Network Resource Allocation Method based on Blockchain and Federated Learning in IoT

I. INTRODUCTION

IN the Internet of things (IoT), terminal devices can form networks through self-organization, thus achieving interconnectivity and communication. Today, IoT can be applied in many fields, such as healthcare, retail, industry, transportation, utility, and communication [1]. By 2030, the number of IoT devices in the world will reach 29.4 billion [2], which will be large scale IoTs. With the increase of the number of devices, the application data generated will also increase exponentially [3]. However, the larger scale the IoT, the greater pressure the data communication and resource requirement at terminals [4]. Unfortunately, terminal devices, such as smart sensors, smartphones, and other intelligent electronic devices [5]–[7], often have limited network resources, which poses a huge challenge to IoT’s network resource allocation. Moreover, most existing network resource allocation methods are fixed and insufficient to support diverse application requirements. Therefore, how to improve the resource utilization of terminals while meeting diverse application requirements is a key problem in IoT’s network resource allocation. Virtual network embedding (VNE) is an effective way to solve this problem [8]. Under the constraints of resource and QoS requirements, VNE can abstract different IoT application requirements into virtual networks (VNs), and then map them to the physical network (PN) according to network resources. This approach can eliminate the resource allocation limitations of the underlying physical network, solving the problems of limited terminal resources and diverse application requirements [9]. So, in this paper, we also use VNE to realize the network resource allocation for diverse IoT application requirements.

Existing VNE resource allocation methods are all centralized methods. That’s to say, network resource information and IoT application requirements are uploaded to the central server, and then the central server makes resource allocation decisions, such as heuristics algorithm [10], ant colony system (ACS) [11], Q-learning [12], reinforcement learning (RL) [13], deep reinforcement learning (DRL) [14], Graph convolutional networks (GCN) [15], etc. These centralized methods [10]–[15] are suitable for small networks with a small number of terminals and simple topology. For large-scale IoT networks, these centralized methods [10]–[15] will lead to high communication and computing costs for the system. That’s to say, the large-scale IoT VNE problem needs a distributed approach to solve. Distributed federated learning (FL) can be used to solve this problem. So, in this paper, we propose a distributed resource allocation method based on federated learning (DRAM-FL) to reduce the computing and communication cost, simplify the network complexity, and improve the network resource utilization.

Since IoT terminals are mostly low-cost devices with poor reliability, it is essential to consider the reliability of IoT terminals when using DRAM-FL, and avoid information security issues such as data tampering and malicious node attacks. In this regard, blockchain can establish reliable information interaction between untrusted nodes, and solve the information security problem in distributed system [16]. Therefore, we introduce blockchain into DRAM-FL and propose a distributed resource allocation method based on blockchain and federated learning (DRAM-BFL) to improve information security. As far as we know, it is the first attempt to combine blockchain and FL with VNE to solve the resource allocation problem in IoT.

The main contributions of this paper are as follows:

1) A DRAM-BFL is proposed. Firstly, we transform the resource allocation problem into a VNE problem, and proposes a DRAM-FL to solve it. This method enables local networks to collect information, learn the dynamics of the network and make optimal VNE decisions through their respective local training nodes. It can improve VN acceptance rate and long-term average revenue-toexpenditure ratio, reduce the complexity of IoT network topology, and reduce the computational and communication costs.

2) We introduce blockchain into DRAM-FL and propose DRAM-BFL. A blockchain structure with dual chains is designed, which contains topology chain and model chain. The topology chain is used for secure sharing of network topology information, and the model chain is used for secure sharing of model information in FL. The dual chains can realize protection and access control of on-chain data, reduce the hidden risk of data leakage, and realize decentralized FL.

3) In DRAM-BFL, a node reliability assessment method is proposed and the reliability of physical nodes is measured through evaluating their performance. During the node mapping stage, VNE decisions can be made based on the results of node reliability assessment, this can effectively avoid attacks from malicious nodes.

4) In order to further improve the security of DRAMBFL, we design the enhanced practical Byzantine fault tolerant consensus algorithm based on node reliability assessment (EPBFT-NRA). And the consensus nodes are dynamically updated to ensure the fairness of nodes and improve the security of consensus process.

II. RELATED WORK

A. Virtual Network Embedding (VNE) Algorithms

The VNE problem has been proven to be NP-hard [17], so most of the traditional VNE methods are heuristics algorithms [18]–[21] that rely on manual rules to make embedding decisions. Initially, these heuristics algorithms were used in single-domain scenarios. However, with the diverse application of the IoT, such as medical services, retail, industry, transportation, etc., there may be multiple network service requirements for the same physical network. Each requirement has different transmission performance requirements. So, researchers began to study multi-domain heuristic algorithms [22]. These multidomain heuristic algorithms are centralized methods and make decisions by a third party [23]. Furthermore, heuristic algorithms need follow fixed rules to get embedding decisions. They cannot adaptive optimize according to the changes of the physical network, they can easily fall into local optimum and often get suboptimal solutions.

B. Machine Learning based Virtual Network Embedding Algorithms

Large-scale IoT network and fragmented resources bring great challenges to the traditional VNE algorithms. Many researchers turn their attention to the machine learning (ML) methods. Unlike heuristic algorithms, ML can effectively avoid falling into local optimization. For example, [24] models the problem of resource allocation under DDOS as Bayesian Q learning game, and a greedy Q learning algorithm is proposed to solve it. [25] combines deep Q-network and Monte Carlo method to achieve fast convergence of VNE decision. [26] combines Monte Carlo tree searching and RL neural network to solve the VNE problem. [27] uses RL to solve VNE problem and abstracts node mapping into the Markov decision-making process (MDP), which requires large computing costs and has low time efficiency. In [28], RL is used in VNE, where policy gradients are used to train policy networks. In [29], RL and policy networks are used in the node mapping phase, and bandwidth resource sequencing is used in link mapping phase. With the objective of maximizing the number of embedded VNs, DRL is applied to VNE in [30], which combines deep learning (DL) and RL to enhance the success rate. In [31], a VNE algorithm based on RL security perception is proposed. In [32], a multi-stage VNE prediction model based on RL is proposed for cloud data centers to determine suitable physical resources and optimize the resource utilization.

In summary, all these heuristic algorithms [18]–[23] and ML algorithms [24]–[32] are all centralized algorithms. The local training data needs to be uploaded to a central server to make resource allocation decisions, resulting in large computing costs and communication costs in large-scale IoT. Therefore, in this paper, we adopt distributed FL, which is different from traditional centralized training methods. FL can reduce the network topology complexity in IoT, greatly minimize communication and computing costs while improving the scalability of VNE.

C. Security-aware Virtual Network Embedding Algorithms

Considering the complex network environment of IoT, the security of the VNE process is also crucial. Distributed FL algorithms face security challenges such as malicious node attacks and data tampering. Some approaches are proposed to address the security of VNE. For example, [32] establishes security levels for VNs, but does not consider the security of physical nodes and the underlying physical network. References [30] and [33] incorporate constraints on reputation or security level of physical nodes into the node importance ranking process. All the methods in [30], [32], [33] are designed for centralized VNE algorithms and rely on manually formulated node reliability assessment, which may not accurately reflect the actual network node situation and cannot ensure the security of VNE decisions.

As a result, some researchers begin to study improvements or new solutions to solve the security problems of today’s IoT. Blockchain technology is a relatively new solution. Some researches integrate block chain into the frame of FL in IoT scenarios, build trust between devices, realize privacy preserving and model sharing in FL, effectively prevent the FL single point failure and malicious attacks. For example, [34] jointly considers channel assignment, block size adjustment and block producer selection to reduce the energy consumption and improve the security of FL. [35] proposes an IoT resource management framework combining blockchain and FL, which uses support vector machine (SVM) classifier to improve the accuracy of detecting malicious nodes. [36] addresses the privacy risks of gradient inversion attacks by building a self-aggregating privacy-protecting FL model at the top of the blockchain. [37] proposes a Byzantine robust federated learning framework to realize privacy preserving. However, all the studies in [34]–[37] focus on the effective and secure resource management of FL, uses blockchain to realize privacy preserving, model sharing or preventing malicious attacks in FL. All the studies in [34]–[37] did not consider how to effectively utilize IoT’s network resources to meet different application requirements, not only the FL resource requirement. VNE model is an effective means to realize IoT resource management to meet different application requirements. So, in this paper, we first propose a VNE model in IoT, and then use FL and blockchain to improve the efficiency and safety of VNE, the proposed VNE model can meet more application needs, including FL.

At present, there is a lack of researches on the security of distributed VNE algorithms. Therefore, in this paper, we intend to incorporate blockchain into distributed VNE resource allocation and propose a dual-chain structure (topology chain and model chain) to improve the security of the VNE process. Simulation results also show that the proposed DRAM-BFL can achieve more secure and efficient IoT resource allocation when compared with the traditional VNE method.

In addition, the symbols and variables mentioned in the paper are given in Table 1.

III. SYSTEM MODEL FOR NETWORK RESOURCE ALLOCATION

A. VNE Model and VNE Problem

For the convenience of analysis, we divide IoT nodes into two types: Base stations (BSs) and general devices. BSs are the nodes that usually have high computing power, large storage space, and fixed location. General devices are terminal devices that usually have low computing power, small storage space, and mobile location. When a virtual network (VN) application requirement arrives, IoT needs to adopt appropriate resource allocation method based on the current network status to meet the application requirement of VN. Once the VN requirement is successfully embedded (mapped), the resources within IoT will be consumed until the end of VN application. In this context, we define the underlying physical network as PNs, refer to application requirements as VNs. As a result, we can transform the network resource allocation problem into a multi-domain VNE problem.

1) Physical network: The physical network is represented as an undirected weighted graph: [TeX:] $$G^S=\left({ Node }^S, { Link }^S, { Path }^S, { Func }^S\right) .$$ There are Q physical nodes in the physical network, and these physical nodes are recorded as [TeX:] $$n_1^S, \cdots, n_Q^S .$$ [TeX:] $${ Node }^S$$ represents the set of all physical nodes in the physical network, [TeX:] $$Node^S=\left\{n_1^S, \cdots, n_Q^S\right\}.$$ The physical link from [TeX:] $$n_i^S \text{ to } n_i^S$$ is denoted as [TeX:] $$l_{i j}^S,$$ the set of all physical links is [TeX:] $$\operatorname{Link}^S=\left\{l_{i j}^S, i, j \in\{1,2, \cdots, Q\}, i \neq j\right\} .$$ [TeX:] $${Path}^S$$ represents the set of all physical paths in this physical network. A physical path contains one or more physical links, the latter situation belongs to path splitting. In the VNE, the resource attributes of the physical node [TeX:] $$n_i^S$$ include CPU resources [TeX:] $$C P U\left(n_i^S\right)$$ and node reliability assessment [TeX:] $$N E S\left(n_i^S\right).$$ The resource attribute of the physical link [TeX:] $$l_{i j}^S$$ is the available bandwidth resource [TeX:] $$B w\left(l_{i j}^S\right).$$ [TeX:] $${ Func }^S$$ epresents the set of functional attributes for the physical network, which includes node location [TeX:] $${Loc}\left(n_i^S\right)$$ of all physical nodes.

2) Virtual network: Each application requirement is defined as a VN. Then VNE is used to allocate network resources. A virtual network is described as an undirected weighted graph: [TeX:] $$G^V=\left({ Node }^V,{ Link }^V,{ Func }^V\right) .$$ There are R virtual nodes in the virtual network denoted as [TeX:] $$n_1^V, \ldots, n_R^V.$$ [TeX:] $${Node}^V$$ is the set of all virtual nodes, that is [TeX:] $${Node}^V=\left\{n_1^V, \cdots, n_R^V\right\}.$$ The virtual link from [TeX:] $$n_l^V \text { to } n_k^V$$ is denoted as [TeX:] $$l_{l k}^V.$$ [TeX:] $${Link}^V$$ represents the set of all virtual links in the virtual network, that is [TeX:] $${Link}^V=\left\{l_{l k}^V, l, k \in\{1,2, \cdots, R\}, l \neq k\right\}.$$ In the VNE, the resource attribute of a virtual node [TeX:] $$n_l^V$$ is the node CPU resource [TeX:] $$C P U\left(n_l^V\right) .$$ The resource attribute of the virtual link [TeX:] $$l_{lk}^V$$ is available bandwidth [TeX:] $$B w\left(l_{l k}^V\right) .$$ [TeX:] $${Func}^V$$ represents the set of functional attributes for the virtual network, which includes node location [TeX:] $${Loc}\left(n_l^V\right)$$ and maximum location deviation [TeX:] $${MaxLocDev}\left(n_l^V\right)$$ of all virtual nodes.

3) Multi-domain VNE model: Fig. 1 shows the multidomain VNE model in IoT, the process of VNE can be represented as [TeX:] $$G^V \rightarrow G^S .$$ As shown in Fig. 1, a virtual node can only be mapped to one physical node, different virtual nodes of the same VN must be mapped to different physical nodes, virtual nodes of different VNs can be mapped to the same physical node. Furthermore, a virtual link can be mapped into a physical path, which contains one or more physical links.

B. VNE Evaluation Index

1) VN acceptance rate: VN acceptance rate, also known as VN success rate, is one of the important indexes to evaluate the performance of VNE algorithms. VN acceptance rate means the ratio of the number of VNs successful embedding to the total number of VNs in the time T.

where [TeX:] $${ Accepted }_{V N}^T$$ indicates the number of VNs successfully accepted by the physical network from time 0 to T. [TeX:] $${ Total }_{V N}^T$$ indicates the total number of VNs received by the physical network from time 0 to T. The VN acceptance rate reflects resource utilization, and the higher the VN acceptance rate, the more the resources utilization of the physical network.

2) Long-term average revenue: The revenue of embedding [TeX:] $$G^V$$ means the revenue obtained by the underlying physical network through renting out resources after [TeX:] $$G^V$$ is successfully embedded. It is calculated as follows.

where [TeX:] $$C P U\left(n_l^V\right)$$ represents the computing resource demand of the virtual node [TeX:] $$n_l^V,$$ [TeX:] $$BW\left(l_{lk}^V\right)$$ represents the bandwidth resource demand of the virtual link [TeX:] $$l_{l k}^V.$$ Their revenue weights are determined by the network service provider, and are uniformly set to 1 in this paper to simplify analysis.

That’s to say, the revenue of underlying physical network for embedding [TeX:] $$G^V$$ is determined by the sum of the CPU resources consumed and the bandwidth resources consumed of embedding [TeX:] $$G^V$$ during the given duration time t.

Then, the long-term average revenue can be defined as:

[TeX:] $$R\left(G^V\right)$$ measures the average value of the revenue obtained by the underlying physical network in time T, which represents the ability of the network service provider to obtain revenue.

3) Long-term average revenue-to-expenditure ratio: The long-term revenue-to-expenditure ratio reflects the utilization of underlying resources. If the ratio is high, it indicates that the utilization rate of the underlying resources is high and the number of VNs successfully accepted is large.

The long-term expenditure is defined as

where [TeX:] $$C P U\left(n_l^V\right)$$ represents the amount of physical node computing resource occupied by the virtual node [TeX:] $$n_l^V,$$ [TeX:] $$B W\left(l_{l k}^V\right)$$ represents the amount of physical path bandwidth resource occupied by the virtual link [TeX:] $$l_{l k}^V$$

In the link embedding in (4), a virtual link [TeX:] $$l_{l k}^V$$ is mapped into a physical path [TeX:] $$p_{i j}^S,$$ which consists of one or more physical links. [TeX:] $${Num}(p_{i j}^S)$$ denotes the number of physical links on the physical path [TeX:] $$p_{i j}^S.$$

The long-term average expenditure is calculated as

Therefore, the long-term average revenue-to-expenditure ratio of VNE is defined as

RC measures the ratio of the average revenue and the average resource consumed expenditure of the physical network for embedding [TeX:] $$G^V$$ during time T. RC is an index used to measure the resource utilization efficiency of the underlying physical network. The higher the RC, the higher the resource utilization efficiency of the network.

IV. DISTRIBUTED RESOURCE ALLOCATION METHOD BASED ON FEDERATED LEARNING (DRAM-FL)

A. Network Resource Allocation Problem

The goal of the network resource allocation is to find optimal mapping decision [TeX:] $$F\left(n_l^V \rightarrow n_i^S, L_{l k}^V \rightarrow P_{i j}^S\right)$$ (i.e.,embedding decision) to maximize the sum of VN acceptance rate and revenue-to-expenditure ratio under the constraints of resources, function and reliability. Therefore, the network resource allocation problem can be described as the VNE optimization problem P1.

Specifically, VNs cannot be indefinitely mapped to the physical network due to the limited resources. Conditions C1 and C2 are resource constraints, which ensure that the available resources of the underlying network nodes and links meet the resource requirements of the virtual nodes and virtual links. C3 means the range of VNE cannot exceed the maximum position deviation, it is a functional constraint to avoid longdistance transmission. C4 means that a virtual node of the same VN can only be mapped in one physical node, where the set of malicious physical nodes FN is excluded. C5 indicates that a virtual link can be mapped into one or more physical links, the latter case refers to path splitting.

B. System Model of DRAM-FL

As shown in Fig. 2, we integrate FL into VNE problem, and propose the DRAM-FL to solve the VNE problem. We divide IoT into multiple local networks based to geographical location, select a capable node as the local training node in each local network for FL. The local training node collect real-time topology information, such as physical location, CPU resources, link strength, node connectivity, and node reliability assessment, etc.

C. Workflow of DRAM-FL

Assume IoT network is divided into I local networks, which are denoted as [TeX:] $$G_1^S, \cdots, G_i^S, \cdots, G_I^S$$ respectively, and the dataset size of local network [TeX:] $$G_i^S$$ is denoted as [TeX:] $$D_i.$$ When the local training node receives the VN request, it downloads the pre-trained model and starts online learning. The local training node takes the collected local network topology information as the model input and makes VNE decisions as the model output. Local training nodes perform mixed pattern training, that is to say, each local training node will wait for the completion of other training nodes. However, this algorithm has a timeout setting, if it times out, it discards incomplete training node.

For the local training model of VNE, we refer to the neural network model in [38]. Its input is the feature matrix composed of CPU, bandwidth, and node reliability assessment value. The neural network model structure can be divided into four layers:

1) Input layer: It is used to input the feature matrix that contains local network topology information.

2) Convolution layer: It evaluates the resource characteristics of each feature vector in the feature matrix by convolution operation on the extracted feature matrix, and obtains the residual resource vector of each node.

3) Probability layer: The softmax function is used to normalize the gradient logarithm of the discrete probability distribution of the residual resource vector to obtain the corresponding embedding probability of each physical node.

4) Filter layer: It filters out physical nodes with insufficient resources and low reliability, and outputs a set of possible embedding physical nodes for each virtual node and their corresponding embedding probabilities.

The workflow of DRAM-FL is described in Algorithm 1.

In DRAM-FL, FedAvg is used for global model aggregation, its objective function is

But FedAvg here uses a different local training node selection method when compared to traditional methods. According to [39], we choose the node probability selection scheme, so that the central server can dynamically adjust the probability of each node being selected in each round of aggregation according to the most aggregation results, and accelerate the convergence of the model. We need to check the inner product of local gradient and global gradient for all local training nodes to ensure model convergence. If [TeX:] $$\left\langle\nabla F\left(\omega_t\right), \nabla F_i\left(\omega_t\right)\right\rangle\lt 0,$$ the convergence speed of the global model will slow down. Therefore, in this paper, we exclude local training nodes that are not conducive to global update, and the remaining set of local training nodes participating in global update is [TeX:] $$S_t.$$

V. DISTRIBUTED RESOURCE ALLOCATION METHOD BASED ON BLOCKCHAIN AND FEDERATED LEARNING (DRAM-BFL)

Since IoT terminals have poor reliability, it is essential to consider the reliability of IoT terminals when using DRAM-FL. In order to promote the security sharing of network information between nodes, and prevent data tampering and malicious node attacking, we introduce blockchain into DRAM-FL, and propose DRAM-BFL. Additionally, we design a node reliability assessment method to mitigate the risk of malicious node attacking.

A. System Model and Problem Description of DRAM-BFL

In Fig. 3, DRAM-BFL contains a local training layer and a central consensus layer. The local training layer is consistent with the model in Fig. 2. In the central consensus layer, the consensus nodes are selected through the node reliability assessment method (Section V.D). We choose the top n BSs with the highest node reliability as the central consensus layer. This layer implements a distributed blockchain, where consensus nodes can trade and securely share model information and network topology information with other nodes. The central consensus layer verifies the training results of each local training node by collecting the topology information and local model parameters.

Through introducing blockchain, problem is changed into problem P2 with adding security constraint C6. Detailed analysis of (17) is given in Section V.C.

B. Workflow of DRAM-BFL

The workflow of DRAM-BFL is shown in Fig. 4. Based on the node assessment method described in Section V.D, we select a base station with high reliability as the local training node to ensure the security of FL. we adopt the Parameter Server architecture and the FL with asynchronous pattern. The detailed descriptions of Fig. 4 are as follows:

<1> Explore environment. Each local training node explores the environment of its own local network and obtains its topology information separately.

<2> Upload information. The topology information obtained by the local training node is uploaded to the central consensus layer.

<3> Chain up. In the central consensus layer, the topology information is packaged into blocks and uploaded to the topology chain.

<4> Local training. When the local training node receives the VN requirements, it downloads the pre-trained model and starts online training, and feeds the training results (local model) back to the central consensus layer.

<5> Verify. The local training node upload trained local model to the central consensus layer. After receiving the local model, the central consensus layer first obtains the topology information from the topology chain to verify the local model, and then adds the verification results to the topology chain. The validation results are also used as part of the node reliability assessment.

<6> Model aggregation. The global model is obtained through the aggregation of local training models.

<7> Chain up. The global model is packaged into blocks and uploaded to the model chain.

<8> Model update. Each local training node obtains the latest global model from the model chain, then it starts a new round of training for its own local model.

C. Dual Chain Structure

We introduce blockchain into VNE, design a dual chain structure that contains topology chain and the model chain.

1) Topology chain: The topology chain is a public chain that used to store the local network topology information. Local training nodes are served as light nodes in topology chain, they collect network topology information from neighboring nodes, save it, are then upload it to the central consensus layer. The network topology information includes the physical location of nodes, CPU resources, link strength, node connectivity, and node reliability. After the consensus process, the central consensus layer packages this information into a block, adds it to the topology chain. The topology chain has a high degree of security and transparency, all information including node reliability is publicly recorded and all nodes can access this information. In the VNE process, network topology information stored in the topology chain can effectively improve security and play a key role in subsequent model verification.

2) Model chain: After completing local model training, the local training node uploads the local training model information to the central consensus layer. The central consensus node aggregates these models, packages the latest global aggregated model information into a block, and adds the new block to the model chain through the consensus process. So, the model chain has high privacy and controllability, and can be used to save the sensitive data of model parameters. Then, the local training node can directly obtain the latest global training model information from the model chain, this method can reduce direct information interaction between the local training layer and the central consensus layer and improve the security of the model update process. Additionally, before model aggregation, the central consensus layer verifies local training model, and the validation result is one of the main parameters of reliability evaluating for local training nodes.

The dual-chain structure is a multichain blockchain, two chains store different data content, and the two chains cooperate with each other to complete VNE tasks. Topology chain is a public chain used to store and verify open information, ensuring security and consistency across of the network. Model chain is an alliance chain used to deal with sensitive data and private transactions. Such structure can strike a balance between protecting privacy and maintaining transparency while meeting the needs of different organizations interoperate operations, and providing a secure and reliable way for multiple organizations to share data. What’s more, the dual-chain structure facilitates the queries of VNE processes. The workflow of DRAM-BFL can be written into a smart contract that can act automatically.

1) EPBFT-NRA: Considering the consensus security, we design the enhanced practical Byzantine fault tolerant (PBFT) consensus based on node reliability assessment. The EBPFTNRA integrates reliability assessment and consensus node dynamic update, and PBFT. Initially, the node with the highest reliability assessment value is selected as primary node, the top n central consensus nodes with the highest node reliability value are selected as consensus node (replica node). After every M round of consensus process, EPBFT-NRA performs a consensus node updating process to ensure the fairness of nodes and the security of consensus process.

EPBFT-NRA is based on PBFT protocol. If we assume that the total number of consensus nodes in the system is [TeX:] $$\mathbb{N},$$ and there are f malicious nodes. For PBFT, only when [TeX:] $$\mathbb{N} \geq 3 f+1,$$ the security of the system can be guaranteed. The blockchain structure stores the information of the latest VNE process, and begins a new consensus process after completing a new VNE.

The Consensus process of EPBFT-NRA is shown in Fig. 5. The detailed descriptions are as follows.

1. Arrive: When a VNE arrives, the local training node sends its information to the nearest consensus node i.

2. Generate: The node with the highest reliability value is selected as primary node. After receiving the information from the local training node, the consensus node i packages this information and forwards it to the primary node.

3. Propagate: After the primary node receives messages from other consensus nodes, it packages all the messages and generates a block, then sends this new block to other replica nodes. After the primary node verifies the MAC, the three-phase broadcast protocol of PBFT starts, which are preprepare, prepare, and commit.

4. Pre-prepare: The primary node sends the pre-prepare message to all replica nodes. Each replica node accepts the pre-prepare message and enters the prepare phase.

5. Prepare: When replica nodes enter the prepare stage, each replica node sends a prepare message to all other replica nodes. After receiving the new block information, each replica node validates the information. For a replica, if it receives information from 2f different replicas are consistent with the pre-prepare message, that is, with 2f + 1 confirmations, the replica node is prepared. After all replica nodes are prepared, the consensus enters commit phase.

6. Commit: Each replica node broadcasts a commit message to all other replica nodes. If 2f+1 commit messages (including the message of itself) are correct, the replica node enters the committed state. After all replica nodes enter the committed state, the consensus process is completed, the new block is added to the blockchain.

The consensus node update process is shown in Fig. 6. The detailed descriptions are as follows.

1. Start: After M rounds of consensus process, the primary node will start the dynamic update process and send the start information to other replica nodes. In order to select new n replica nodes and new primary node, a reliability value threshold is calculated according to new node reliability values, and the start information includes this threshold value.

2. Exchange: After replica nodes receiving the start information from primary node, each replica node determines whether its reliability value is greater than the threshold value, if it is greater than the threshold, the replica node sends the update information to other replica nodes. If a replica node receives the information that from other 2f + 1 replica node, it enters the recruitment phase. The replica nodes with reliability values less than the threshold will be removed from the replica nodes.

3. Recruit: The remaining replica nodes send recruitment information to other consensus nodes (non-replica nodes).

4. Confirm recruitment: Each non-replica node determines whether its reliability value is greater than the threshold value, if its reliability value is greater than the threshold, it becomes a candidate node. All candidate nodes will send recruitment confirmation message to all replica nodes.

5. Update: After receiving recruitment confirming messages, each replica node will send node update information to other replica nodes and candidate nodes. If each replica node and each candidate node receive the update information from more than 2f + 1 nodes, these candidate nodes will become the replica nodes. The process of consensus node updating is end.

2) Blockchain system delay: The delay of block generation can be determined by two parts: consensus delay and node update delay. According to [40], only the computational delay of cryptographic operations is considered, including verifying signatures delay, generating MACs delay, and verifying MACs delay, which are [TeX:] $$C_s, C_m \text { and } C_v$$ respectively, the processing speed of consensus nodes is k GHz.

1) Consensus delay: The blockchain consensus process is shown in Fig. 5. We set the delay [TeX:] $$T_{arrive }$$ for VN to reach the processing stage to a fixed value. Then, the cost of the primary node and the replica node in the consensus process are respectively.

The consensus delay is

2) Node update delay: The consensus node update process is shown in Fig. 6. According to the process, we can calculate the cost of the primary node and the replica node as follows.

The delay of the node update process is

After every M consensus process, the node update process is developed. Additionally, the average delay calculation of the blockchain system is

To ensure the security of VNE in IoT, it is necessary to limit the consensus delay [41] of the blockchain, so

where [TeX:] $$T_{b c}(t)$$ is the delay limit to ensure system security.

D. Node Reliability Assessment Method

When there are malicious nodes in IoT, the attack behaviors of malicious nodes, such as malicious packet loss, malicious transmission, can cause VNE failure. This results in resource utilization decreasing and IoT tasks failure. To mitigate the impact of malicious nodes on the system performance, we propose a node reliability assessment method. Firstly, we analyze the behaviors of malicious nodes as follows:

1) Malicious embedding: After receiving the embedding decision, the malicious node may abandon the embedded decision with a certain probability.

2) Malicious transmission: After receiving the packet, the malicious node does not send the packet according to the optimal physical path selected by VNE. For example, arbitrarily transmitting packets to other physical paths that are already embedded, or maliciously deviating the optimal link embedding decision and choosing another long-distance physical path.

3) Malicious model uploading: If the malicious node is a local training node, it may maliciously upload local model information with poor performance to the central consensus layer.

These three malicious behaviors are quantified into corresponding security assessment values respectively and integrated into a node reliability assessment algorithm.

1) Node embedding assessment

where [TeX:] $$R^{N_i^S}$$ is the embedding completed by the node [TeX:] $$N_i^S$$ per unit of time; [TeX:] $$S^{N_i^S}$$ is embedding decisions received by the node [TeX:] $$N_i^S$$ per unit of time.

2) Node transmission assessment

where [TeX:] $$M D^{N_i^S}$$ is the number of times the node [TeX:] $$N_i^S$$ is detected as malicious transmission per unit time; [TeX:] $$D^{N_i^S}$$ is the total number of times the node [TeX:] $$N_i^S$$ is detected for transmission per unit of time, [TeX:] $$1+D^{N_i^S}$$ is set to avoid the situation that denominator is equal to 0.

3) Node model uploading assessment

where [TeX:] $$M Z^{N_i^S}$$ is the number of times the node [TeX:] $$N_i^S$$ is detected as malicious uploads per unit time; [TeX:] $$Z^{N_i^S}$$ is the total number of times the node [TeX:] $$N_i^S$$ is detected for model uploading per unit of time.

4) The assessment of node reliability

It can be seen from (21) that the larger [TeX:] $$\mathbb{S}_i^{N_i^S},$$ the higher the reliability of the node [TeX:] $$N_i^S.$$

VI. SIMULATION RESULTS AND ANALYSIS

We use GT-ITM topology generator [42] to generate the topology of the underlying physical network and the virtual network requirements. The number of nodes in the initial underlying physical network is 100, the connection probability between nodes is 0.5, and the CPU and bandwidth resources of each physical link are randomly generated following a uniformly distributed between 50 and 100. The underlying physical network is divided into 8 local networks according to geographical location. For the virtual network requirements, the requirement arrival follows Poisson distribution, the arrival time is 1000 unit times and the expected is 5. The number of virtual nodes follows a uniform distribution between 2 and 8, and the connection probability between nodes is 0.5. The CPU and link bandwidth resources of each virtual node are randomly generated following a uniformly distributed between 1 and 20. We generate 1,000 VN requirements during 200,000 unit times, and we use these VN requirements as a local dataset. The learning rate η is set to 0.001, the blockchain size is 1 MB, k is 2.4 GHz, [TeX:] $$D_s$$ is 0.034 M (CPU cycles), [TeX:] $$C_m$$ is 4 M (CPU cycles), and [TeX:] $$C_v$$ is 4 M (CPU cycles).

To evaluate the performance of DRAM-BFL, we compare DRAM-BFL with two methods, which are Node Rank in [20] and RL-VNE in [27], under the network environment with malicious nodes and without malicious node respectively. We compare the performance of VN acceptance rate and longterm average revenue-to-expenditure ratio. We also increase the number of physical nodes and expand the scale of the physical network to test the scalability of DRAM-BFL.

We first evaluate the VN acceptance rate and long-term average revenue-to-expenditure ratio of each method over time. Then we set the physical network environment to 100 physical nodes (PN=100) and 200 nodes (PN=200), and simulate the scenarios with 5 malicious nodes and without malicious node respectively. In order to show the superiority of DRAM-BFL, we simulate its algorithm execution time and its number of communications, and compare DRAM-BFL with centralized VNE algorithms. Then, we conduct the delay and throughput experiments by using DRAM-FL under an ideal environment (no malicious nodes), and compare it with DRAM-FL with malicious nodes and DRAM-BFL with malicious nodes.

Figs. 7 and 8 show the superiority of DRAM-BFL in VN acceptance rate and long-term average revenue-to-expenditure ratio. In the ideal IoT environment without malicious nodes, we can see that VN acceptance rate of all three methods are reduced at first, this is because when more VNs arrive, the underlying network resources will be occupied more, and the available idle resources will be less. However, the long-term average revenue-to-expenditure ratio is relatively stable as it is independent of the available resources. As the underlying network gradually depletes, the performance of the three methods begins to stabilize. Notably, the VN acceptance rate of DRAM-BFL is 15.1% and 24.1% higher than that of Node Rank and RL-VNE, and the long-term average revenue-toexpenditure ratio of DRAM-BFL is 25.8% and 41.8% higher than that of Node Rank and RL-VNE respectively.

However, when malicious nodes are present in the IoT network, Figs. 9 and 10 show that the VN acceptance rate of RL-VNE and Node Rank significantly decreases. This is because malicious nodes cause security problems while RL-VNE and Node Rank do not have blockchain protection. To address this problem, DRAM-BFL uses a node reliability assessment method, and prefers physical secure nodes for embedding. The method can effectively reduce the impact of malicious nodes on VNE performance.

Figs. 11 and 12 show the VN acceptance rate of three methods in the network with double physical nodes. We can see that, even with the increase of physical nodes and the underlying physical network resources, DRAM-BFL still outperforms the other two methods in terms of VN acceptance rate. The increase of physical nodes leads to a great increase of computation required to find suitable nodes and links during VNE. As the Node Rank employs the greedy search strategy, the time required increase exponentially as the number of nodes increases. RL-VNE, relying on the embedding probability calculated by a centralized ML policy, needs to collect the feature information of all local nodes, resulting in double computing and storage resources requirements in double scale network.

Due to the direct correlation between computational cost and algorithm execution time, we evaluated the computational cost of DRAM-FL by algorithm execution time, and we evaluated the communication cost of DRAM-FL by the number of communications. Figs. 13 and 14 show the number of communications and the algorithm execution time of three methods.

Fig. 13 shows the average number of communications required by embedding a VN, and it can be seen that the communication costs of DRAM-BFL is only about 20% of Node Rank and about 25% of RL-VNE. That’s because DRAM-BFL obtains local network information through the local training node collecting, while RL-VNE and Node Rank obtain local network information through all nodes uploading to central server. In Fig. 14, we can see that Node Rank takes the least execution time because it uses a simple search strategy, but its VN acceptance rate is poor. RL-VNE adopts a centralized training strategy, which increases the computational complexity, so it has more time-consuming than DRAM-FL. The time-consuming of DRAM-FL is 40.3% lower than that of centralized RL-VNE method. The nDRAM-BFL umber of communications of DRAM-FL is much lower than that of centralized algorithms RL-VNE and Node Rank. So, DRAM-FL can reduce the computational and communication costs when compared with centralized VNE algorithms.

Figs. 15–17 further illustrate the superiority of the DRAM-BFL blockchain system in the malicious node environment.

Fig. 15 shows that the throughput of DRAM-FL without malicious nodes is better than that of DRAM-BFL with malicious nodes and DRAM-FL with malicious nodes. Furthermore, due to the security protection of blockchain, the throughput of DRAM-BFL with malicious nodes is higher than that of DRAM-FL with malicious nodes.

Fig. 16 shows that, as the number of malicious nodes increases, the performance of DRAM-FL and DRAM-BFL decreases. This is because in a malicious node environment, the greater the amount of data, the more data that the malicious node handles, and the lower the throughput. However, DRAM-BFL can effectively avoid the selection of malicious nodes, so the throughput of DRAM-BFL scheme is always higher than that of DRAM-FL.

Fig. 17 shows the network delay of different schemes. As time increases, the delay of the DRAM-FL without malicious nodes is lower than that of DRAM-BFL with malicious nodes and DRAM-FL with malicious nodes. That’s because, in the environment of malicious nodes, malicious nodes will choose non-optimal paths to transmit data, resulting in the increase of network transmission delay. In addition, due to the security protection of blockchain, the delay of DRAM-FL with malicious nodes is always lower than that of DRAM-BFL with malicious nodes.

Based on the above analysis, the proposed DRAM-BFL can not only improve the security of resource allocation in IoT, but also provide excellent performance and practical significance.

VII. CONCLUSION

Based on the characteristics of resource fragmentation in IoT, we use network virtualization technology to model the resource allocation problem as a VNE optimization problem. Considering the restricted terminal resource and security problems, we introduce blockchain and FL into VNE and propose DRAM-BFL to solve this VNE optimization problem. In DRAM-BFL, a dual chain structure is proposed to protect network topology information and model parameter information, a node reliability assessment method and EPBFT-NRA consensus algorithm are proposed to improve security performance. Finally, simulation results show that DRAM-BFL has good performance in VN acceptance rate, revenue-to-expenditure ratio, network throughput and delay while improving system security.