Decentralized Self-Verifiable Cryptographic Image Provenance in Social Internet of Things

Smart objects in the Social Internet of Things (SIoT), such as cameras, drones, and vehicles, exchange images that act as visual evidence and drive automated decisions. These images can be altered in their pixels or their metadata, replayed, or injected by unauthorized publishers. Central verification services can check them, but such services must be reachable at verification time, form a bottleneck, and observe who produced which image. This paper presents a decentralized scheme that makes an SIoT image object self-verifiable, so that an intermittently connected verifier can check it offline. Each object binds its image hash, its name, its provenance record, and its source identity in one signature, and it carries its own key documents and authorization chain. Trust anchors are Decentralized Identifiers computed as key thumbprints, so no registry, ledger, or certificate authority is queried during verification. Our central technical point is that a signed hash alone gives only name-bound replay prevention. We therefore add temporal layers that such schemes usually omit: a freshness mechanism with interactive, beacon, and transparency log variants; signed status lists with a proven bounded staleness revocation guarantee; and monotone epochs that resist rollback of rotated keys and documents. We prove the base goals by reduction to signature unforgeability and hash collision resistance under a Dolev–Yao adversary, and we prove the temporal properties as unbounded inductive invariants discharged in Z3. An Ed25519 and SHA-256 implementation verifies a typical image in under two milliseconds with about 1.6 kB of metadata. The evidentiary levels are stated separately and are not interchangeable. The base object is proven, implemented, and measured; the freshness, revocation, and rollback layers are proven but not measured; the pseudonymous mode is design-only. “Self-verifiable” means that provenance is checked cryptographically from the object and one anchor. It does not mean the scheme proves that the captured scene is real, and it is conditional on a preconfigured root identifier and, for the temporal layers, on a status list or time source.