PQ‐AuthN‐IIoT: A Lightweight, LWE‐Based Postquantum and Privacy‐Preserving Mutual Authentication Scheme for Resource‐Constrained Industrial IoT Systems
The rapid expansion of the Industrial Internet of Things (IIoT) presents pressing challenges for secure, efficient, and privacy‐preserving communication among users, sensors, and cloud infrastructures. Existing lightweight authentication schemes, primarily based on classical cryptographic assumptions, are increasingly vulnerable to the emerging threat of quantum computing. To address these challenges, we propose a lightweight, quantum‐resilient, and privacy‐preserving mutual authentication scheme tailored to the IIoT ecosystem. The proposed scheme integrates the learning with errors (LWE) assumption to achieve postquantum secure authentication and identity protection, hash functions for message integrity, and ephemeral elliptic curve Diffie–Hellman (ECDH) to provide classical forward secrecy within a hybrid security model. A novel use of ephemeral pseudonyms further enhances unlinkability and resilience against traceability attacks. The security of the scheme is established through informal analysis, covering resistance to forgery, impersonation, replay, man‐in‐the‐middle, and key compromise impersonation attacks, and through formal analysis in both the random oracle model (ROM) and BAN logic, proving mutual authentication and secrecy properties. Performance evaluation demonstrates that the scheme achieves low computational cost for resource‐constrained sensors (≈ 4 ms) and practical communication overhead while maintaining comprehensive security features superior to existing solutions. These results highlight that the proposed scheme provides a robust, efficient, and deployable framework for postquantum secure authentication in IIoT ecosystems.
The rapid expansion of the Industrial Internet of Things (IIoT) presents pressing challenges for secure, efficient, and privacy‐preserving communication among users, sensors, and cloud infrastructures. Existing lightweight authentication schemes, primarily based on classical cryptographic assumptions, are increasingly vulnerable to the emerging threat of quantum computing. To address these challenges, we propose a lightweight, quantum‐resilient, and privacy‐preserving mutual authentication scheme tailored to the IIoT ecosystem. The proposed scheme integrates the learning with errors (LWE) assumption to achieve postquantum secure authentication and identity protection, hash functions for message integrity, and ephemeral elliptic curve Diffie–Hellman (ECDH) to provide classical forward secrecy within a hybrid security model. A novel use of ephemeral pseudonyms further enhances unlinkability and resilience against traceability attacks. The security of the scheme is established through informal analysis, covering resistance to forgery, impersonation, replay, man‐in‐the‐middle, and key compromise impersonation attacks, and through formal analysis in both the random oracle model (ROM) and BAN logic, proving mutual authentication and secrecy properties. Performance evaluation demonstrates that the scheme achieves low computational cost for resource‐constrained sensors (≈ 4 ms) and practical communication overhead while maintaining comprehensive security features superior to existing solutions. These results highlight that the proposed scheme provides a robust, efficient, and deployable framework for postquantum secure authentication in IIoT ecosystems.
The Industrial Internet of Things (IIoT) integrates control systems with IoT technology to enable automation and intelligent operations in industrial environments. As IIoT deployments expand, reliance on wireless communication channels increases the attack surface and exposes systems to various security and privacy threats. Moreover, the limited computational capabilities of IIoT devices and the need to preserve device anonymity introduce additional security requirements. Insufficient protection against these challenges can result in operational disruption and significant economic losses. Existing symmetric-key and hash-based schemes are lightweight but lack scalability for large IIoT deployments, whereas public-key methods provide stronger security. However, the emergence of quantum computing threatens the long-term security of such protocols, as quantum algorithms can efficiently break conventional number-theoretic cryptosystems. To address these challenges, we propose a quantum-resistant three-party authentication and key agreement (AKA) protocol for the IIoT. The ring learning with errors (RLWE)-based protocol provides quantum-safe and efficient mutual authentication and secure session key establishment between workers and devices. Comprehensive security and performance analyses demonstrate that the proposed protocol is robust against security attacks. Performance evaluations confirm lower computational and communication overhead than existing post-quantum schemes, proving its practicality for IIoT.
The Industrial Internet of Things (IIoT) enables smart manufacturing through advanced sensing, monitoring, and control capabilities. However, securing these resource-constrained IIoT devices poses critical challenges due to limited memory and energy resources, while the emergence of quantum computing threatens existing security mechanisms. This study addresses the urgent need for practical quantum-resistant security solutions for deployment in resource-limited industrial environments. It presents QLight-IIoT, a quantum-resistant authentication and key agreement (AKA) scheme established solely on hash-based hardness assumption, demonstrating that lightweight quantum-resistant authentication is achievable without relying on computationally intensive primitives like lattices or codes. The proposed scheme is deployed and tested over Raspberry Pi 4 to demonstrate its practicality in real-world IIoT environments. Experimental validation shows that the scheme ensures mutual authentication with session key establishment with an average key generation time of 0.3200 seconds. The security of the proposed QLight-IIoT scheme is systematically evaluated using the Real-or-Random (ROR) model, the Scyther tool, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) framework. Performance evaluation reveals significant efficiency improvements, achieving 9.29–77.36% reduction in communication cost and 4.41–95.37% reduction in Computational overhead relative to existing schemes. The scheme requires minimal storage of 632 bits per IIoT device, resulting in up to 64.84% reduction in total system storage cost. Comparative security analysis further validates the scheme’s security against various attack vectors. This work provides a practical pathway for industrial organizations to prepare IIoT infrastructure for quantum-resistant security challenges while maintaining compatibility with current resource-constrained hardware.
The Edge-enabled Industrial Internet of Things (Edge-IIoT) has emerged as a fundamental architecture for intelligent manufacturing by enabling low-latency data collection, processing, and communication among distributed industrial devices. However, the open and distributed nature of Edge-IIoT introduces significant challenges to secure data authentication and privacy preservation. Meanwhile, conventional public key infrastructure incurs considerable certificate management overhead and is not well suited for future industrial environments in the presence of quantum computing. To address these challenges, this paper proposes a lattice-based certificateless blind signature scheme for secure and privacy-preserving authentication in Edge-IIoT. The proposed scheme integrates the Dilithium signature algorithm with certificateless public key cryptography and blind signature techniques to simultaneously provide anonymous authentication, data integrity, conditional identity revocation, and post-quantum security while eliminating the certificate management overhead associated with traditional public key infrastructures. Furthermore, the proposed construction improves existing lattice-based certificateless blind signature schemes by addressing identified security weaknesses and strengthening resistance against forgery attacks, while effectively avoiding the key escrow problem inherent in identity-based cryptography. The correctness, blindness, and unforgeability of the proposed scheme are formally proved in the random oracle model based on the hardness of the Module Short Integer Solution (MSIS) problem. In addition, theoretical performance analysis demonstrates that the proposed scheme incurs acceptable computational, communication, and storage overhead while providing comprehensive security properties, including certificateless operation, identity anonymity, no key escrow, conditional revocation, and post-quantum security. Overall, the proposed scheme achieves an effective balance between security, privacy preservation, and efficiency, which exhibits favorable theoretical security-efficiency trade-offs for secure industrial data authentication in resource-constrained Edge-IIoT environments. Practical implementation is left for future investigation.
The rapid expansion of Internet of Things (IoT) ecosystems has introduced significant security challenges due to resource-constrained devices, heterogeneous network architectures, and largescale connectivity. Traditional authentication and key exchange mechanisms, primarily based on classical cryptographic algorithms such as RSA and ECC, are vulnerable to future quantum computing attacks. The emergence of quantum algorithms, particularly Shor’s algorithm, threatens the long-term confidentiality and integrity of IoT communications. This paper proposes a Quantum-Resistant Authentication and Key Exchange Protocol specifically designed for secure IoT architectures. The proposed framework integrates post-quantum cryptographic primitives, including lattice-based key exchange mechanisms and hash-based authentication schemes, optimized for low computational overhead suitable for constrained IoT devices. The protocol ensures mutual authentication, forward secrecy, and resistance against quantum adversaries while maintaining minimal communication latency. Security analysis demonstrates robustness against replay, man-in-the-middle, and key-compromise attacks. Performance evaluation shows that the proposed solution achieves a balance between quantum security strength and resource efficiency, making it suitable for next-generation IoT deployments in smart cities, healthcare systems, and industrial automation.
The imminent advent of quantum computing threatens the long-term security of classical public-key cryptography, creating critical challenges for resource-constrained internet of things (IoT) environments.Hybrid cryptographic frameworks combining elliptic curve cryptography (ECC) with post-quantum cryptography (PQC) primitives have emerged as a transitional solution; however, their security properties remain insufficiently validated under semi-trusted infrastructure assumptions.This paper presents a comprehensive security evaluation of a hybrid ECC-KEM authentication and key agreement framework targeting IoT deployments.Using a dual-verification methodology that integrates formal symbolic analysis with the Tamarin-Prover and practical AI-assisted testing via the APSVer tool, we identify a critical impersonation vulnerability that enables a semi-trusted third party (TTP) to reconstruct PUF-based authentication material.To mitigate this flaw, we introduce a protocol enhancement incorporating ML-DSA post-quantum digital signatures and device-isolated key derivation.Formal verification confirms that the enhanced protocol achieves mutual authentication, session key secrecy, replay resistance, and effective isolation of the TTP.Experimental performance analysis demonstrates that the proposed security improvements introduce only a 12%-15% computational overhead, preserving feasibility for constrained IoT devices.The proposed framework provides a practical, quantum-resilient authentication architecture suitable for next-generation secure IoT deployments.
As an imperative division of the Internet of Things (IoT), Industrial IoT (IIoT) has also attracted full attention. IIoT networks are equipped with various authenticated key exchange techniques under the cumbersome Diffie–Hellman (DH) problems and certificate management overheads. However, DH-type problems are vulnerable to quantum cryptanalysis. In this article, a novel identity-based authenticated key exchange protocol is designed using the concept of lattice cryptography, which enables the different security features in the IIoT in open wireless communication. Due to the lattice hard assumptions, the proposed protocol can withstand a quantum attack. Rigorous formal security analysis has been made, which shows the ability of the proposed protocol to resist existing as well as quantum attacks. Performance results demonstrate that the proposed protocol exhibits better communication, energy consumption, cryptographic key storage, and computation costs than other similar state of the arts.