Authors - Md Manirul Islam, Umme Salsabil, Md. Mushfiqur Rahman, Sazzad Hossain Abstract - This paper presents a compact identity-verification architecture for private web and Internet of Things (IoT) deployments that require tamper evidence without the operational overhead of a full blockchain. The framework separates credential verification from profile-integrity verification across multiple stores: a credential store, a protected-profile store, a reference integrity store, and a key store. Credentials are protected with Argon2id-based verifiers, while protected profile records are bound to entity identifiers, timestamps, and version counters through HMAC-SHA-256 reference tags. Unlike scan-heavy hash-only workflows, the proposed design performs direct indexed lookup by entity identifier and then verifies integrity through a keyed comparison step, improving both security posture and scalability. The same logic can be deployed behind HTTPSbased web services and MQTT-over-TLS IoT gateways. A reference prototype and benchmark study over datasets of 1,000 to 10,000 entities show that the indexed login path remains nearly size-stable, with median successful login latency around 1.68-1.69 ms under a development-profile Argon2id configuration, while a scan-based baseline login path grows from 0.92 ms to 6.90 ms over the same range. Injected profile tampering was detected in all benchmarked trials. The resulting framework offers a pragmatic middle path between conventional centralized login and heavyweight distributed-ledger authorization for institutions that prioritize local autonomy, compartmentalization, and data-integrity assurance.
Open Zoom