The work, led by Mohammad Iqbal Saryuddin Assaqty of Universitas Nahdlatul Ulama Indonesia, with collaborators at South China University of Technology, the Beijing Institute of Technology, and Fordham University, addresses a problem that has grown sharper as manufacturing shifts toward what researchers term the Internet of Production, or IoP. In this vision, production systems are no longer isolated islands of automation. They are networked ecosystems where data flows between machines on a factory floor, between multiple plants owned by the same company, and between entirely separate organizations collaborating on a shared product. Each of those flows demands trust, and trust is precisely what conventional cloud-centric architectures struggle to guarantee.

The core insight of the paper is that not all manufacturing data transactions are created equal. A temperature reading from a machine inside a single plant has very different trust requirements than a quality certificate shared between two competing suppliers working on the same contract. XManuChain therefore divides the transactional world into three distinct scopes. The local scope covers transactions within one factory. The inter-local scope covers exchanges across multiple factories belonging to the same organization. The cross-domain scope covers communication between different organizations entirely. Rather than forcing all three through the same pipe, the framework assigns each its own authentication pathway, its own agent architecture, and its own relationship to the shared blockchain ledger.

Technically, the framework rests on what the authors describe as a hierarchical agent-based transaction model. Each operational layer is populated by dedicated software agents. User devices—sensors, controllers, human interfaces—are registered and authenticated within their local environment through a local agent. When data must cross the boundary between factories of the same organization, an inter-local agent brokers the exchange, verifying that both endpoints are legitimate members of the broader organizational network. When collaboration extends across organizational boundaries, a cross-domain agent takes over, enforcing stricter identity checks and recording the transaction on the permissioned ledger so that neither party can later dispute what was exchanged or when. This layering means that lightweight devices on the factory floor never need to bear the full cryptographic burden of cross-organizational verification; that responsibility is delegated upward to more capable infrastructure.

The blockchain at the heart of the system is permissioned rather than public. In a permissioned network, every participant is known and vetted before joining, and consensus is achieved among a limited set of trusted nodes rather than through energy-intensive proof-of-work mining. This choice matters enormously for manufacturing, where transaction throughput, latency, and regulatory accountability are paramount. The prototype was built in a Hyperledger Composer and Playground environment, a widely used open-source toolchain for modeling business networks and smart contracts. The researchers used it to validate transaction logic and to confirm that ledger state transitions behaved as intended across all three operational scopes—local, inter-local, and cross-domain workflows all executed correctly in the modeled scenarios.

Of course, a blockchain can guarantee that recorded transactions are tamper-evident, but it cannot by itself guarantee that the entities initiating those transactions are who they claim to be. Authentication is therefore the second pillar of XManuChain. The framework defines a blockchain-backed authentication scheme covering four classes of actors: user devices, local agents, external agents, and cross-domain agents. Each must prove its identity before participating in a transaction, and the proof is anchored to the shared ledger so that credentials cannot be forged or replayed undetected. This design draws on a body of prior work in mutual authentication protocols, including schemes developed for roaming services in global mobility networks and for 5G systems, but adapts those ideas to the specific constraints and trust relationships of collaborative manufacturing.

To assess whether the authentication scheme actually holds up under scrutiny, the team turned to two established formal verification techniques. The first is BAN logic, a classical method introduced by Burrows, Abadi, and Needham in 1990, which allows researchers to reason step by step about what each party in a protocol can believe at each stage of an exchange—whether a shared key is genuinely fresh, whether a message truly originated from the claimed sender, and whether both sides end up with mutual belief in each other’s identity. The second is AVISPA, the Automated Validation of Internet Security Protocols and Applications, a formal tool that models security protocols in a specialized language and searches for attack scenarios that a protocol designer might have overlooked. Together, these analyses examined the authentication properties of the framework across its registration and authentication phases for local, inter-local, and cross-domain scenarios. The reported results indicate that the protocol logic satisfies the intended authentication goals in the modeled settings.

The authors are candid about the limits of what they have demonstrated, and that candor is worth emphasizing. The evaluation was carried out in a browser-based, resource-constrained prototype environment using Hyperledger Composer’s Playground tool, which is designed for modeling and validating business network logic rather than for measuring production-scale throughput. The paper does not yet provide a full distributed deployment specification, meaning that the performance findings should be read as evidence of functional feasibility rather than as definitive benchmarks. A real deployment across multiple factories and organizations would involve consensus overhead, network latency, node failures, and adversarial traffic that a browser-based prototype cannot fully capture. The contribution, as the researchers frame it, lies not in raw performance numbers but in the integration itself—the demonstration that permissioned ledger, edge computing, and cloud services can be composed into a coherent, hierarchically organized transaction model for production collaboration.

That integration is precisely what distinguishes this work from earlier efforts. Blockchain has been proposed for supply chain traceability, for IoT device security, and for federated learning systems. Edge computing has been studied extensively for reducing latency in industrial IoT. Cloud platforms have long been the default home for manufacturing analytics. What has been missing, the authors argue, is a framework that treats these three not as alternatives but as complementary layers of a single security architecture, with the operational scope of each transaction determining which layer handles authentication and recording. In a cross-domain scenario, for instance, the blockchain provides the immutable audit trail that makes disputes resolvable without a trusted third party, while edge infrastructure handles the low-latency data exchange and cloud services support analytics and long-term storage.

The implications for industry are potentially significant. Cross-factory collaboration is becoming the norm in sectors such as aerospace, automotive, and electronics, where no single company owns the entire production process. Yet each new partnership multiplies the number of access-control relationships that must be managed, and each shared data stream expands the attack surface. A framework that standardizes how devices, agents, and organizations authenticate across these boundaries—and that anchors every transaction to a shared, tamper-evident ledger—could reduce the operational burden of securing such collaborations while making them more auditable. The three-scope model also gives organizations a vocabulary for reasoning about which security guarantees apply where, something that flat, one-size-fits-all architectures tend to obscure.

The research builds on a substantial lineage. Earlier work by some of the same authors explored private blockchain approaches for material and product tracking in smart manufacturing, and lightweight authentication schemes using physical uncoable functions for supply chain IoT. Other members of the team have contributed to distributed denial-of-service detection using deep learning and meta-learning techniques, expertise that informs the framework’s awareness of adversarial threats to networked infrastructure. The new paper synthesizes these threads into a unified architecture aimed squarely at the collaborative production scenario.

What comes next will determine whether XManuChain remains an elegant prototype or becomes a practical foundation for industrial deployment. The authors’ own framing suggests a roadmap: a full distributed deployment specification, testing on production-grade Hyperledger Fabric networks with real consensus configurations, and performance evaluation under realistic manufacturing workloads. Questions of scalability—how many agents, how many transactions per second, how large the ledger grows under sustained cross-domain collaboration—remain open. So too do questions of governance: who operates the permissioned network when multiple organizations are involved, and how are membership changes handled. These are not weaknesses of the study so much as the natural boundary of what a single paper can establish.

For now, XManuChain offers something the field has lacked: a carefully structured, formally analyzed template for securing the transactional fabric of collaborative manufacturing. As smart factories multiply and the boundaries between organizations grow increasingly porous, frameworks of this kind—grounded in permissioned ledgers, layered agent architectures, and rigorous protocol verification—may well become part of the standard toolkit for building trust into the industrial internet.

The advent of IIoT has transformed various sectors, including manufacturing, energy, and transportation, offering unprecedented capabilities for data collection, analysis, and operational efficiency. However, these advancements come hand-in-hand with vulnerabilities that can be exploited, leading to significant operational disruptions and financial losses. The conventional security measures often fall short in addressing the sophisticated tactics employed by cyber adversaries who continually evolve their strategies.

Recognizing the urgent need for advanced security mechanisms, the researchers introduce D3O-IIoT, an innovative framework that leverages deep reinforcement learning to create a dynamic deception orchestration system. This approach is particularly intriguing as it employs the principles of deception technology—an emerging field designed to mislead potential attackers by creating decoys and traps to protect critical assets. The D3O-IIoT framework aims not only to detect potential intrusions but also to actively engage cyber adversaries in a manner that increases the overall complexity of the attack surface.

Deep reinforcement learning (DRL) stands as a transformative methodology in artificial intelligence, particularly suitable for environments with numerous variables and possible outcomes. Unlike traditional supervised learning methodologies, which rely on labeled data, DRL algorithms learn to make decisions through trial and error, maximizing long-term rewards. By integrating DRL into the deception orchestration, the D3O-IIoT framework illuminates the path toward more adaptive and intelligent security measures that can evolve in real-time.

The research entails a robust architecture that encompasses multiple levels of deception, aiming to frustrate attackers while safeguarding vital information and operational integrity. Through simulations and experimental setups, the authors demonstrate how the D3O-IIoT model can be fine-tuned to recognize patterns indicative of malicious behavior. This adaptability ensures that the system remains effective in countering new and sophisticated attack vectors that jeopardize industrial operations.

In scenarios involving IIoT devices, the challenge lies in the scale and diversity of the networked systems. Each device may have unique characteristics and functions, which requires a highly nuanced security strategy. The D3O-IIoT addresses this intricacy by deploying a modular framework that allows for the integration of various deception tactics tailored to specific industrial contexts. This versatility highlights the system’s potential applicability across multiple sectors and operational environments.

One of the pivotal components of the D3O-IIoT framework is its ability to simulate various attack scenarios with high fidelity. This simulation capability not only provides insight into potential vulnerabilities but also informs the automated deployment of deceptive measures best suited to counteract those threats. As a result, organizations can evaluate their security posture proactively rather than reactively, leading to significant improvements in risk management and incident response.

The benefits of employing deep reinforcement learning in this capacity extend beyond deception tactics. By continuously analyzing interactions between the IIoT devices and potential attackers, the DRL algorithms learn and adapt, minimizing false positives and enhancing detection accuracy. This characteristic addresses a critical challenge faced by security teams—overwhelming alerts that can distract from genuine threats.

Moreover, D3O-IIoT emphasizes collaboration among devices, allowing them to share intelligence about threats and countermeasures in real-time. This collaborative learning environment fosters a collective defense mechanism that can dynamically adjust based on the latest threat intelligence. Such an approach aligns well with the rapidly changing landscape of cyber threats and the need for infrastructures that can react instantaneously.

The implications of D3O-IIoT extend well beyond operational security. Companies implementing this advanced framework can expect more resilient business processes, leading to reduced downtime and enhanced productivity. Additionally, by creating a more secure IIoT environment, organizations also fortify customer trust and compliance with regulatory standards, which is ever more critical in today’s data-driven world.

As businesses embark on digital transformation journeys, the challenge of securing IIoT infrastructure must be at the forefront of their strategic planning. The insights gleaned from Wushishi et al.’s research suggest that proactive, intelligence-driven security measures can safeguard assets and operations from an ever-growing array of cyber threats. The D3O-IIoT framework exemplifies a shift towards predictive security models—prioritizing anticipation and adaptation over mere response.

In conclusion, as industries increasingly integrate IIoT technologies into their operational frameworks, the need for robust security measures becomes paramount. The innovative D3O-IIoT framework, powered by deep reinforcement learning, represents a significant leap forward in the realm of industrial cybersecurity. By employing dynamic deception orchestration, organizations can cultivate a proactive approach to threat detection and response, securing not just their devices but the future of interconnected industrial operations. The study presented by Wushishi, Hussain, and Khalid paves the way for new research avenues and practical implementations that promise to enhance the resilience of our technologically advanced environments.

The exploration of these advanced frameworks highlights a fundamental shift in cybersecurity philosophy, demonstrating that deception can be an invaluable tool in the defense arsenal against nefarious actors. As D3O-IIoT continues to evolve and be refined, it will likely inspire further innovations in the quest for safer and more reliable IIoT infrastructures.

Subject of Research: Industrial IoT security through deep reinforcement learning

Article Title: D3O-IIoT: deep reinforcement learning-driven dynamic deception orchestration for industrial IoT security

Article References:

Wushishi, U., Hussain, A., Khalid, M.I. et al. D3O-IIoT: deep reinforcement learning-driven dynamic deception orchestration for industrial IoT security.
Sci Rep (2025). https://doi.org/10.1038/s41598-025-33426-4

Image Credits: AI Generated

DOI: 10.1038/s41598-025-33426-4

Keywords: Industrial IoT, cybersecurity, deep reinforcement learning, deception technology, dynamic orchestration.