Post-quantum cryptography (PQC) is fast becoming a necessity for the Industrial Internet of Things (IIoT), where security requirements must align with strict latency and resource constraints. Traditional security protocols relying on static identities, centralized revocation, and bulky ciphertexts are ill-suited for dynamic and distributed IIoT systems. This paper introduces a quantum-resilient identity and key management architecture optimized for constrained industrial environments. We propose a lightweight entropy-seeded identity model that leverages biometric, device, and environmental randomness to generate spoof-resistant identities. A compressed key encapsulation delivery protocol based on CRYSTALS Kyber512 is developed using delta encoding, fragmentation, and ZLIB compression to minimize ciphertext overhead. Although a hybrid blockchain integration is conceptually discussed to outline revocation and trust enforcement, our implementation on constrained IIoT devices demonstrates over 48% ciphertext size reduction, 30% latency improvement compared to baseline Kyber, and real-time trust scoring based on behavioral analysis, showing strong potential for scalable, bandwidth-aware, and future-proof security deployment in post-quantum IIoT ecosystems.
Post-quantum cryptography (PQC) is fast becoming a necessity for the Industrial Internet of Things (IIoT), where security requirements must align with strict latency and resource constraints. Traditional security protocols relying on static identities, centralized revocation, and bulky ciphertexts are ill-suited for dynamic and distributed IIoT systems. This paper introduces a quantum-resilient identity and key management architecture optimized for constrained industrial environments. We propose a lightweight entropy-seeded identity model that leverages biometric, device, and environmental randomness to generate spoof-resistant identities. A compressed key encapsulation delivery protocol based on CRYSTALS Kyber512 is developed using delta encoding, fragmentation, and ZLIB compression to minimize ciphertext overhead. Although a hybrid blockchain integration is conceptually discussed to outline revocation and trust enforcement, our implementation on constrained IIoT devices demonstrates over 48% ciphertext size reduction, 30% latency improvement compared to baseline Kyber, and real-time trust scoring based on behavioral analysis, showing strong potential for scalable, bandwidth-aware, and future-proof security deployment in post-quantum IIoT ecosystems.
The Industrial Internet of Things (IIoT) enables smart manufacturing through advanced sensing, monitoring, and control capabilities. However, securing these resource-constrained IIoT devices poses critical challenges due to limited memory and energy resources, while the emergence of quantum computing threatens existing security mechanisms. This study addresses the urgent need for practical quantum-resistant security solutions for deployment in resource-limited industrial environments. It presents QLight-IIoT, a quantum-resistant authentication and key agreement (AKA) scheme established solely on hash-based hardness assumption, demonstrating that lightweight quantum-resistant authentication is achievable without relying on computationally intensive primitives like lattices or codes. The proposed scheme is deployed and tested over Raspberry Pi 4 to demonstrate its practicality in real-world IIoT environments. Experimental validation shows that the scheme ensures mutual authentication with session key establishment with an average key generation time of 0.3200 seconds. The security of the proposed QLight-IIoT scheme is systematically evaluated using the Real-or-Random (ROR) model, the Scyther tool, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) framework. Performance evaluation reveals significant efficiency improvements, achieving 9.29–77.36% reduction in communication cost and 4.41–95.37% reduction in Computational overhead relative to existing schemes. The scheme requires minimal storage of 632 bits per IIoT device, resulting in up to 64.84% reduction in total system storage cost. Comparative security analysis further validates the scheme’s security against various attack vectors. This work provides a practical pathway for industrial organizations to prepare IIoT infrastructure for quantum-resistant security challenges while maintaining compatibility with current resource-constrained hardware.
The emergence of quantum computing threatens classical cryptographic systems, including RSA and ECC, potentially compromising the security of pervasive Internet of Things (IoT) deployments. Resourceconstrained IoT devices—such as sensors, embedded controllers, and microcontrollers—face significant challenges in adopting post-quantum cryptographic (PQC) protocols due to computational, memory, and energy limitations. This paper proposes AQ-PQC, an adaptive lightweight hybrid key exchange protocol combining Kyber lattice-based KEM and lightweight elliptic curve cryptography (ECC), specifically designed for constrained devices. AQ-PQC introduces a dynamic parameter tuning algorithm that adjusts key sizes, handshake rounds, and compression ratios based on real-time device state and network conditions. Formal security analysis under the IND-CCA model demonstrates quantum-resistance and forward secrecy. Extensive hardware implementation on Raspberry Pi 4 and ESP32 devices reveals a significant reduction in handshake latency, energy consumption, and memory footprint compared to conventional PQC protocols. The proposed framework provides a practical, reproducible, and secure methodology for post-quantum IoT communications, supporting heterogeneous and resource-limited networks.
Industrial Internet of Things (IIoT) deployments increasingly rely on cloud–edge collaboration while operating with long-lived field devices, heterogeneous hardware, deterministic control requirements, and bandwidth-constrained links. These properties make “PQC everywhere” upgrades costly and operationally risky, yet the edge–device access boundary remains a critical trust bottleneck and an attractive target for impersonation, replay, and key-compromise threats. This paper proposes a selective-deployment approach for post-quantum authentication in industrial systems: rather than enforcing uniform migration, we identify security-critical boundaries and map protocol changes to lifecycle safe points to enable incremental, deployable protection. Building on this framework, we design SDAKA, a lifecycle-oriented post-quantum authentication and key agreement protocol spanning onboarding/registration, runtime access, maintenance (key evolution), and decommissioning/ revocation. SDAKA combines the standardized post-quantum signature primitive ML-DSA with an ML-KEM-inspired Module-LWE key-establishment component to establish session keys and authenticate lifecycle operations, while supporting operational needs such as pseudonymous access with accountable traceability. We validate the protocol via machine-checked symbolic analysis (ProVerif) and reduction-style security arguments in the Real-or-Random (RoR) model. A heterogeneous edge–device testbed evaluation further demonstrates that SDAKA’s computational latency and communication overhead remain practical for industrial links, and that different security configurations provide flexible trade-offs between protection strength and deployment cost.
The explosive growth of Industrial Internet of Things (IIoT) technologies has been reshaping manufacturing, energy, transportation and infrastructure with real-time monitoring and automation supported by predictive analytics. The more interconnected machines are, the more vulnerable they become to advanced cyberattacks. RSA and ECC are two of the dominant cryptographic algorithms that 60% of the IIoT communications today. They are still susceptible to quantum computing attacks, especially from Shor, which can easily break public-key encryption. This new risk, and the threat it represents, calls for a monitoring of the quantum situation by adding Post Quantum Cryptography (PQC) to guarantee data privacy and resilient systems. This work studies the quantum-empowered security approach to IIoT environment and considers lattice-based, hash-based and code-based cryptography techniques immune to quantum attacks. This paper investigates the industrial system design demands, identifies some of these weaknesses, and presents a secure communication architecture including post-quantum cryptography for device authentication, secure firmware updates and data encryption. Studies show that due to constraints in resources, triage for IIoT devices is difficult, especially because of limitations of processors, among others; latency and scalability are two issues. The approach proposed showcases a means for industrial cybersecurity to benefit from post-quantum cryptography without losing efficiency.
Quantum computing is also posing a serious challenge to the classical cryptographic algorithms like RSA and ECC as they have vulnerability to quantum algorithms such as Shor and Grover. This is a serious problem to Internet of Things (IoT) and edge computing systems, where billions of devices work with strict resource constraints in processing power, memory and energy. To resolve this, we are introducing a minimal postquantum cryptography model to be used in edge platforms with constraints on their resources. This framework combines fierce encapsulation of key (Kyber512) on a lattice with traditional ECDH in a hybrid system of key establishment, along with the Ascon AEAD encryption algorithm to provide effective data hiding and integrity provision. Furthermore, rekeying and forward secrecy on a lightweight basis is possible to reconfigure a layer with negligible overhead on a secure transmission with forward secrecy. The experimental data with ARM Cortex-M and RISC-V architectures and 128-bit post-quantum security has shown that the proposed system can reduce the latency by up to 30 percent and the energy usage by up to 35 percent and considerably better throughput than PQC-only implementations. These findings validate the fact that hybrid PQC solutions have the potential to provide high-resistance quantum with minimal overhead and thus are best suited to IoT and edge applications. The paper offers a viable and extensible security design in conformance with the NIST PQC and IETF migration policies, which can support secure communication in the post-quantum era.
Current cellular authentication mechanisms rely primarily on SIM-based Authentication and Key Agreement (AKA), which have scaled successfully worldwide but face challenges as the Internet of Things (IoT) grows to billions of devices. SIM provisioning and lifecycle management become increasingly costly, while reliance on long-term symmetric keys limits revocation flexibility and cross-operator support. To address these issues, we propose a SIM-less, certificate-based authentication framework that integrates Public Key Infrastructure (PKI) with post-quantum cryptography (PQC). Specifically, the framework employs Kyber for key encapsulation and Dilithium for digital signatures, providing quantum-resistant protection for future networks. A key challenge is the computational overhead of PQC on constrained IoT devices; we address this by offloading cryptographic operations to trusted edge servers, whose integrity is validated using attestation mechanisms such as Trusted Platform Modules (TPMs) or secure enclaves. We implement and evaluate the framework in a simulated FutureG environment, comparing IoT-only execution against edge-assisted configurations. Results show that edge offloading reduces TLS handshake latency by up to 96% while maintaining minimal resource usage on devices. These findings demonstrate that PQC-enabled PKI, combined with edge-assisted execution, offers a scalable and practical complement to SIM/AKA for secure and quantum-resilient authentication in FutureG IoT deployments.