ubuntu 22.04 LTS (x86-64) with Python 3.11 as the primary orchestration and experiment language. Containerization and orchestration use Docker (v25.x) and Docker Compose (v2.x). The blockchain layer uses Hyperledger Fabric v2.5.4, Fabric CA v1.5.9 for identity management, and CouchDB v3.3.x as the world-state database. Classical cryptographic operations, including Paillier, ECDSA/ECIES, and HKDF, are implemented using pycryptodome (v3.20.0), together with SHA3-256 and SHAKE-256 from Python’s standard hashlib library. Graph analysis and scientific computation use NetworkX (v3.3), NumPy (v1.26.4), and SciPy (v1.13.0); visualization uses Matplotlib (v3.8.4), and data handling uses Pandas (v2.2.2). Network conditions are 19

A PREPRINT - AUGUST 25, 2026

Table 4: Encryption latency comparison across representative PHE-based systems (lower is better). System

Encryption time (ms)

Si et al. Aronoff et al. Njungle et al. Φ-PHE-BC (Proposed)

7.8 15.0 8.0 7.2

9 15 6 8

7.8

7.2

3

Sy st em

et al .

Pr op os ed

Nj un gl e

Ar on of fe ta l.

Si et al .

0

Paillier Enc/tx ECIES

8 6 4

40

80

40

2 0

Threshold Decryption Time (ms)

12

120

Ciphertext Size (bytes)

Encryption Time (ms) 15

Encryption time per item (ms)

10

Ciphertext Bytes ECIES Bytes 0

100

200

300

400

0

500

Batch Size

0

10

20

30

40

50

Plaintext Size (bits)

60

70

30

20 Current t=5

10

3

4

5

6 7 8 Threshold t

9

10

Figure 3: Cryptographic performance of the evaluated Φ-PHE-BC implementation: (a) encryption-time comparison across representative PHE-based systems; (b) encryption time per transaction under increasing batch size; (c) ciphertextsize comparison between Paillier and ECIES; and (d) threshold-decryption latency as a function of threshold parameter t. emulated using tc netem (iproute2 6.x) with normally distributed per-link delay and 1 ms jitter, supported by Linux network namespaces. Testing uses pytest (v8.1.1), and Fabric client interactions use grpcio and grpcio-tools (v1.63.0). 8.1.1

Chaincode

The PHE aggregation chaincode is implemented in Go and exposes nine transaction functions corresponding to the nine protocol phases described in Section 4.4. Homomorphic aggregation is performed using Go’s math/big package for modular arithmetic. Threshold partial decryption and Lagrange combination are also integrated into the chaincode workflow. The implementation also includes the mask-cancellation step used by the noise-flooding wrapper, so that the aggregate masking contribution is removed during threshold reconstruction before final plaintext recovery. Therefore, the measured threshold-decryption results include the correctness-preserving flooding/cancellation procedure rather than an unflooded threshold-Paillier baseline. The information-theoretic protection associated with this flooding step is the property established in Theorem 5; it should not be conflated with the classical computational security of Paillier. 8.1.2

Transaction Authentication

Device transactions are authenticated using ECDSA-256 signatures in the evaluated implementation, consistent with the classical EUF-CMA transaction integrity result of Theorem 7. The baseline is a classical PHE–blockchain configuration using Paillier aggregation, ECDSA-256 signatures, and ECDH key establishment, corresponding to the classical design family represented by Si et al. [6]. 8.1.3

Topology Emulation

The four topology classes are emulated using Linux network namespaces and tc netem for per-link latency injection. The mean link latency τ is configured as 5 ms for the intra-data-center baseline and 50 ms for the wide-area IoT setting. For topology-scaling experiments, validator counts are selected from nv ∈ {4, 8, 16, 32, 64}; the separate PBFT validator-sensitivity experiment uses the set reported in Table 3. Device counts are selected from nd ∈ {50, 200, 500}. These experiments operationalize the network-diameter and connectivity effects analyzed in Section 6. The proposed Φ-PHE-BC implementation records an encryption latency of 7.2 ms in the comparison summarized in Table 4. Figure 3(a) visualizes the same comparison. Figure 3(b) shows the effect of increasing batch size on per-transaction encryption cost, while Figure 3(c) illustrates the ciphertext-size expansion of Paillier relative to ECIES. Figure 3(d) reports threshold decryption latency as a function of the threshold parameter t; in the tested range, the latency remains below 20 ms. 20

A PREPRINT - AUGUST 25, 2026

Table 5: Throughput under increasing validator count (PBFT consensus). nv 4 5 6 7 8 10 12 16 Throughput (TPS)

327

336

313

297

275

255

204

143

336

Consensus Latency Under Byzantine Load (nv = 7, f = 2, fault-tolerant regime) Consensus Latency (ms)

Throughput

280

210 327

336

140

313

297

275

255 204 143

70

0 4

5

6

7

8

10

12

16

40

30.72

Decryption success: 100% 28.28 across all trials27.29 in this regime

0 (n=12)

1 (n=48)

30 20 10 0

Validators Counts (nv)

2 (n=86)

Byzantine Validator Count (nbyzantine) Figure 4: Consensus-performance sensitivity: (a) PBFT-style throughput under increasing validator count; and (b) consensus latency under increasing Byzantine-validator count within the configured fault-tolerant regime nbyz ≤ f . 8.2

Throughput and Latency

Measured throughput under the intra-data-center latency setting (τ = 5 ms) is consistent with the topology dependence predicted by Theorem 10: topologies with smaller effective validator-network diameter incur a smaller communication component in Eq. (29). Across the validator-count benchmark, throughput ultimately decreases as the validator population grows because the adopted BFT voting procedure contains a quadratic all-to-all communication component, as quantified by Proposition 11. Table 5 reports the measured PBFT-style throughput series, and Figure 4(a) shows the corresponding scaling trend. For nv = 7 and f = 2, consensus latency under the tested sub-threshold Byzantine load remained between approximately 27 and 31 ms for nbyz ∈ {0, 1, 2}, while decryption success remained at 100% across the recorded trials. These observations are consistent with the sufficiency direction of Theorem 9 for the tested fully connected validator overlay. Figure 4(b) reports the measured Byzantine-load sensitivity. No empirical claim is made for nbyz > f . Transaction-per-second scaling with network size is shown in Figure 5(a). Under the benchmark used for the crosssystem comparison, the proposed system records approximately 3120 TPS compared with approximately 1950 TPS for Si et al., while the corresponding end-to-end transaction latency decreases from approximately 2307 ms to approximately 410 ms. The latency reduction is approximately 82%. These values are configuration-specific benchmark results and should not be interpreted as topology-independent deployment guarantees. Figure 5(b) shows the measured latency trend as the number of IoT devices increases; Figure 5(c)–(d) provide the cross-system latency and throughput comparisons. The threshold-decryption entry in Table 6 shows that Φ-PHE-BC incurs a higher threshold-decryption time than the selected Si et al. comparison value (13.8 ms versus 9.8 ms), even though its reported end-to-end latency and throughput are better under the cross-system benchmark. This is the expected trade-off to report from the numerical values provided, rather than claiming a threshold-decryption speedup. Figure 6(a) visualizes this threshold-decryption comparison. Table 6: End-to-end latency and throughput comparison against the selected prior system. Metric

Si et al.

Φ-PHE-BC

End-to-end transaction latency (ms) Throughput (TPS) Threshold decryption time (ms)

2307 1950 9.8

410 3120 13.8

21

2,000

1,000

0 0

20

40

60

Nodes

80

100

8,500 7,745 6,991 6,236 5,482 4,727 3,973 3,218 2,464 1,709 955 200

2307

3120

1840

2480 Throughput (TPS)

Phi-PHE-BC Si_et_al BlockFDT

E2E Transaction Latency (ms)

Transactions Per Second

3,000

End-to-End Latency (ms)

A PREPRINT - AUGUST 25, 2026

1380 2307 920 460

240 Number 430 620 810 of IoT Devices (n_d)

3120 1240 1950 620

410 0

50

1860

0

1,000

Si et al.

Proposed

Si et al.

Proposed System

Figure 5: Scalability and cross-system performance: (a) transaction-per-second scaling with network-node count; (b) end-to-end latency with increasing IoT-device population; (c) end-to-end transaction-latency comparison against the selected prior system; and (d) throughput comparison under the stated cross-system benchmark configuration.

12

9 13.8

97 40 64

64

20

385.04 0

8 Pr op os ed

120.33

PH E

138.37

As ym -E nc

0

457.24

60

Ke y

Pla in te xt BC Sin gle Ke y PH E EC IE S As ym -E nc

Proposed System

240

35 Pr op os ed

0

0

24

480

80

EC IE S

60

Ciphertext (bytes)

261.95

120

720

Pr op os ed

284.73

Throughput (TPS)

180

960

Pla in te xt BC Sin gle Ke y PH E EC IE S As ym -E nc

3

Si et al.

97

1216

240

Sin gle

284.73

9.8

Pla in te xt BC

6 Latency (ms)

Thresold Decryption Time (ms)

14

Figure 6: Detailed baseline comparisons: (a) threshold-decryption time against the selected prior framework; and (b) latency–throughput–ciphertext trade-off across the evaluated blockchain variants. Figure 6(b) compares plaintext blockchain, single-key PHE, ECIES-based encrypted blockchain, and the proposed threshold-PHE blockchain configuration. Plaintext operation minimizes cryptographic overhead but provides no confidentiality; a single-key PHE design retains a centralized key-recovery point; and the proposed threshold design distributes decryption authority at the cost of additional cryptographic and communication overhead. 8.3

Security–Performance Comparison

Table 7 compares the architectural properties reported for the selected schemes. The distinguishing feature of Φ-PHEBC in this comparison is the joint use of threshold decryption, blockchain integration, homomorphic aggregation, topology-aware liveness, throughput, and connectivity-based fault-tolerance analysis. 8.4

Liveness Verification

Theorem 9 establishes that liveness holds if and only if κ(Gv ) ≥ f + 1,

(50)

under the authenticated-path and partial-synchrony assumptions stated in Section 6. The empirical evaluation covers only the fault-tolerant regime. For nv = 7 (f = 2) and nbyz ∈ {0, 1, 2}, the fully connected validator overlay satisfies the required vertex-connectivity condition, and consensus completed successfully in 100% of the recorded trials. The measurements summarized in Figure 4(b) are therefore consistent with the sufficiency direction of Theorem 9. We did not empirically evaluate configurations violating the connectivity condition, such as a validator overlay with κ(Gv ) < f + 1, nor did we run partition-attack trials for nbyz > f . Consequently, the necessity direction of Theorem 9 is supported in this paper by the constructive partition argument of Section 6, not by an empirical failure-regime experiment. Directly validating that failure regime across multiple values of nv and multiple validator connectivity patterns is retained as future work. 22

A PREPRINT - AUGUST 25, 2026

Table 7: Security and feature matrix comparison. Scheme

Threshold Decryption

Blockchain Integration

Homomorphic Encryption

Topology-Aware Liveness

IoT Support

✗ ✓ ✗ ✗ ✗ ✓

✓ ✓ ✗ ✓ ✗ ✓

✗ ✓ ✓ ✓ ✓ ✓

✗ ✗ ✗ ✗ ✗ ✓

✓ ✗ ✗ ✗ ✗ ✓

Block-FDT Si et al. Ci et al. Aronoff et al. Njungle et al. Φ-PHE-BC (Proposed)

8.5 8.5.1

Limitations and Future Work Experimental Scope

The experimental evaluation uses an emulated Hyperledger Fabric environment with controlled latency settings and modeled topology classes rather than a large-scale physical IoT deployment. The reported latency and throughput values should therefore be interpreted as implementation-level evidence under the tested configurations, not as universal deployment guarantees. The experiments cover selected validator counts, device populations, and workload settings; larger networks, heterogeneous edge hardware, intermittent links, and mobility can alter both cryptographic and consensus costs. 8.5.2

Trusted-Execution Dependency

The optional Paillier–BFV bridge of Section 4.5 assumes a trusted execution environment for secure decrypt-and-reencrypt processing. The practical security of that optional component therefore, depends on the TEE trust model and implementation assumptions stated in the framework design. This dependency is separate from the security of the primary Paillier aggregation path evaluated in this section. 8.5.3

Device-Layer Topology Augmentation

Tree- and star-shaped device deployments do not by themselves establish the validator-connectivity condition required by Theorem 9. The validator overlay must be configured or augmented independently so that κ(Gv ) ≥ f + 1, consistent with the validator/device-topology separation discussed in Section 6. 8.5.4

Empirical Liveness-Failure Regime

As discussed in Section 8.4, the empirical liveness study covers only nbyz ≤ f . The failure regime predicted by the necessity direction of Theorem 9 remains to be validated experimentally using controlled vertex-cut and partition attacks. 8.5.5

Post-Quantum Migration as Future Work

The present Φ-PHE-BC architecture does not claim general post-quantum security. Theorem 4 provides classical IND-CPA confidentiality for Paillier under the DCR assumption, and Theorem 7 provides classical transaction integrity for the deployed ECDSA-256 authentication scheme. In contrast, Theorem 5 provides a statistical, information-theoretic protection result for the modeled flooded partial-decryption shares and therefore does not rely on computational hardness assumptions. A future quantum-capable adversary could nevertheless threaten the long-term confidentiality of Paillier ciphertexts and the unforgeability of ECDSA-authenticated transactions. Closing these gaps is a future-work objective rather than a property of the current system. A concrete migration roadmap is as follows: • Transport and authentication. Replace classical session-key establishment and ECDSA-256 transaction signatures with standardized post-quantum key establishment and digital signatures, such as ML-KEM and ML-DSA, respectively, in a future implementation [33, 34]. Their measured effect on the full Φ-PHE-BC transaction path must be established experimentally rather than assumed. Within the symmetric-cost utility model of Theorem 12, any resulting common cost increase is represented by α and cancels from the honestversus-deviate condition. 23

A PREPRINT - AUGUST 25, 2026

• Aggregation layer. Investigate replacing Paillier as the primary aggregation primitive with a lattice-based homomorphic scheme, such as BFV or another suitable Module-LWE-based construction, so that the aggregation layer itself no longer depends on the DCR assumption. The current Paillier-BFV bridge in Section 4.5 is optional and TEE-dependent; promoting a lattice-based primitive to the primary path would therefore require a new protocol design and new security analysis rather than a simple relabeling of the existing architecture. • Threshold decryption over the new ciphertext space. Re-derive Phase 7 for the selected lattice-based ciphertext space and determine whether an analog of the current threshold-share protection can be constructed. In particular, the noise-flooding analysis of Theorem 5 cannot be transferred automatically from the present Paillier-based exponent/share model to a ring-based scheme. • End-to-end security against a quantum-capable adversary. Revisit Theorem 6 after the transport, authentication, and aggregation primitives have actually been replaced by post-quantum candidates. The present theorem is explicitly a classical end-to-end confidentiality result and should not be interpreted as a quantumsecurity proof. • Empirical post-quantum overhead. Implement the migrated stack and repeat the benchmark methodology of Sections 8.1 and 8.2 to measure end-to-end latency, throughput, ciphertext expansion, signature size, key-establishment cost, and validator CPU/memory overhead under realistic IoT workloads. The roadmap above is intentionally separated from the evaluated results. No ML-KEM, ML-DSA, BFV-primary aggregation, or other lattice-based post-quantum configuration is treated as implemented or proven in the present paper. 8.5.6

Variation Across Reported Throughput Results

Throughput values in this section correspond to different evaluation objectives. Table 5 and Figure 4(a) report validator-count sensitivity at a fixed moderate block configuration, whereas Table 6 and Figure 5 report the cross-system benchmark configuration. Figure 6(b) reports a fixed cross-variant trade-off configuration. These values should therefore be compared only within their stated benchmark settings rather than treated as interchangeable estimates of a single deployment-wide throughput constant.

9

Conclusion

This paper presented Φ-PHE-BC, a topology-aware homomorphic blockchain architecture for privacy-preserving IoT data aggregation. The framework combines on-chain Paillier-based aggregation, threshold decryption with information-theoretic protection of partial-decryption shares, standard signature-based transaction integrity, and topology-parameterized analysis of liveness and throughput, together with an explicit per-block communication-cost model. The central contribution of this work is the proof that validator-graph connectivity is a necessary and sufficient determinant of protocol liveness, namely, κ(Gv ) ≥ f + 1, (51) together with topology-parameterized throughput bounds for tree, star, mesh, and scale-free deployment models and an explicit per-block communication-cost expression—a treatment absent from the selected PHE-blockchain literature. We further showed that validator incentive stability, formalized through a Nash-equilibrium analysis of honest-versusdeviate strategies, is robust to the magnitude of the deployed cryptographic cost. This property is directly relevant to future increases in cryptographic overhead. The implementation results on Hyperledger Fabric suggest that the proposed design is practical for the tested configurations and can achieve lower latency than the selected classical baseline while preserving threshold-based distributed trust. At the same time, these findings should be interpreted in light of the study’s assumptions, including emulated network conditions, selected topology classes and validator sizes, and reliance on a trusted execution environment for the optional Paillier–BFV bridge. We deliberately scope the security claims of this paper to the classical and information-theoretic guarantees established in Section 5. Section 8.5 instead outlines a concrete migration path toward a fully post-quantum-confidential instantiation of the framework, which constitutes the primary direction for future work. Future research will also extend the evaluation to real-world IoT deployments, broader workload and mobility settings, and stronger verification of bridge and computation correctness under less trusted execution assumptions.

24

A PREPRINT - AUGUST 25, 2026

References [1] Shaopeng Guan, Youliang Cao, and Yuan Zhang. Blockchain-enhanced data privacy preservation and secure sharing scheme for healthcare iot. IEEE Internet of Things Journal, 12(5):5600–5614, 2025. [2] Satoshi Nakamoto. Bitcoin: A peer-to-peer electronic cash system. https://metzdowd.com, pages 1–9, 03 2009.

Cryptography Mailing list at

[3] Abdullah Lakhan, Tor-Morten Groenli, Huaming Wu, Muhammad Younas, and George Ghinea. A novel homomorphic blockchain scheme for intelligent transport services in fog/cloud and iot networks. IEEE Transactions on Intelligent Transportation Systems, 26(2):1914–1929, 2025. [4] Guijuan Wang, Qi Liu, Zhongyuan Yu, Hongliang Zhang, and Anming Dong. Bce-ppds: Blockchain-based cloud–edge collaborative privacy-preserving data sharing scheme for iot. Future Generation Computer Systems, 174:107922, 2026. [5] Yuqing Xu, Guangxia Xu, Yong Liu, Yuan Liu, and Ming Shen. A survey of the fusion of traditional data security technology and blockchain. Expert Systems with Applications, 252:124151, 2024. [6] Haiping Si, Weixia Li, Nan Su, Tingting Li, Yanling Li, Chuanhu Zhang, Bacao Fernando, and Changxia Sun. A cross-chain access control mechanism based on blockchain and the threshold paillier cryptosystem. Computer Communications, 223:68–80, 2024. [7] Pascal Paillier. Public-key cryptosystems based on composite degree residuosity classes. In Advances in Cryptology – EUROCRYPT 1999, volume 1592 of Lecture Notes in Computer Science, pages 223–238. Springer, 1999. [8] Ruoting Xiong, Wei Ren, Shenghui Zhao, Jie He, Yi Ren, Kim-Kwang Raymond Choo, and Geyong Min. Copifl: A collusion-resistant and privacy-preserving federated learning crowdsourcing scheme using blockchain and homomorphic encryption. Future Generation Computer Systems, 156:95–104, 2024. [9] Ruizhe Yang, Tonghui Zhao, F. Richard Yu, Meng Li, Dajun Zhang, and Xuehui Zhao. Blockchain-based federated learning with enhanced privacy and security using homomorphic encryption and reputation. IEEE Internet of Things Journal, 11(12):21674–21688, 2024. [10] Baofu Han, Bing Li, Raja Jurdak, Peiyun Zhang, Hao Zhang, Pan Feng, and Chau Yuen. Pbfl: A privacy-preserving blockchain-based federated learning framework with homomorphic encryption and single masking. IEEE Internet of Things Journal, 12(10):14229–14243, 2025. [11] Muhammad Firdaus, Harashta Tatimma Larasati, and Kyung Hyune-Rhee. Blockchain-based federated learning with homomorphic encryption for privacy-preserving healthcare data sharing. Internet of Things, 31:101579, 2025. [12] Yunhua He, Shuang Wang, Zhihao Zhou, Ke Xiao, Anke Xie, and Bin Wu. A blockchain-based carbon emission security accounting scheme. Computer Networks, 243:110304, 2024. [13] Dongyu Cao, Bixin Li, and Jingyuan Cai. A privacy-preserving method for cross-chain interoperability using homomorphic encryption. Peer-to-Peer Networking and Applications, 18(1):48, Dec 2024. [14] Wenxian Jiang, Jun Tao, and Zhenglei Guan. A trusted data privacy computing method for vehicular ad hoc networks based on homomorphic encryption and dag blockchain. IEEE Internet of Things Journal, 12(6):6621– 6632, 2025. [15] Xiaohua Wu, Jing Wang, and Tingbo Zhang. Integrating fully homomorphic encryption to enhance the security of blockchain applications. Future Generation Computer Systems, 161:467–477, 2024. [16] Weinan Liu, Lin You, Yunfei Shao, Xinyi Shen, Gengran Hu, Jiawen Shi, and Shuhong Gao. From accuracy to approximation: A survey on approximate homomorphic encryption and its applications. Computer Science Review, 55:100689, 2025. [17] Rabia Latif, Bello Musa Yakubu, Nor Shahida Mohd Jamail, Amir Mohamed Talib, and Fahad Omar Alomary. Bbas: A blockchain-based authentication system for e-health with multi-factor authentication, access control, and post-quantum security. Scientific Reports, Feb 2026. [18] Khalil Hariss, Jean Paul A. Yaacoub, and Hassan N. Noura. Homomorphic cryptography: Challenges and perspectives. Computer Science Review, 59:100815, 2026. [19] Shreyansh Sharma, Anurag Mudgil, Richa Dubey, Anil Saini, and Santanu Chaudhury. A bibliometric analysis of homomorphic encryption for privacy-preserving biometrics. Computers and Electrical Engineering, 131:110969, 2026. 25

A PREPRINT - AUGUST 25, 2026

[20] Daniel Aronoff, Adithya Bhat, Panagiotis Chatzigiannis, Mohsen Minaei, Srinivasan Raghuraman, Robert M. Townsend, and Nicolas Xuan-Yi Zhang. SoK: Fully-homomorphic encryption in smart contracts. Cryptology ePrint Archive, Paper 2025/527, 2025. [21] Mi-Ying (Miryam) Huang, Baiyu Li, Xinyu Mao, and Jiapeng Zhang. Fully homomorphic encryption with efficient public verification. Cryptology ePrint Archive, Paper 2024/1764, 2024. [22] Zhenkun Yang, Suvadeep Banerjee, Jeremy Casas, and Jin Yang. Formal verification of a custom compiler for a fully homomorphic encryption accelerator. 2025 26th International Symposium on Quality Electronic Design (ISQED), pages 1–7, 2025. [23] Kazuma Shiraishi, Keisuke Hara, Toi Tomita, Kyosuke Yamashita, and Junji Shikata. Homomorphic signature with designated evaluator. IEEE Access, 13:23950–23958, 2025. [24] Nges Brian Njungle, Milan Stojkov, and Michel A Kinsy. A safety-centric analysis and benchmarks of modern open-source homomorphic encryption libraries. no. Secrypt, pages 978–989, 2025. [25] Raniyah Wazirali, Fatma Foad Ashrif, and Rami Ahmad. Selective homomorphic encryption with lle enhances privacy and scalability in doorbell face recognition. IEEE Access, 14:27650–27664, 2026. [26] Ashish Kumar, Kakali Chatterjee, Ashish Singh, Abhinav Kumar, and Hamad Aldawsari. Privacy-preserving federated learning with blockchain auditing for consumer electronics applications. IEEE Transactions on Consumer Electronics, pages 1–1, 2026. [27] K. Jagdeesh, N. Kanimozhi, Tanvir H. Sardar, N. Naveenkumar, B. Mahalakshmi, A. Chandrasekar, M. Karpagam, and Sk Mahmudul Hasan. Federated learning with continual update for privacy-preserving clinical event prediction across distributed hospitals using mcn-gnn. Scientific Reports, Mar 2026. [28] Jiawei Zha, Guoan Zhang, Li Jin, Shuping Dang, and Wei Duan. Lightweight privacy-preserving ids for its: Integrated federated learning and blockchain. IEEE Transactions on Intelligent Transportation Systems, pages 1–16, 2026. [29] Zhenqi Wang, Peng Yang, Angze Du, Dongmei Yang, and Xiaoyan Liu. Attribute-based searchable encryption for secure data sharing with blockchain in vanets. Computer Networks, 277:112026, 2026. [30] Ahmed M. Tawfik, Ayman Al-Ahwal, Adly S. Tag Eldien, and Hala H. Zayed. Pricollabanalysis: privacypreserving healthcare collaborative analysis on blockchain using homomorphic encryption and secure multiparty computation. Cluster Computing, 28(3):191, Jan 2025. [31] Shang Ci, Sen Hu, Donghai Guan, and Çetin Kaya Koç. Privacy-preserving word vectors learning using partially homomorphic encryption. Journal of Information Security and Applications, 89:103999, 2025. [32] Muath AlShaikh, Mostefa Kara, Farid Binbeshr, and Mustafa Ghaleb. An otp and watermarking based partial homomorphic approach to authenticated and integrated cloud computing. Cluster Computing, 28(8):520, Aug 2025. [33] National Institute of Standards and Technology. Module-lattice-based key-encapsulation mechanism standard (CRYSTALS-Kyber). Technical Report FIPS 203, NIST, 2024. [34] National Institute of Standards and Technology. Module-lattice-based digital signature standard (CRYSTALSDilithium). Technical Report FIPS 204, NIST, 2024. [35] National Institute of Standards and Technology. Federal Information Processing Standard (FIPS) 205, Stateless Hash-Based Digital Signature Standard — csrc.nist.gov. https://csrc.nist.gov/pubs/fips/205/final, 2024. [Accessed 13-03-2026].

26

Related documents

• Privacy-Preserving IoT Data Aggregation Based on Blockchain and Homomorphic Encryption#400539
• Privacy-enhancing distributed protocol for data aggregation based on blockchain and homomorphic encryption#419003
• An integrated privacy preserving data aggregation framework for IoT networks using homomorphic encryption and secure computation.#327220
• Homomorphic encryption for privacy-preserving data aggregation in data spaces.#263139
• Resource Management and Secure Data Exchange for Mobile Sensors Using Ethereum Blockchain#1121781