IEEE Internet of Things Journal

Selective Deployment of Post-Quantum Edge–Device Authentication for IIoT: A Lifecycle-Oriented SDAKA Protocol

Hao Tang, Hui Xia He, Weizhe Zhang, Hongwei Yang, Qingyang Fan

Published May 22, 2026• 0 citations

Abstract

Industrial Internet of Things (IIoT) deployments increasingly rely on cloud–edge collaboration while operating with long-lived field devices, heterogeneous hardware, deterministic control requirements, and bandwidth-constrained links. These properties make “PQC everywhere” upgrades costly and operationally risky, yet the edge–device access boundary remains a critical trust bottleneck and an attractive target for impersonation, replay, and key-compromise threats. This paper proposes a selective-deployment approach for post-quantum authentication in industrial systems: rather than enforcing uniform migration, we identify security-critical boundaries and map protocol changes to lifecycle safe points to enable incremental, deployable protection. Building on this framework, we design SDAKA, a lifecycle-oriented post-quantum authentication and key agreement protocol spanning onboarding/registration, runtime access, maintenance (key evolution), and decommissioning/ revocation. SDAKA combines the standardized post-quantum signature primitive ML-DSA with an ML-KEM-inspired Module-LWE key-establishment component to establish session keys and authenticate lifecycle operations, while supporting operational needs such as pseudonymous access with accountable traceability. We validate the protocol via machine-checked symbolic analysis (ProVerif) and reduction-style security arguments in the Real-or-Random (RoR) model. A heterogeneous edge–device testbed evaluation further demonstrates that SDAKA’s computational latency and communication overhead remain practical for industrial links, and that different security configurations provide flexible trade-offs between protection strength and deployment cost.

DOI: 10.1109/jiot.2026.3696043

Related papers

Quantum-Resilient Key and Identity Lifecycle Architecture for Lightweight IIoT Systems

Chimeremma Sandra Amadi, Taesoo Jun

Post-quantum cryptography (PQC) is fast becoming a necessity for the Industrial Internet of Things (IIoT), where security requirements must align with strict latency and resource constraints. Traditional security protocols relying on static identities, centralized revocation, and bulky ciphertexts are ill-suited for dynamic and distributed IIoT systems. This paper introduces a quantum-resilient identity and key management architecture optimized for constrained industrial environments. We propose a lightweight entropy-seeded identity model that leverages biometric, device, and environmental randomness to generate spoof-resistant identities. A compressed key encapsulation delivery protocol based on CRYSTALS Kyber512 is developed using delta encoding, fragmentation, and ZLIB compression to minimize ciphertext overhead. Although a hybrid blockchain integration is conceptually discussed to outline revocation and trust enforcement, our implementation on constrained IIoT devices demonstrates over 48% ciphertext size reduction, 30% latency improvement compared to baseline Kyber, and real-time trust scoring based on behavioral analysis, showing strong potential for scalable, bandwidth-aware, and future-proof security deployment in post-quantum IIoT ecosystems.

International Conference on Information and Communication Technology Convergence (ICTC)Oct 14, 20250 citations

QLight-IIoT: A Quantum-Resistant Lightweight Authentication and Key Agreement Scheme for Resource-Constrained IIoT Environments

Baisakhi Upadhyaya, Amaresh Chandra Panda, Swagat Sourav Mohanty +2 more

The Industrial Internet of Things (IIoT) enables smart manufacturing through advanced sensing, monitoring, and control capabilities. However, securing these resource-constrained IIoT devices poses critical challenges due to limited memory and energy resources, while the emergence of quantum computing threatens existing security mechanisms. This study addresses the urgent need for practical quantum-resistant security solutions for deployment in resource-limited industrial environments. It presents QLight-IIoT, a quantum-resistant authentication and key agreement (AKA) scheme established solely on hash-based hardness assumption, demonstrating that lightweight quantum-resistant authentication is achievable without relying on computationally intensive primitives like lattices or codes. The proposed scheme is deployed and tested over Raspberry Pi 4 to demonstrate its practicality in real-world IIoT environments. Experimental validation shows that the scheme ensures mutual authentication with session key establishment with an average key generation time of 0.3200 seconds. The security of the proposed QLight-IIoT scheme is systematically evaluated using the Real-or-Random (ROR) model, the Scyther tool, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) framework. Performance evaluation reveals significant efficiency improvements, achieving 9.29–77.36% reduction in communication cost and 4.41–95.37% reduction in Computational overhead relative to existing schemes. The scheme requires minimal storage of 632 bits per IIoT device, resulting in up to 64.84% reduction in total system storage cost. Comparative security analysis further validates the scheme’s security against various attack vectors. This work provides a practical pathway for industrial organizations to prepare IIoT infrastructure for quantum-resistant security challenges while maintaining compatibility with current resource-constrained hardware.

IEEE Internet of Things JournalApr 8, 20262 citations

Post-Quantum SIM-Less Authentication: Scalable and Secure Solutions for FutureG IoT Networks

Abhisek Kumar Jha, SeyedMohammad Kashani, Sang Wu Kim +2 more

Current cellular authentication mechanisms rely primarily on SIM-based Authentication and Key Agreement (AKA), which have scaled successfully worldwide but face challenges as the Internet of Things (IoT) grows to billions of devices. SIM provisioning and lifecycle management become increasingly costly, while reliance on long-term symmetric keys limits revocation flexibility and cross-operator support. To address these issues, we propose a SIM-less, certificate-based authentication framework that integrates Public Key Infrastructure (PKI) with post-quantum cryptography (PQC). Specifically, the framework employs Kyber for key encapsulation and Dilithium for digital signatures, providing quantum-resistant protection for future networks. A key challenge is the computational overhead of PQC on constrained IoT devices; we address this by offloading cryptographic operations to trusted edge servers, whose integrity is validated using attestation mechanisms such as Trusted Platform Modules (TPMs) or secure enclaves. We implement and evaluate the framework in a simulated FutureG environment, comparing IoT-only execution against edge-assisted configurations. Results show that edge offloading reduces TLS handshake latency by up to 96% while maintaining minimal resource usage on devices. These findings demonstrate that PQC-enabled PKI, combined with edge-assisted execution, offers a scalable and practical complement to SIM/AKA for secure and quantum-resilient authentication in FutureG IoT deployments.

IEEE Military Communications Conference (MILCOM)Oct 6, 20251 citation

Quantum-Resistant Three-Party Mutual Authentication Protocol for Industrial IoT Environments

Chaeeon Kim, Deokkyu Kwon, Y K Park +1 more

The Industrial Internet of Things (IIoT) integrates control systems with IoT technology to enable automation and intelligent operations in industrial environments. As IIoT deployments expand, reliance on wireless communication channels increases the attack surface and exposes systems to various security and privacy threats. Moreover, the limited computational capabilities of IIoT devices and the need to preserve device anonymity introduce additional security requirements. Insufficient protection against these challenges can result in operational disruption and significant economic losses. Existing symmetric-key and hash-based schemes are lightweight but lack scalability for large IIoT deployments, whereas public-key methods provide stronger security. However, the emergence of quantum computing threatens the long-term security of such protocols, as quantum algorithms can efficiently break conventional number-theoretic cryptosystems. To address these challenges, we propose a quantum-resistant three-party authentication and key agreement (AKA) protocol for the IIoT. The ring learning with errors (RLWE)-based protocol provides quantum-safe and efficient mutual authentication and secure session key establishment between workers and devices. Comprehensive security and performance analyses demonstrate that the proposed protocol is robust against security attacks. Performance evaluations confirm lower computational and communication overhead than existing post-quantum schemes, proving its practicality for IIoT.

IEEE Internet of Things JournalMar 25, 20262 citations

Post-quantum cryptographic authentication protocol for industrial IoT using lattice-based cryptography

Abdul Basit Shahid, Khwaja Mansoor, Yawar Abbas Bangash +2 more

The integration of NIST-standardized lattice-based cryptographic algorithms (ML-KEM and ML-DSA) into TLS 1.3 enables post-quantum secure authentication for Industrial IoT (IIoT) environments. This work implements these algorithms within the X.509 certificate infrastructure and evaluates their performance on resource-constrained IIoT hardware (Raspberry Pi 4). Experimental measurements covering key generation, encapsulation, decapsulation, and signature operations were obtained using a liboqs-enabled TLS 1.3 stack. The results show that PQ TLS 1.3 achieves comparable handshake latency to conventional TLS on IIoT-class gateways, with certificate size identified as the dominant overhead. These findings confirm the practicality of post-quantum authentication in IIoT systems while acknowledging limitations related to the hardware scope and simulated networking. Future work will extend validation to field deployments and additional PQC candidates.

Scientific ReportsMar 3, 202612 citations

Enhancing IoT security in the post-quantum era: a hybrid approach to protection from impersonation attacks

Adel Hassan, Isam Ishaq, Jorge Munilla

The imminent advent of quantum computing threatens the long-term security of classical public-key cryptography, creating critical challenges for resource-constrained internet of things (IoT) environments.Hybrid cryptographic frameworks combining elliptic curve cryptography (ECC) with post-quantum cryptography (PQC) primitives have emerged as a transitional solution; however, their security properties remain insufficiently validated under semi-trusted infrastructure assumptions.This paper presents a comprehensive security evaluation of a hybrid ECC-KEM authentication and key agreement framework targeting IoT deployments.Using a dual-verification methodology that integrates formal symbolic analysis with the Tamarin-Prover and practical AI-assisted testing via the APSVer tool, we identify a critical impersonation vulnerability that enables a semi-trusted third party (TTP) to reconstruct PUF-based authentication material.To mitigate this flaw, we introduce a protocol enhancement incorporating ML-DSA post-quantum digital signatures and device-isolated key derivation.Formal verification confirms that the enhanced protocol achieves mutual authentication, session key secrecy, replay resistance, and effective isolation of the TTP.Experimental performance analysis demonstrates that the proposed security improvements introduce only a 12%-15% computational overhead, preserving feasibility for constrained IoT devices.The proposed framework provides a practical, quantum-resilient authentication architecture suitable for next-generation secure IoT deployments.

International Journal of Internet Technology and Secured TransactionsJan 1, 20260 citations