The core weakness the researchers set out to fix is architectural. Most existing authentication schemes for vehicular networks rely on a single Trusted Authority, a central server that vouches for every vehicle and issues the cryptographic credentials needed to join the network. That model works reasonably well when the fleet is small, but it carries two structural flaws that grow worse with scale. First, as the number of vehicles climbs into the hundreds of thousands, the central authority becomes a computational bottleneck: every registration, every credential check, and every revocation must pass through one system. Second, and more dangerously, the authority represents a single point of failure. Compromise that one server, and an attacker can impersonate vehicles, forge safety messages, or silently disable the trust fabric of an entire transportation network. The team’s answer is to distribute trust across multiple Trusted Authorities using a blockchain as the shared, tamper-resistant ledger that lets them cooperate without a single dominant player.

Cross-domain authentication is the technical heart of the proposal. In a realistic smart-city deployment, vehicles do not stay within the jurisdiction of one authority. A car registered in one municipality may drive through neighboring regions, each managed by a different Trusted Authority with its own databases and policies. Under the traditional model, a vehicle crossing such a boundary either cannot authenticate at all or must re-register from scratch, wasting time and bandwidth. BAS-IoV enables what the authors call cross-TA authentication: authorities that have never directly trusted each other can verify a visiting vehicle’s credentials by consulting the blockchain, which records registration and authentication information in a form that no single party can alter retroactively. The result is a network in which trust is portable, and in which the failure or corruption of any one authority cannot cascade through the whole system.

What makes the protocol genuinely notable, however, is how little computation it demands. Blockchain-based security schemes have a reputation problem: they are often heavy, requiring expensive public-key operations that strain the modest processors embedded in vehicles and roadside units. The researchers deliberately built BAS-IoV from efficient cryptographic primitives. Elliptic Curve Cryptography provides strong security with comparatively small keys and fast operations, since the difficulty of the elliptic curve discrete logarithm problem underpins the scheme’s resistance to forgery. Hash functions compress and bind messages together, and XOR operations, among the cheapest operations a processor can perform, are used to combine secrets without costly modular arithmetic. The most intriguing ingredient is the Physical Unclonable Function, or PUF. A PUF exploits the microscopic, random manufacturing variations in a chip’s silicon to produce a device-specific fingerprint: challenge a PUF with an input and it returns an output that is effectively impossible to predict, copy, or duplicate, because no second chip shares the same physical imperfections. By anchoring authentication in hardware-level uniqueness, the protocol gains protection against physical attacks such as key extraction, since no long-term secret is ever stored in memory in a form an attacker could read out.

Security claims in cryptography are cheap; proofs are not. The authors subjected BAS-IoV to a battery of formal verification techniques that represent the current standard of rigor in protocol analysis. Using the Real-or-Random model, a well-established framework for proving the security of authenticated key exchange, they demonstrated that session keys established by the protocol are indistinguishable from random strings to any adversary, which means an eavesdropper who records an entire conversation learns nothing usable about the keys protecting it. They then turned to two automated formal verification tools, Tamarin and ProVerif, which symbolically explore every possible execution path of a protocol, including those involving a powerful attacker who controls the network, to search for hidden flaws. Both tools confirmed the protocol’s resilience against known attack classes, including impersonation, replay, man-in-the-middle, and privileged insider attacks. Formal verification of this kind matters because history is littered with vehicular authentication schemes that looked sound on paper and collapsed under careful cryptanalysis; indeed, the same research group previously published a cryptanalysis of existing IoV message communication protocols, giving them a practitioner’s skepticism toward unproven designs.

Proving security is only half the battle, because a protocol that is safe but slow would strangle a network that depends on millisecond-level message exchange. Vehicular safety applications, such as collision warnings and cooperative braking, require authentication overhead low enough that messages arrive while they are still relevant. To measure real-world performance, the team ran extensive simulations in NS-3, the widely used discrete-event network simulator, evaluating the protocol under large-scale deployments with high vehicle densities. The results showed high throughput, low End-to-End Delay, and a high Packet Delivery Ratio, the three metrics that together determine whether an authentication scheme can keep pace with live traffic rather than becoming the bottleneck it was meant to eliminate. The lightweight design choices, from elliptic curve arithmetic to XOR-based secret combination, translate directly into these favorable network-level numbers.

The implications reach well beyond academic cryptography. Smart cities are investing billions in connected infrastructure, from adaptive traffic lights to autonomous shuttle fleets, and every one of those systems inherits the security assumptions of the underlying vehicular network. A centralized authentication model that buckles under load, or that can be toppled by compromising a single server, is a poor foundation for safety-critical transportation. A distributed model anchored in a blockchain offers a different bargain: trust becomes a shared, auditable record rather than a promise from one institution, and the cost of that assurance is paid in cheap, hardware-accelerated operations rather than heavy computation. For automakers and infrastructure operators weighing how to secure fleets that will only grow, protocols of this kind sketch a plausible migration path from today’s fragmented, authority-bound systems toward something more resilient.

There are, of course, familiar caveats. Blockchain systems introduce their own questions about consensus overhead, ledger growth, and governance, and the study’s evaluation, while thorough in simulation, represents a model of radio conditions and vehicle mobility rather than a live deployment on crowded highways. The authors report that no datasets were generated or analyzed during the study, and the work received no specific external funding, with the analysis resting on simulation and formal proof rather than field trials. Real-world adoption would also require agreement among the many authorities, manufacturers, and regulators whose cooperation any cross-domain scheme implicitly demands, a coordination challenge that no protocol alone can solve.

Even with those qualifications, BAS-IoV is a compelling demonstration that the perceived trade-off between blockchain-grade security and vehicular-grade speed is not inevitable. By combining PUF-based hardware trust, elliptic curve efficiency, formally verified key agreement, and a multi-authority blockchain backbone, the researchers have assembled a design that addresses the two failure modes, centralization and computational cost, that have limited earlier generations of vehicular authentication. As the number of connected vehicles continues its steep climb, and as smart cities stake safety and efficiency on the integrity of wireless messages exchanged between machines, work of this kind moves from the margins of cryptographic literature toward the center of infrastructure engineering. The roads of the future will be governed less by asphalt and signage than by protocols, and studies like this one are writing the rules those protocols will follow.

Subject of Research: Blockchain-based cross-authority authentication and key agreement for secure, scalable Internet of Vehicles communications

Article Title: BAS-IoV: lightweight blockchain-based authentication for secure and scalable internet of vehicles

Article References: Ghadim, G. O., Rastegari, P., Dakhilalian, M., Hendessi, F., & Susilo, W. (2026). BAS-IoV: lightweight blockchain-based authentication for secure and scalable internet of vehicles. Cluster Computing, 29(14), Article 784. https://doi.org/10.1007/s10586-026-06595-8

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06595-8

Keywords: Internet of Vehicles, blockchain, authentication, cryptography, Physical Unclonable Functions, Elliptic Curve Cryptography, Trusted Authority, NS-3 simulation, formal verification, smart cities, vehicular networks, security protocols

The core difficulty with position verification is that ordinary distance measurements are fundamentally based on trust. Radar, GPS, and time-of-flight ranging all rely on the assumption that the device being located responds honestly and that the signals it returns are genuine. A spoofing attacker can exploit this by relaying messages, predicting challenge responses, or replaying recorded signals faster than physics should allow. Classical cryptography alone cannot close these loopholes, because any classical challenge-response scheme can, in principle, be simulated or forwarded by a sufficiently capable adversary. What the new work shows is that by encoding challenges in quantum states, specifically coherent states, the kind of light produced by ordinary lasers, and by enforcing the relativistic speed limit on information, a verifier can confirm a prover’s location with security guarantees that no classical protocol can match.

The protocol builds on a concept known as relativistic position verification, which has been discussed theoretically for more than a decade. The idea is elegant in its use of special relativity. A verifier sends a challenge signal to the claimed position of a prover, and the prover must respond within a strict time window determined by the speed of light. If the prover is genuinely at the claimed position, the round-trip timing works out precisely. If the prover is anywhere else, the finite speed of light makes it impossible to receive the challenge and return a correct response in time. The catch, historically, has been that a single relativistic check can be defeated by multiple colluding adversaries who surround the claimed position and share information, provided the challenge itself carries no quantum advantage. The new protocol confronts this collusion problem directly by making the challenge a quantum state that cannot be perfectly copied or measured without disturbance.

Coherent states occupy a special place in quantum optics. They are the closest quantum states to classical light, describing the output of an ideal laser, and they are famously robust: a beam splitter tapping a fraction of a coherent state leaves the remaining light in another coherent state, undisturbed. This resilience is precisely why coherent states are the workhorses of optical communication. But it also means they cannot be protected by the no-cloning theorem in the same dramatic way that single photons can. The researchers’ insight was to design a verification scheme in which the security does not depend on detecting eavesdropping through disturbance, but rather on the statistical structure of the coherent-state challenge combined with relativistic timing constraints. An attacker who tries to intercept, measure, and forward the challenge gains only limited information within the light-speed-bounded window, and that limitation translates into a quantifiable, provable bound on the probability of successful spoofing.

In the experimental demonstration, the team implemented the protocol using quantum optical equipment in a laboratory setting that emulated the geometry of a multi-verifier network. Verifiers at separated reference points prepared coherent-state challenges and sent them toward the claimed position of a prover. The prover, located at the intersection point defined by the overlapping signals, was required to perform a joint measurement on the arriving light and return a response that depended on the full quantum content of the challenges. The verifiers then checked both the correctness of the response and its arrival time against the relativistically mandated schedule. Only a prover genuinely at the claimed spacetime point, with access to the complete quantum information carried by the coherent pulses, could satisfy both conditions simultaneously with high probability.

The measurement statistics from the experiment confirmed the central theoretical prediction. Honest provers at the correct location passed the verification test with high probability, while simulated attacks, in which adversaries positioned away from the claimed point attempted to collaborate and cheat the timing and content checks, succeeded only with probabilities bounded well below the levels required to break the protocol. The experiment thereby elevated relativistic position verification from a theoretical proposal with idealized assumptions to a demonstrated capability built from realistic optical components. Because coherent states are exactly what standard telecommunications lasers produce, the result carries an unusually direct path toward practical deployment in fiber networks and free-space optical links.

The security implications extend across several domains of modern technology. In satellite navigation, position verification could harden global positioning systems against spoofing attacks, a threat that has been demonstrated against civilian GPS receivers and poses risks to aviation, maritime shipping, and autonomous vehicles. In distributed computing and blockchain systems, verifiable position could anchor the physical identity of nodes, preventing adversaries from masquerading as geographically distributed participants. In quantum networks, where future quantum internet nodes will exchange entanglement and secret keys over continental distances, confirming that a node is physically where it claims to be adds a layer of authentication that no certificate or cryptographic key alone can provide. The protocol essentially gives the physical layer of communication a cryptographic guarantee derived from the laws of nature rather than from computational assumptions.

What makes the achievement scientifically notable is the way it reconciles two apparently competing demands. Quantum protocols for position verification have often relied on fragile single-photon states or entanglement, which are difficult to distribute over long distances and easily degraded by loss. Relativistic schemes, conversely, have been robust in their signals but vulnerable to collusion attacks. By choosing coherent states, the experimenters selected the most loss-tolerant, telecom-compatible quantum states available, and then recovered security against collusion through a careful protocol design that exploits the interplay between the quantum statistics of the light and the strict causal structure imposed by relativity. The result is a scheme whose ingredients are mundane, laser light and precise clocks, but whose guarantees are anything but.

The work also contributes to a broader conceptual shift in quantum information science: the recognition that spacetime structure itself is a computational and cryptographic resource. Just as entanglement enables tasks impossible classically, the light cone structure of relativistic spacetime constrains what any attacker can know and when they can know it, and protocols that weave quantum states through this causal fabric inherit guarantees rooted in physics. Position verification is perhaps the most natural application of this principle, because position is defined by spacetime, but researchers have begun exploring related ideas in secure timing, delegated quantum computation, and verifiable quantum communication. The new demonstration provides an experimental anchor for this emerging field, showing that the theory can be reduced to working hardware.

Challenges remain before such systems secure real-world infrastructure. Laboratory demonstrations operate over short distances with controlled timing, whereas field deployment will demand picosecond-level clock synchronization across verifier stations, management of atmospheric and fiber-induced noise, and careful analysis of loss, which affects coherent states in ways that must be folded into the security proofs. Scaling the number of verifiers and the distance to the prover will require engineering advances in optical timing distribution and high-speed quantum-light detection. Yet the direction is clear. The experiment demonstrates that verifying where someone is, without trusting anything they say, can be achieved by combining the most ordinary light in the universe with the most fundamental speed limit in nature. In doing so, it turns a century of physics, from Einstein’s postulates to the quantum theory of light, into a practical answer to a deceptively simple question: can you prove where you are? The answer, it turns out, is yes, if your answer travels at the speed of light and carries the quiet statistical fingerprint of a coherent state.

Subject of Research: Relativistic position verification using coherent quantum states of light

Article Title: Relativistic position verification with coherent states

Article References: Fan-Yuan, G.-J., Shan, Y.-G., Zhang, C., Wang, Y.-L., Fan, Y.-X., Xie, W.-X., He, D.-Y., Wang, S., Yin, Z.-Q., Chen, W., Fu, S.-N., Guo, G.-C., & Han, Z.-F. (2026). Relativistic position verification with coherent states. Nature Physics. https://doi.org/10.1038/s41567-026-03439-5

Image Credits: AI Generated

DOI: 10.1038/s41567-026-03439-5

Keywords: position verification, coherent states, quantum optics, relativistic cryptography, spoofing attacks, speed of light, quantum communication, laser light, quantum networks, spacetime, time-of-flight, security protocols