Data in a blockchain is structured into blocks, which are linked to ensure immutability. Each data block consists of a blockhead and body, as shown in Fig. 4. The block header contains essential information, such as the block number, the accounting node, the QHF value of the current block, the QHF value of the previous block, and the block’s creation timestamp. The block body holds transaction records that quantum signatures have verified.

In literature [17], Ye et al. used classical hash functions and Merkle tree structures to construct and verify blocks, ensuring the integrity and security of transactions. However, the Merkle tree structure is vulnerable to quantum computing attacks. As quantum computing advances, the susceptibility of the traditional hash function-based Merkle tree structure to pre-image collision attacks becomes increasingly evident [42]. To enhance blockchain security and protect against quantum computing attacks, specifically second pre-image attacks by the Grover algorithm, we incorporate a quantum hash function within QBIoT.

Given the potential threat posed by quantum adversaries, QBIoT employs the quantum hash function to generate the QHF value for each block. These QHF values create interconnectivity among the blocks. In a transaction record, a third-party verifier can confirm the authenticity of the transaction content using the signer’s public key to verify the signature. Once enough transactions are collected, the leader node compiles them into a new block, initiates a vote, and broadcasts the valid block to other validator nodes in the blockchain network. The blockchain structure is depicted in Fig. 5.

In a typical blockchain system, a jointly elected accounting node assumes responsibility for proposing and generating new blocks. In QBIoT, this process is governed by the PoARE consensus mechanism, which will be comprehensively described in this section.

The consensus mechanism is the linchpin of blockchain technology, ensuring that all nodes within the blockchain network achieve consensus on data and transactions. It significantly influences crucial blockchain characteristics such as security, scalability, and decentralization. Popular consensus mechanisms in use today include Proof of Work (PoW), Proof of Stake (PoS), Delegated Proof of Stake (DPoS), Proof of Authority (PoA), Practical Byzantine Fault Tolerance (PBFT), and more. Selecting an appropriate consensus mechanism depends on a blockchain project’s specific goals and requirements. Table 2 compares mainstream consensus protocols based on eight key aspects.

The PoW [43] consensus mechanism, initially proposed by Dwork et al., is utilized in cryptocurrencies like Bitcoin and Ethereum. PoW involves the selection of an accounting node through mining, where miners compete to find a nonce value that satisfies a specific condition (i.e., the hash value of the nonce meeting certain criteria). PoW is susceptible to mining attacks [44], as the Grover quantum algorithm accelerates the search for the pre-image of the hash function. This means that if a competitor with a quantum computer joins the mining activity, he gains a substantial advantage, leading to quicker mining rewards and bookkeeping rights. Literature [44] indicated that a quantum adversary employing the enhanced Grover algorithm can successfully mine on the Bitcoin platform in just 2 s, whereas an ordinary classical computer miner would take 465 days. Consequently, the PoW consensus mechanism is considered unfair due to quantum computing advancements. Furthermore, the PoW mining process is highly energy-intensive, consuming significant power and computing resources, which makes it inefficient.

In the PoS consensus mechanism, stakers compete for bookkeeping rights by pledging their stake, which involves public key signatures. These signatures are vulnerable to key recovery attacks by Shor’s algorithm. As a result, a quantum adversary can use Shor’s algorithm to deduce the staker’s private key from the existing signature and public key, leading to the loss of assets. Furthermore, the PoS consensus mechanism lacks sufficient fairness and decentralization, as large stakeholders can exploit their stake’s advantage to obtain near-monopoly bookkeeping rights, which contradicts the original decentralization concept in blockchain design.

Similar to PoS, in the DPoS [45] consensus mechanism, asset staking transactions are susceptible to quantum computing attacks by Shor’s algorithm. Moreover, DPoS necessitates elections that rely on voting algorithms often employing classical public-key signatures [46], making them vulnerable to quantum computing attacks.

The PBFT [47] consensus mechanism is hindered by poor scalability [48], limiting the scale of the blockchain network. Once the number of nodes reaches a certain threshold, the efficiency of reaching consensus decreases significantly, rendering PBFT unsuitable for our consideration.

The PoA [49] consensus mechanism, proposed by Gavin Wood, the founder of Ethereum, in 2004, is currently implemented in projects like Aura and Clique blockchains. PoA relies on the reputation of a real identity as collateral. It follows a rigorous vetting process for regular nodes seeking authority node status. Once nodes pass the qualification audit, they become authority nodes and publish their identity information on the public network, ensuring their honesty and trustworthiness. Authority nodes possess the privilege to validate transactions, and during a consensus round, the validating nodes on the validating node list take turns serving as the leader node, each with an equal time allocation. This setup promotes fairness and impartiality.

For QBIoT, the selected consensus mechanism must offer relatively high transactions per second (TPS), scalability, low transaction costs, and equitable distribution of bookkeeping rights. Consequently, we adopt an enhanced PoA mechanism known as proof of authority with random election (PoARE).

QBIoT utilizes the PoARE consensus mechanism for electing the accounting node. PoARE is a more secure consensus mechanism based on improving the PoA consensus mechanism.

In PoA, new block creation depends on a set of authenticated, validator nodes chosen through a trustable mechanism. At the beginning of each consensus cycle, certain rules govern the election of a leader node from among the validator nodes. This leader node is granted the privilege to create a new block. The leader node produces a candidate block within its designated time frame and broadcasts it throughout the network. Validator nodes receive the candidate block, collectively verifying its validity through voting. If the candidate block garners more than half of the votes in approval, it is accepted by the blockchain system. Subsequently, all validator nodes append it to their blockchain ledger. Due to the controlled identity of the leader node, PoA ensures the proper generation of blocks, thereby upholding the stability and security of the blockchain system.

A PoA-based blockchain network comprises four node types: ordinary nodes, authority nodes, validator nodes, and leader nodes. Table 3 delineates the specific roles and permissions of these nodes.

PoARE inherits the security benefits of PoA grounded in identity management and introduces improvements in three key areas. (1) The identity of the leader node is concealed and confidentially shared among the validator nodes through the Quantum Secret Sharing Protocol (QSS) [50]. (2) PoARE introduces the leader node election algorithm based on the quantum random number generator (QRNG), making leader node election entirely randomized, more flexible, and efficient. (3) It implements a dynamic updating mechanism for the list of validator nodes, which limits the involvement of faulty or compromised nodes in bookkeeping, reducing their adverse impact on the blockchain system. This enhances the efficiency and robustness of the blockchain network. The comparison between PoA and PoARE is shown in Table 4.

Table 5 outlines the leader node election algorithm used in the PoARE consensus mechanism. At the start of each consensus cycle, the leader node (A_N) generates a random number (R_N), which is secretly shared using the QSS. The R_N is collaboratively generated by all candidate nodes seeking the leader node position supervised by all of them. Each candidate node submits a random number (R) using the quantum random number generator (QRNG) chip, and the R_N is the sum of all submitted random numbers. It is important to note that random numbers can only be proposed during the interval T_start-T_end after the vote for block B_N is closed; random numbers submitted beyond this period are disregarded. Subsequently, A_N calculates the competition value (VC) for each candidate node vying for the leader node role, where VC = Hash (R_N||T_N-2||T_N-1||ID), with “||” representing the character concatenation symbol. The candidate node with the highest VC value becomes the leader node for the next consensus. The incumbent leader node (A_N) shares the identity information of the subsequent leader node (A_N+1) among the validator nodes through the QSS protocol. Once A_N completes block voting, whether the block (B_N) is accepted into the blockchain or discarded, A_N proceeds to the leader node election process for the next consensus. An example of this algorithm is illustrated in Table 5.

In the following, we give an example to illustrate the leader node election process in PoARE-based QBIoT. The leader node election process can be divided into three phases according to the chronological order, which are (a) the random number submission phase, (b) the ballot processing phase, and (c) the leader node identity sharing phase.

In the random number submission phase, the leader node (A_N), who has completed the bookkeeping task in the previous term, initiates the new leader node election and sets a time period, T_start-T_end, for this phase, in which each leader node candidate (i.e., V_i, a member of the LVN that has not participated in bookkeeping) wishing to obtain the bookkeeping right, picks a random number, R_i, generated by the QRNG, and submits a sequence (ID, R_i, t, proof snapshotting of R_i) to the leader node (A_N) as a ballot for winning the next leader node role.

When the time reaches T_end, the process automatically enters the ballot processing phase, in which A_N generates the R_N for this consensus and calculates VC for all the ballots and sorts them alphabetically. In this phase, A_N stops receiving ballots from the candidate nodes, and checks all the received ballots, flags the invalid ballots, retains the valid ballots, and calculates the R_N, which is the sum of R_i of all the valid ballots. After the value of R_N has been calculated, A_N calculates the corresponding VC for each valid ballot. Then all the VCs are sorted alphabetically, and the proposer of the ballot with the largest VC is identified as the leader node (A_N+1) for the next consensus. A_N stores identity of the leader node (A_N+1), and would broadcast its ballot to all validator nodes in the forthcoming leader node identity sharing phase for verification. As shown in Table 6, after calculation, we can get the sum of R_i, Sum (R_i) = 14467.

After A_N+1 has been determined by the A_N, the identity of A_N+1 is shared secretly in the leader node identity sharing phase within all validator nodes. A_N shares the ballot with its VC attached to it containing the ID of the new leader node (A_N+1) with all the validator nodes through the QSS. At this point, all validator nodes have known the identity of the new leader node (A_N+1), and the system would enter into the (N + 1)th consensus, where A_N hands over the transaction queue with the unpacked transactions from the Nth consensus to the new leader node (A_N+1), who continues to collect transactions and performs the bookkeeping task.

After the new leader node (A_N+1) is elected, the system enters into the (N + 1)th consensus, then all the validator nodes start submitting new transactions to (A_N+1), and (A_N+1) starts to perform transaction collection and validation. The specific process of a transaction, including signing and verification, is described in detail the following Section 4.2.

Drawing inspiration from [51], we have devised a Public Key Quantum Signature (PKQS) protocol, employing single-qubit rotation to facilitate transaction verification within the QBIoT framework. The PKQS protocol leverages qubit rotation applied to quantum particles as an encryption operation. To illustrate, if we have an initial quantum state denoted as |ξ⟩, then the qubit rotation operation can be represented as R(θ)|ξ⟩=|ξ|′⟩, with R(θ)=cos⁡θ|0⟩⟨0|+sin⁡θ|0⟩⟨1|−sin⁡θ|1⟩⟨0|+cos⁡θ|1⟩⟨1|. It is straightforward to derive |ξ′⟩ from |ξ⟩ and θ by applying the qubit rotation operation R(θ) to |ξ⟩. However, deducing θ from |ξ⟩ and |ξ′⟩ is infeasible, as |ξ⟩ and |ξ′⟩ are two unknown quantum states. Accurate information about |ξ⟩ and |ξ′⟩ cannot be obtained by measuring them using the appropriate basis. Consequently, θ cannot be ascertained. Therefore, the qubit rotation parameter θ is a private key, while |ξ′⟩ functions as the corresponding public key.

For clarity, let us set the stage: Alice initiates (signs) a transaction, Bob is the transaction recipient, Tx represents the transaction message, and Trent, acting as the transaction verifier, is considered a trusted entity. To enhance security and fairness, we have incorporated the PoARE consensus mechanism, where the validator node takes on the role of Trent. Trent’s primary responsibilities include validating the signature and ensuring the message’s legitimacy. In a transaction, Alice commences by computing the QHF value (h) of the transaction message (Tx), encodes h into a quantum sequence (|h⟩), and proceeds to sign |h⟩, generating the signature. We assume the quantum sequence |h⟩ comprises n particles, denoted as ⊗i=1n|hi⟩, where |hi⟩=αi|0⟩+βi|1⟩,|αi|2+|βi|2=1. The signature protocol unfolds as follows:

Step 1: Alice and Bob jointly agree on the secret QHF parameter KAB, and Alice uses QHF with QHF(Tx,KAB)=h to encrypt the message Tx. Subsequently, Alice forwards h and her identity ID={ID1,ID2,…,IDn} to Trent, who generates a private key sk=H(ID⊕h) for Alice, where H is a mapping function with uniformly distributed output, and sk={sk1,sk2,…,skn}={θi}n,θ∈(0,2π].

Step 2: Alice encodes h into |H⟩=⊗i=1n|hi⟩ based on the encoding table presented in Table 7. She prepares four identical quantum sequences, denoted as |H1⟩=⊗i=1n|hi⟩, |H2⟩=⊗i=1n|hi⟩, |H3⟩=⊗i=1n|hi⟩, |H4⟩=⊗i=1n|hi⟩.

Step 3: Alice applies the qubit rotation operation R(ski)(i=1,2,…,n) to the particle |hi⟩ in |H1⟩, where R(ski)=cos⁡ski|0⟩⟨0|+sin⁡ski|0⟩⟨1|−sin⁡ski|1⟩⟨0|+cos⁡ski|1⟩⟨1|. This operation transforms the particle |hi⟩ into |hi′⟩. After the qubit rotation operation, |H1⟩=⊗i=1n|hi⟩ becomes |H1′⟩=⊗i=1n|hi′⟩.

Step 4: Alice sends |H2⟩ and |H1′⟩ to Trent. |H2⟩ is the quantum sequence that Alice will sign, while |H1′⟩ serves as Alice’s public key for the transaction Tx.

Step 5: Alice applies the qubit rotation operation R(ski)(i=1,2,…,n) to the particle |hi⟩ in |H3⟩, converting |H3⟩ into |H3′⟩.

Step 6: Alice prepares n Bell states, denoted as |ψi⟩=12(|00⟩+|11⟩),(i=1,2,…,n). |ψi⟩ consists of two quantum state particles, with one being |ai⟩, and the other being |bi⟩. Alice retains |ai⟩ and forwards |bi⟩ to Trent.

Step 7: Alice conducts n joint Bell measurements for |H3′⟩ and |ai⟩. In the ith joint Bell measurement, the two target particles to be measured are the ith particles of |H3′⟩, and |ai⟩, respectively. After the measurement, Alice obtains the measurement result R=(r1,r2,…,ri,…,rn),i∈{1,2,…,n}. The value of ri is {00,01,10,11} when the Bell states are |ψ+⟩=12(|00⟩+|11⟩),|ψ−⟩=12(|00⟩−|11⟩), |ϕ+⟩=12(|01⟩+|10⟩), and |ϕ−⟩=12(|01⟩−|10⟩), respectively.

Step 8: Alice retains (|H4⟩,R) as the signature pair and transmits them to Bob. Quantum sequence |H4⟩ represents the transaction message digest, and R is used as the signature for Tx.

Step 9: Upon receiving the signature pair (|H4⟩,R), Bob prepares a quantum sequence |H5⟩ by encoding h as per the encoding table (Table 7) in Step 2. He then compares |H5⟩ with |H4⟩. If |H5⟩ and |H4⟩ match, Bob forwards (|H4⟩,R) to Trent and proceeds to the next step. In case of any disparity between |H5⟩ and |H4⟩, the signature pair is deemed invalid, and Bob discards it, effectively terminating the protocol.

Step 10: Trent receives Bob’s signature pair (|H4⟩,R). Trent then performs unitary operation τ on the particle |bi⟩ based on the value of ri, as outlined in Table 8.

Step 11: After executing the unitary operations in Step 10, Trent employs the QSTC method [52] to compare the ith particle of |H1′⟩ with the particle |bi⟩. If |H1i′⟩=|bi⟩ for all i, values from 1 to n. Trent deems the signature valid and accepts the transaction Tx. Conversely, the signature is considered invalid and discarded if any discrepancies are found.

It is necessary to add that, during each transmission of a quantum sequence in the protocol, we will insert the decoy state particles into the original quantum sequence before transmission to form a hybrid quantum sequence, and after the transmission of the hybrid quantum sequence is completed, we will complete the eavesdropping detection by sender announcing the position of the decoy state particles, receiver selecting the suitable measurement basis for the measurement, and comparing the measurement results to make sure that there is no eavesdropping before recovering the original quantum sequence. The detailed process of transaction verification is visually represented in Fig. 6.

Before Alice sends a transaction to Bob, she encrypts the transaction information using a quantum hash function. Quantum hash functions are tailored for quantum computing environments, offering resilience against attacks like Grover’s algorithm. Attempting to find an original input matching a particular hash would demand exponentially more computational resources, making second pre-image attacks exceedingly difficult. Moreover, Alice creates a signature pair (|H4⟩,R), transmits it to Bob, and Trent verifies it. During transmission, even if an attacker intercepts the transaction information and the signature, they cannot easily decipher the signature or obtain transaction details. The security of this signature pair relies on quantum physics, rendering it impervious to effective quantum attacks. Trent verifies the received transaction information and ensures its integrity by comparing the corresponding QHF values. Any tampering with the transaction information would result in a hash value mismatch, exposing the alteration.

QBIoT demonstrates resilience against quantum computing attacks. Quantum cryptography is a part of quantum information science and is fundamentally secure, unlike classical cryptography [54]. Quantum mechanics principles such as the quantum no-cloning theorem [53] and the Heisenberg uncertainty principle [55] make it challenging for attackers to go unnoticed during an attack, enhancing the security of the QBIoT scheme. In summary, our proposed QBIoT scheme proves secure against quantum computing attacks.

Quantum adversaries, equipped with quantum computers, have the ability to intercept, store, measure, and manipulate quantum-state particles, presenting a significant security challenge to quantum blockchain networks. IBM’s recent development of a 1121-qubit quantum computer [56] has further enhanced the capabilities of these adversaries. Therefore, QBIoT can be utilized to assess the security implications of a quantum adversary attack. Due to the scarcity of quantum resources, we use the number of quantum public keys consumed by a single blockchain transaction to evaluate the efficiency of the transaction.

The Blockchain Trilemma [57], coined by Vitalik Buterin, founder of Ethereum, represents the trade-off between decentralization, security, and scalability. Often, enhancing one aspect entails sacrificing another. Mainstream blockchain systems like Bitcoin, Ethernet, and EOS have all compromised in the Blockchain Trilemma. Bitcoin prioritizes decentralization and security at the expense of efficiency. Ethernet 2.0 adopts PoS for efficiency but faces performance issues and high transaction fees. EOS utilizes DPoS for scalability but sacrifices decentralization due to few nodes.

However, in the case of QBIoT, our solution introduces more nodes into the validation and consensus process through the PoARE consensus mechanism, maintaining decentralization while improving performance. PoARE optimizes block generation efficiency and transaction validation, reducing the complexity of the consensus algorithm and thus enhancing scalability. Furthermore, using quantum cryptography and communication techniques, such as QKD, QDS, QHF, QSS, etc., ensures QBIoT’s resistance to quantum computing attacks, bolstering IoT data security. Additionally, our solution resists quantum computing attacks, enhancing blockchain security. QBIoT strikes a nearly perfect balance between decentralization, security, and scalability, thus representing a significant advancement in this context.

Specifically, compared with literatures 14 and 46, our proposed quantum blockchain scheme exhibits superior efficiency and scalability.

As for the quantum-secured blockchain proposed by Kiktenko et al. [14], the validation of a single transaction requires all the other (n−1) nodes’ verification, therefore, (n−1) copies of quantum keys would be prepared by the transaction initiator for a single transaction. While in the quantum blockchain proposed by Li et al. [46], the verification of a single transaction requires the signer to prepare n (n−1) copies of quantum public keys in total. When it comes to QBIoT, the signature of a single transaction consumes 5 copies of quantum public keys only, which is rather resource-efficient. As shown in Fig. 7, in the schemes of literature [14,46], with the increase of the number of nodes, the number of quantum keys to be consumed to complete a single transaction increases rapidly, which will reduce the operational efficiency of the system and limit the scalability of the blockchain network. In our scheme, on the other hand, the number of quantum public keys consumed by a single transaction is constant, and thus our scheme is more quantum resource-efficient and thus achieved better scalability and practicality.

For a blockchain network, resistance to cyberspace attacks is an essential indicator of its robustness. A PoA-based blockchain is rather fragile to centralized attacks when the adversaries know who is the real leader node. Because all the cyberspace attacks would be accurately implemented on the publicly available leader node. While in QBIoT, it is quite different. As QBIoT adopts the PoARE consensus algorithm that conceals the leader node’s identity, attacker could not distinguish the real leader node from other validator nodes, so the attacks intended for the leader node are implemented on all validator nodes evenly. As the number of authentication nodes increases, the advantage of PoARE over PoA in resisting attacks on the bookkeeping node becomes more and more significant. This is because when the number of attacks is certain (e.g., A), the leader node suffers A attacks in a general blockchain network employing PoA; whereas, in QBIoT employing PoARE, the real leader node will only suffer A/N attacks on average, since the identity of the leader node is inaccessible to the adversary. Fig. 8 shows the trend of the number of attacks with the number of validator nodes for conventional PoA-based blockchain system and PoARE-based QBIoT.

As shown in Table 9, a comprehensive comparison between our work and other quantum blockchain schemes is made from 4 aspects, demonstrating the comprehensive security of QBIoT.

Our QBIoT scheme is designed to employ quantum hash functions, ensuring resistance to quantum computing attacks for transaction records. It uses a quantum public key signature algorithm for transaction integrity and authenticity. The PoARE consensus mechanism brings notable scalability, transaction efficiency, and security advantages. In summary, our proposed scheme excels in security and efficiency.

By encompassing these aspects, QBIoT presents a comprehensive security framework and improved performance, distinguishing itself as a robust solution for blockchain implementation.