Two-Layer Blockchain Sharding Improves Connected Vehicle Authentication Efficiency and Scalability

Computer science researchers have developed a dual-layer sharded blockchain architecture paired with certificateless cryptography that substantially enhances cross-domain message authentication within the Internet of Vehicles. Autonomous vehicular networks rely on communications across multiple administrative trust domains to convey critical transit information such as real-time road conditions and dynamic navigation planning. However, because independent operational domains do not maintain mutual trust and time-sensitive vehicular messages face risks of interception and alteration, rapid verification becomes essential. Conventional authentication frameworks experience computational delays that multiply significantly as message traffic intensifies, precipitating a continuous decline in verification efficiency across domain boundaries. To address these operational constraints, an international research team designed an integrated framework combining hierarchical blockchain coordination with balanced graph partitioning to ensure scalable, low-latency trust management.

The structural vulnerability of standard connected vehicle deployments stems largely from the dual burdens placed on regional trust authorities. In established systems, each local authority must oversee internal vehicle registration, credential distribution, and roadside infrastructure while concurrently processing external authentication requests from neighboring administrative regions. When thousands of vehicles cross jurisdictional perimeters and request identity validation, regional trust nodes face severe throughput bottlenecks. Although decentralized blockchain ledgers offer tamper-resistant environments for exchanging cryptographic validation credentials, unpartitioned blockchains suffer from restricted transaction throughput and sluggish synchronization speeds. While horizontal sharding can scale blockchain throughput almost linearly with the addition of network segments, conventional random partitioning strategies frequently suffer from hot sharding, in which transactions concentrate excessively on specific nodes, undermining parallel processing across roads.

To mitigate these structural deficits, the investigators designed an architecture comprising two distinct entity tiers: a Trust Agent blockchain layer and a Multi-access Edge Computing blockchain layer, underpinned by physical roadside units and moving vehicles. The upper Trust Agent layer consists of administrative authorities from each participating trust domain who maintain a global ledger, govern key cryptographic parameters, execute periodic key updates through smart contracts, and orchestrate network sharding calculations. Below this administrative tier, regional edge computing servers manage clusters of physical roadside units that relay messages to and from traveling vehicles. These edge computing nodes form a dedicated secondary blockchain divided into coordinated shards, maintaining local authentication records including public parameters, regional keys, and active pseudonyms, thereby offloading high-volume verification duties from regional trust authorities.

To prevent the localized congestion that destabilizes traditional sharded networks, the researchers instituted an automated graph partitioning mechanism driven by the Metis partitioning algorithm. In connected transit networks, traffic density varies widely between congested arterial corridors and quiet rural connectors, creating an unequal distribution of authentication requests across roadside edge nodes. To balance these disparate workloads, each local authority constructs a vertex-weighted network topology using collected traffic volume records over defined evaluation windows. In this mathematical graph, edge computing servers serve as vertices weighted by observed traffic flow, while communication links serve as edges. The system converts this topological map into compressed sparse row formatting, allowing the Metis algorithm to divide the computing tier into balanced subgraphs where total vehicular traffic loads remain equitable across shards.

Cryptographic operations within the framework rely on certificateless public-key cryptography built on the computational hardness of the elliptic curve discrete logarithm problem. Traditional connected vehicle architectures generally deploy either public key infrastructure or identity-based cryptography, both of which introduce operational compromises. Public key infrastructure demands complex, bandwidth-heavy certificate management and revocation registries, whereas identity-based systems introduce key escrow vulnerabilities because a centralized authority possesses the private credentials of all participating vehicles. Certificateless cryptography eliminates both handicaps: a central authority generates only a partial private key derived from a registered vehicle pseudonym, while the vehicle independently produces a secret random value to establish its full private signing key, ensuring that no administrative authority can impersonate legitimate network participants.

Message generation and verification follow a coordinated six-stage operational workflow consisting of initialization, pseudonym allocation, partial key issuance, complete key creation, message signing, and signature verification. Vehicle anonymity is preserved through dynamic pseudonym rotation; local authorities verify initial registration credentials and pre-generate batches of unique pseudonyms linked to validity timestamps, preventing malicious observers from tracking vehicular trajectories across multiple broadcasts. To optimize vehicular computing efficiency, signing operations are divided into offline and online phases. A vehicle precomputes cryptographic scalar multiplications prior to transmission; upon generating a traffic message, it completes an online calculation incorporating a timestamp to prevent replay attacks, broadcasting the finalized signature alongside its temporary pseudonym.

At the verification stage, receiving edge computing servers validate incoming transmissions without incurring excessive processing delays. When receiving individual communications from adjacent trust domains, an edge server checks timestamp freshness and pseudonym validity windows before referencing the synchronized edge blockchain to verify signature parameters. For environments confronting dense cross-domain message influxes, the proposed architecture introduces a cross-domain batch verification protocol. In standard environments, checking signatures originating from disparate trust authorities forces verifiers to evaluate each message sequentially or organize rigid, high-overhead cross-domain groups. Under the proposed certificateless scheme, edge servers mathematically transform varied domain public key parameters into a unified master public key parameter, permitting simultaneous algebraic batch verification of incoming messages regardless of their administrative origin.

The authors validated their sharded architecture through experimental deployments using the Hyperledger Fabric platform hosted on enterprise server hardware equipped with an Intel Xeon Silver 4210 processor and 60 gigabytes of memory. Cryptographic verification benchmarks were executed on an Intel Core i5-10500 workstation utilizing the Miracl cryptography library, employing 256-bit prime modulus BN-P156 curves for bilinear pairing baselines and 160-bit SECG-K-160 curves for elliptic curve operations alongside SHA-256 hashing. To reflect realistic driving conditions, the experimental framework incorporated real-world vehicular traffic datasets gathered from urban roadways across three United Kingdom cities—Millfield, Derby, and Birmingham—during January 2021, dividing operational trust domains along urban municipal boundaries with three sharded partitions assigned to each domain.

Throughput assessments demonstrated substantial operational gains over unsharded multi-domain configurations where trust authorities serve as unified blockchain nodes. In simulated scenarios spanning two, four, and six administrative domains, the proposed sharded framework improved overall transaction throughput by 207.6 percent, 505.8 percent, and 843.5 percent respectively compared to baseline unsharded networks. While baseline throughput steadily degraded as additional domains increased inter-node consensus delays, the sharded edge architecture maintained linear throughput growth because cross-domain data synchronization occurred concurrently within autonomous shards without generating inter-shard transaction bottlenecks, fluctuating within a narrow operational margin of plus or minus 45 transactions per second around maximum capacity.

Load balancing evaluations confirmed that the Metis-driven partitioning technique substantially diminished workload variance across active shards compared to geographic and address-based sharding schemes. In comparative tests across the three regional traffic distribution scenarios, the proposed algorithm reduced shard workload variance by 74.5 percent and 62.2 percent in the first domain, 80.3 percent and 64.1 percent in the second domain, and 78.64 percent and 65.5 percent in the third domain relative to comparative models. By incorporating measured traffic density alongside physical node placement, the framework prevented high-density traffic nodes from clustering within a single partition, ensuring that computational demands remained evenly distributed across the entire decentralized processing pool.

Cryptographic evaluation indicated marked reductions in computational and communication overhead across message lifecycles. During initial pseudonym and partial key creation, the proposed certificateless protocol reduced computational costs by 14.3 percent relative to existing certificateless baselines by avoiding heavy bilinear pairings and modular exponentiations. In high-volume traffic evaluations, the batch verification technique demonstrated dramatic processing advantages: concurrent verification overhead decreased by 26.4 percent, 94.7 percent, and 67.3 percent compared to competing cross-domain authentication schemes. Furthermore, because verifiers confirm authenticity directly through shared blockchain data rather than executing interactive multi-party queries, total communication volume remained 51.5 percent lower than schemes reliant on centralized key generation facilities.

Security assessments confirmed that the integrated design preserves user anonymity, unforgeability, unlinkability, and traceability while resisting common network vulnerabilities such as replay and impersonation attacks. Because complete private keys are never exposed to central authorities or roadside relays, outside adversaries cannot forge valid message signatures within polynomial time under the elliptic curve discrete logarithm problem. If malicious behavior is detected, authorized domain authorities retain the cryptographic capability to reveal true vehicle identities from stored registration records. By harmonizing balanced edge sharding with efficient certificateless batch cryptography, the researchers have established a verified, scalable framework capable of securing high-density autonomous transportation networks.

Subject of Research: Dual-layer blockchain sharding and certificateless authentication for cross-domain Internet of Vehicles communications

Article Title: Low-overhead trust mechanism for efficient cross-domain authentication in internet of vehicles based on blockchain sharding

Article References: Zhao, W., Hinov, N., Akin, E., Ekinci, S., Abdelhaq, M., Choi, B. J., González López, H. A., Flórez Aristizábal, L., Neira-Rodado, D., Escorcia-Gutierrez, J., & Andriukaitis, D. (2026). Low-overhead trust mechanism for efficient cross-domain authentication in internet of vehicles based on blockchain sharding. Frontiers in Physics, 14, Article 1956228. https://doi.org/10.3389/fphy.2026.1956228

Image Credits: AI Generated

DOI: 10.3389/fphy.2026.1956228

Keywords: blockchain sharding, Internet of Vehicles, cross-domain authentication, certificateless cryptography, Metis algorithm, graph partitioning, load balancing, elliptic curve cryptography, batch verification, Multi-access Edge Computing, vehicle-to-everything, Hyperledger Fabric, computational overhead, transaction throughput, network security, traffic flow, digital signatures, anonymity