Building-Wide Virtual Private Network (VPN) systems leverage the current communication infrastructure to connect various IoT devices and management systems through encrypted tunnels. These systems are essential for protecting sensitive data and ensuring operational security but face imminent threats from quantum computers capable of breaking widely-used public key cryptography. In this paper, we propose a lightweight hybrid post-quantum security framework specifically designed for building-wide IoT VPN systems, which combines classical cryptographic primitives (e.g., ECDH) with selected post-quantum crypto (PQC) algorithms (e.g., Kyber, Dilithium). This dual-layer architecture ensures protection against both current and future quantum threats, relying on the hardness of at least one underlying cryptographic assumption for security. Furthermore, the framework incorporates lightweight design principles tailored for resource-constrained IoT environments. These principles emphasize minimal computational demands, reduced communication costs, and limited protocol complexity. Specifically, its lightweight nature reflects simplification to the VPN protocol’s operations and the selected integration of post-quantum algorithms. This optimized application of PQC simplifies the cryptographic workload for key exchange and signature, thereby balancing security guarantees with feasible deployment on IoT hardware. Our analysis and experimental results demonstrate that the proposed architecture achieves quantum resistance with manageable performance impact compared to traditional VPNs, making it a practical and scalable solution for migrating existing building management infrastructures towards post-quantum security across diverse IoT devices.
Building-Wide Virtual Private Network (VPN) systems leverage the current communication infrastructure to connect various IoT devices and management systems through encrypted tunnels. These systems are essential for protecting sensitive data and ensuring operational security but face imminent threats from quantum computers capable of breaking widely-used public key cryptography. In this paper, we propose a lightweight hybrid post-quantum security framework specifically designed for building-wide IoT VPN systems, which combines classical cryptographic primitives (e.g., ECDH) with selected post-quantum crypto (PQC) algorithms (e.g., Kyber, Dilithium). This dual-layer architecture ensures protection against both current and future quantum threats, relying on the hardness of at least one underlying cryptographic assumption for security. Furthermore, the framework incorporates lightweight design principles tailored for resource-constrained IoT environments. These principles emphasize minimal computational demands, reduced communication costs, and limited protocol complexity. Specifically, its lightweight nature reflects simplification to the VPN protocol’s operations and the selected integration of post-quantum algorithms. This optimized application of PQC simplifies the cryptographic workload for key exchange and signature, thereby balancing security guarantees with feasible deployment on IoT hardware. Our analysis and experimental results demonstrate that the proposed architecture achieves quantum resistance with manageable performance impact compared to traditional VPNs, making it a practical and scalable solution for migrating existing building management infrastructures towards post-quantum security across diverse IoT devices.
The fast development of quantum computing presents a great threat to the security of classical cryptographic algorithms that support secure communication systems like Virtual Private Networks (VPNs). RSA and ECC algorithms that are commonly employed in key exchange and digital authentication can fall victim to quantum attacks from Shor’s and Grover’s algorithms. This study introduces the design and deployment of a post-quantum-resistant VPN protocol using post-quantum cryptographic (PQC) primitives, i.e., Kyber for key encapsulation and Dilithium for digital signatures. The suggested structure is incorporated into OpenVPN via the Open Quantum Safe (OQS) framework for uninterrupted post-quantum compatibility. The protocol is also capable of supporting hybrid cryptography for smooth transition from classical to post-quantum systems. Performance benchmarks are performed over metrics like handshake latency, tunnel throughput, CPU usage, and certificate overhead. The findings illustrate that post-quantum secure VPNs are not only achievable but also feasible for near-future deployment. This work adds a future-proof framework to improve the resilience of secure communications in the post-quantum era with a focus on scalability, crypto-agility, and real-world implementation readiness.
The growing interconnection of critical engineering infrastructure through IoT introduces unprecedented exposure to cyber threats. Emerging quantum computing capabilities pose a transformative risk to classical cryptographic primitives such as Rivest–Shamir–Adleman and Elliptic-Curve Cryptography, which underpin secure communication and device authentication in industrial control systems, power grids, transportation networks, and healthcare infrastructure. This paper investigates quantum-resistant encryption, often termed post-quantum cryptography (PQC), as a sustainable security paradigm for IoT communication within critical systems. By analyzing lattice-based, code-based, multivariate, and hash-based schemes, the study evaluates trade-offs between computational cost, memory footprint, and latency constraints intrinsic to resource-limited IoT nodes. A hybrid architectural framework integrating the National Institute of Standards and Technology-standardized algorithms (e.g., Cryptographic Suite for Algebraic Lattices—Kyber, Dilithium) with lightweight symmetric primitives (e.g., Ascon, GIFT block cipher in Combined Feedback mode) is proposed for secure data transmission across heterogeneous IoT layers. Experimental simulations benchmark key-exchange throughput, ciphertext expansion, and resilience against quantum-adversarial models, demonstrating up to 65% reduction in handshake latency compared to baseline lattice implementations under constrained conditions. The paper concludes with policy and engineering recommendations for the adoption of quantum-resistant IoT protocols in energy, transportation, and industrial automation sectors, highlighting alignment with global PQC migration roadmaps and IEC 62443 cybersecurity standards.
The advent of large-scale quantum computing poses a fundamental threat to widely deployed public-key cryptographic mechanisms, particularly in Internet of Things (IoT) systems with long operational lifetimes and limited upgrade capabilities. Narrowband Internet of Things (NB-IoT), as a representative Low-Power Wide-Area Network (LPWAN) technology, is especially vulnerable to this transition due to its strict constraints on packet size, bandwidth, and Radio-Frequency (RF) energy consumption. Although Post-Quantum Cryptography (PQC) has progressed rapidly through standardization efforts led by the National Institute of Standards and Technology (NIST), the direct and frequent application of PQC primitives in NB-IoT communication remains impractical. Large ciphertexts and digital signatures, although cryptographically sound, conflict with the fundamental design principles of LPWANs and may significantly degrade reliability, scalability, and device lifetime. This paper proposes a PQC-aware secure communication architecture for NB-IoT that reconciles long-term quantum resistance with the operational realities of constrained radio networks. Rather than treating PQC as a drop-in replacement for classical public-key cryptography, the proposed design adopts a two-plane security architecture that explicitly separates control-plane onboarding from data-plane communication. Post-quantum primitives are confined to infrequent onboarding operations, where higher overhead can be tolerated, while routine data transmission relies exclusively on lightweight symmetric authenticated encryption. Specifically, the architecture employs CRYSTALS-Kyber for post-quantum key encapsulation and CRYSTALS-Dilithium for device authentication during onboarding, selected for their standardization status and comparatively compact message sizes. After onboarding, all data traffic is protected using ChaCha20-Poly1305, combined with a key-derivation-based ratcheting mechanism that provides per-message forward secrecy without recurring PQC overhead. This design is explicitly aligned with NIST guidance on the intended use of post-quantum signatures and the constraints of LPWAN deployments. The proposed framework was implemented and evaluated on an ESP32-based NB-IoT platform with a commercial cellular module. Experimental results demonstrate that post-quantum onboarding can be completed within NB-IoT packet-size constraints with acceptable reliability, while routine data transmission incurs minimal computational, bandwidth, and energy overhead. The findings confirm that quantum-resistant security for NB-IoT is achievable only when PQC is applied selectively and system-aware, rather than uniformly across all communication phases.
The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
The urgent threat posed by cryptographically significant quantum computers (CRQC) necessitates a global transition to Post-Quantum Cryptography (PQC) to secure Virtual Private Networks (VPNs). Current standardization efforts, notably in IETF drafts, focus predominantly on hybrid constructions, which introduce operational complexity, dual overhead, and retain partial security dependence on quantum-vulnerable primitives. This paper is in effort of StrongVPN, a novel protocol and implementation that achieves end-to-end quantum resistance without hybrid dependencies which is lift and scale model. Our architecture integrates ML-DSA-65 choosen for authentication and ML-KEM-768 for key exchange in a unified, certificate-free** handshake, offering a simplified trust model compared to complex X.509/PKI requirements, reducing overheads. The implementation emphasizes performance through low-level mathematical optimizations, including Number Theoretic Transform (NTT) for efficient polynomial arithmetic, and stringent constant-time operations for side-channel resilience. Empirical evaluation validates its practical feasibility, demonstrating a mean end-to-end handshake latency of only 127ms on commodity infrastructure, despite a necessary 14.1KB cryptographic overhead. StrongVPN establishes a critical, high-performance baseline for pure PQC network security, offering a simplified and accelerated migration path to full quantum safety solution.
The rapid advancement of quantum computing threatens the security foundations of classical public-key cryptographic systems such as RSA and Elliptic Curve Cryptography (ECC), which underpin cloud and edge infrastructures. With scalable quantum algorithms capable of breaking widely deployed cryptographic primitives, organizations must transition toward quantum-resilient security models. This paper proposes a comprehensive Quantum-Resilient Cryptographic Architecture (QRCA) designed specifically for cloud and edge computing environments. The framework integrates post-quantum cryptographic (PQC) algorithms, hybrid key exchange protocols, zero-trust principles, and hardware-assisted secure enclaves. We present a layered security model that balances computational overhead, latency constraints, and scalability requirements in distributed systems. Experimental simulations evaluate performance metrics including encryption latency, key exchange overhead, and throughput across cloud data centres and edge nodes. Results indicate that hybrid PQC deployments achieve strong quantum resilience with manageable performance trade-offs. The proposed architecture offers a practical migration pathway for organizations seeking future-proof cryptographic security in distributed computing ecosystems.