A Blockchain-Enabled Cybersecurity Framework for IoT-Driven Smart Campuses: Toward Decentralized Authentication and Access Governance

This paper put forward a blockchain-based cybersecurity framework for IoT-enabled educational institutions, centered on decentralized device authentication and smart-contract-driven access control. The motivation stems from the growing use of IoT across smart campuses and the security challenges that accompany it — device identity, unauthorized access, data integrity, privacy, and auditability. The proposed architecture spans five layers: IoT devices, edge/gateway infrastructure, a permissioned blockchain, smart contracts, and institutional applications. Blockchain is applied chiefly to device identities, access policies, security metadata, hashes, and audit records, while sensitive or high-volume data stays off-chain. Research objectives, questions, and hypotheses were laid out to guide empirical evaluation, alongside a comparative experimental design pitting the blockchain-based architecture against a conventional centralized security model. The most significant contribution of this work lies in examining the trade-off between security and performance. Blockchain may enhance decentralization, traceability, and auditability, but these advantages can come at the cost of added latency, processing demands, and storage requirements. The suitability of blockchain for educational IoT should therefore be demonstrated through experimentation rather than assumed outright. Ultimately, this research suggests that blockchain shows the most promise when deployed as a hybrid security and trust layer, rather than as a standalone cybersecurity solution. Pairing permissioned blockchain with edge computing, conventional security tools, cryptographic device identity, smart contracts, and off-chain storage may offer a practical foundation for securing IoT-enabled smart campuses.

[1] T. M. Fernández-Caramés and P. Fraga-Lamas, "Towards Next Generation Teaching, Learning, and Context-Aware Applications for Higher Education: A Review on Blockchain, IoT, Fog and Edge Computing Enabled Smart Campuses and Universities," Applied Sciences, vol. 9, no. 21, Art. no. 4479, 2019. [2] M. Fagan, K. N. Megas, K. Scarfone, and M. Smith, IoT Device Cybersecurity Capability Core Baseline, NISTIR 8259A, National Institute of Standards and Technology, 2020. [3] M. Fagan, K. N. Megas, J. Marron, K. G. Brady, B. B. Cuthill, R. Herold, D. Lemire, and N. Hoehn, IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements, NIST SP 800-213, 2021. [4] K. N. Megas et al., IoT Device Cybersecurity Guidance for the Federal Government: IoT Device Cybersecurity Requirement Catalog, NIST SP 800-213A, National Institute of Standards and Technology, 2021. [5] Y. Zhang, S. Kasahara, Y. Shen, X. Jiang, and J. Wan, "Smart Contract-Based Access Control for the Internet of Things," 2018. [6] "Blockchain-Based Access Control and Behavior Regulation System for IoT," Sensors, vol. 22, no. 21, 2022. [7] "Blockchain-Enhanced Smart Contracts for Formal Verification of IoT Access Control Mechanisms," Alexandria Engineering Journal, 2025. [8] T. Domínguez-Bolaño, V. Barral, C. J. Escudero, and J. A. García-Naya, "An IoT System for a Smart Campus: Challenges and Solutions Illustrated Over Several Real-World Use Cases," 2024. [9] M. Alkhammash, "A Blockchain and IoT Based Framework for Decentralised Smart Campus Environment," University of Sussex, 2023. [10] M. Alkhammash, M. Alshahrani, N. Beloff, and M. White, "Revolutionising the Approach to Smart Campus Architecture Through IoT and Blockchain Technologies," 2022. [11] F. Kurniawan, D. P. Putra, J. Hammad, and A. S. Prabuwono, "A Blockchain-Secure Mobility Data in Smart Campus," International Journal of Interactive Mobile Technologies, vol. 17, no. 18, 2023. [12] A. Srhir, T. Mazri, and M. Benbrahim, "Towards Secure Smart Campus: Security Requirements, Attacks and Counter Measures," Indonesian Journal of Electrical Engineering and Computer Science, vol. 32, no. 2.