The advent of large-scale quantum computing poses a fundamental threat to widely deployed public-key cryptographic mechanisms, particularly in Internet of Things (IoT) systems with long operational lifetimes and limited upgrade capabilities. Narrowband Internet of Things (NB-IoT), as a representative Low-Power Wide-Area Network (LPWAN) technology, is especially vulnerable to this transition due to its strict constraints on packet size, bandwidth, and Radio-Frequency (RF) energy consumption. Although Post-Quantum Cryptography (PQC) has progressed rapidly through standardization efforts led by the National Institute of Standards and Technology (NIST), the direct and frequent application of PQC primitives in NB-IoT communication remains impractical. Large ciphertexts and digital signatures, although cryptographically sound, conflict with the fundamental design principles of LPWANs and may significantly degrade reliability, scalability, and device lifetime. This paper proposes a PQC-aware secure communication architecture for NB-IoT that reconciles long-term quantum resistance with the operational realities of constrained radio networks. Rather than treating PQC as a drop-in replacement for classical public-key cryptography, the proposed design adopts a two-plane security architecture that explicitly separates control-plane onboarding from data-plane communication. Post-quantum primitives are confined to infrequent onboarding operations, where higher overhead can be tolerated, while routine data transmission relies exclusively on lightweight symmetric authenticated encryption. Specifically, the architecture employs CRYSTALS-Kyber for post-quantum key encapsulation and CRYSTALS-Dilithium for device authentication during onboarding, selected for their standardization status and comparatively compact message sizes. After onboarding, all data traffic is protected using ChaCha20-Poly1305, combined with a key-derivation-based ratcheting mechanism that provides per-message forward secrecy without recurring PQC overhead. This design is explicitly aligned with NIST guidance on the intended use of post-quantum signatures and the constraints of LPWAN deployments. The proposed framework was implemented and evaluated on an ESP32-based NB-IoT platform with a commercial cellular module. Experimental results demonstrate that post-quantum onboarding can be completed within NB-IoT packet-size constraints with acceptable reliability, while routine data transmission incurs minimal computational, bandwidth, and energy overhead. The findings confirm that quantum-resistant security for NB-IoT is achievable only when PQC is applied selectively and system-aware, rather than uniformly across all communication phases.
The advent of large-scale quantum computing poses a fundamental threat to widely deployed public-key cryptographic mechanisms, particularly in Internet of Things (IoT) systems with long operational lifetimes and limited upgrade capabilities. Narrowband Internet of Things (NB-IoT), as a representative Low-Power Wide-Area Network (LPWAN) technology, is especially vulnerable to this transition due to its strict constraints on packet size, bandwidth, and Radio-Frequency (RF) energy consumption. Although Post-Quantum Cryptography (PQC) has progressed rapidly through standardization efforts led by the National Institute of Standards and Technology (NIST), the direct and frequent application of PQC primitives in NB-IoT communication remains impractical. Large ciphertexts and digital signatures, although cryptographically sound, conflict with the fundamental design principles of LPWANs and may significantly degrade reliability, scalability, and device lifetime. This paper proposes a PQC-aware secure communication architecture for NB-IoT that reconciles long-term quantum resistance with the operational realities of constrained radio networks. Rather than treating PQC as a drop-in replacement for classical public-key cryptography, the proposed design adopts a two-plane security architecture that explicitly separates control-plane onboarding from data-plane communication. Post-quantum primitives are confined to infrequent onboarding operations, where higher overhead can be tolerated, while routine data transmission relies exclusively on lightweight symmetric authenticated encryption. Specifically, the architecture employs CRYSTALS-Kyber for post-quantum key encapsulation and CRYSTALS-Dilithium for device authentication during onboarding, selected for their standardization status and comparatively compact message sizes. After onboarding, all data traffic is protected using ChaCha20-Poly1305, combined with a key-derivation-based ratcheting mechanism that provides per-message forward secrecy without recurring PQC overhead. This design is explicitly aligned with NIST guidance on the intended use of post-quantum signatures and the constraints of LPWAN deployments. The proposed framework was implemented and evaluated on an ESP32-based NB-IoT platform with a commercial cellular module. Experimental results demonstrate that post-quantum onboarding can be completed within NB-IoT packet-size constraints with acceptable reliability, while routine data transmission incurs minimal computational, bandwidth, and energy overhead. The findings confirm that quantum-resistant security for NB-IoT is achievable only when PQC is applied selectively and system-aware, rather than uniformly across all communication phases.
Building-Wide Virtual Private Network (VPN) systems leverage the current communication infrastructure to connect various IoT devices and management systems through encrypted tunnels. These systems are essential for protecting sensitive data and ensuring operational security but face imminent threats from quantum computers capable of breaking widely-used public key cryptography. In this paper, we propose a lightweight hybrid post-quantum security framework specifically designed for building-wide IoT VPN systems, which combines classical cryptographic primitives (e.g., ECDH) with selected post-quantum crypto (PQC) algorithms (e.g., Kyber, Dilithium). This dual-layer architecture ensures protection against both current and future quantum threats, relying on the hardness of at least one underlying cryptographic assumption for security. Furthermore, the framework incorporates lightweight design principles tailored for resource-constrained IoT environments. These principles emphasize minimal computational demands, reduced communication costs, and limited protocol complexity. Specifically, its lightweight nature reflects simplification to the VPN protocol’s operations and the selected integration of post-quantum algorithms. This optimized application of PQC simplifies the cryptographic workload for key exchange and signature, thereby balancing security guarantees with feasible deployment on IoT hardware. Our analysis and experimental results demonstrate that the proposed architecture achieves quantum resistance with manageable performance impact compared to traditional VPNs, making it a practical and scalable solution for migrating existing building management infrastructures towards post-quantum security across diverse IoT devices.
The growing interconnection of critical engineering infrastructure through IoT introduces unprecedented exposure to cyber threats. Emerging quantum computing capabilities pose a transformative risk to classical cryptographic primitives such as Rivest–Shamir–Adleman and Elliptic-Curve Cryptography, which underpin secure communication and device authentication in industrial control systems, power grids, transportation networks, and healthcare infrastructure. This paper investigates quantum-resistant encryption, often termed post-quantum cryptography (PQC), as a sustainable security paradigm for IoT communication within critical systems. By analyzing lattice-based, code-based, multivariate, and hash-based schemes, the study evaluates trade-offs between computational cost, memory footprint, and latency constraints intrinsic to resource-limited IoT nodes. A hybrid architectural framework integrating the National Institute of Standards and Technology-standardized algorithms (e.g., Cryptographic Suite for Algebraic Lattices—Kyber, Dilithium) with lightweight symmetric primitives (e.g., Ascon, GIFT block cipher in Combined Feedback mode) is proposed for secure data transmission across heterogeneous IoT layers. Experimental simulations benchmark key-exchange throughput, ciphertext expansion, and resilience against quantum-adversarial models, demonstrating up to 65% reduction in handshake latency compared to baseline lattice implementations under constrained conditions. The paper concludes with policy and engineering recommendations for the adoption of quantum-resistant IoT protocols in energy, transportation, and industrial automation sectors, highlighting alignment with global PQC migration roadmaps and IEC 62443 cybersecurity standards.
The impending advent of cryptographically relevant quantum computers threatens classical public-key primitives that underpin 5G and IoT security, including key exchange, authentication, and device onboarding. Ultra-dense networks, constrained endpoints, and long device lifetimes heighten exposure to “harvest-now, decrypt-later” risks. Mobile operators and IoT platform providers need migration ready cryptography that fits radio-access latency budgets, scales to billions of low-power nodes, and integrates cleanly with 3GPP and IETF protocols without degrading quality of service. Many post quantum options impose prohibitive bandwidth and compute costs or lack deployment guidance tuned to network slices and massive machine-type communications. We propose a lattice-based encryption and key-encapsulation framework grounded in Module-LWE/LWR assumptions. The design pairs an IND-CCA-secure KEM for control plane bootstrapping with lightweight AEAD for user-plane data, delivered through a hybrid handshake combining classical ECDH with a post-quantum KEM to ensure continuity during transition. Parameter tiers align with eMBB, URLLC, and mMTC device classes. Implementation emphasizes constant-time polynomial arithmetic, NTT-accelerated convolution, centered-binomial noise sampling, public-key compression, and stateless hash-based signatures for attestation. A gNB-assisted enrollment workflow and session-key rotation via 5G NAS/RRC are specified. Analytical modeling and prototype measurements indicate sub-millisecond encapsulation on ARM Cortex-M33 microcontrollers and ~1.5 ms on RAN baseband paths, while handshake message growth remains within existing NAS and RRC budgets. In ns-3 simulations of dense mMTC topologies, the hybrid handshake achieves >99.99% success under 1% packet loss, and energy profiling shows <5% battery impact for weekly rekeying. Security analysis demonstrates resistance to known lattice attacks at NIST Levels 3–5, forward secrecy via ephemeral KEMs, downgrade resistance through authenticated algorithm negotiation, and post compromise security with frequent rekeying.
The rapid expansion of Internet of Things (IoT) ecosystems has increased the need for communication mechanisms that can remain secure against emerging computational threats. Conventional asymmetric cryptographic schemes, including RSA and Elliptic Curve Cryptography (ECC), are vulnerable to advances in quantum computing due to the ability of Shor's algorithm to undermine their underlying mathematical assumptions. To address these challenges, this paper presents PQ-IoT SecureCom, a quantum-resistant communication framework built using NIST-standardized post-quantum cryptographic primitives. The proposed framework employs ML-KEM (derived from Kyber) for secure key encapsulation and ML-DSA (derived from Dilithium) for digital authentication, combined with AESGCM to ensure data confidentiality and integrity. Additional security mechanisms, including PQC-based device certification, periodic session key updates, and nonce-based timestamp validation, are incorporated to mitigate replay and impersonation attacks. The framework also supports a hybrid operational mode that enables performance comparison between classical and postquantum cryptographic schemes. System behavior is monitored using a real-time dashboard that records cryptographic overhead, communication metrics, and detected security events. Experimental evaluation shows that ML-KEM and ML-DSA significantly enhance security while introducing computational overhead that remains acceptable for contemporary IoT devices. Through automated attack simulations and detailed event logging, PQ-IoT SecureCom demonstrates the practical feasibility of deploying scalable post-quantum security in IoT communication systems.
The rapid advancement of quantum computing poses significant threats to classical cryptographic methods, such as Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC), which currently secure Internet of Things (IoT) and cloud communications. Post-Quantum Cryptography (PQC), particularly lattice-based schemes, has emerged as a promising alternative. CRYSTALS-Kyber, standardized by the National Institute of Standards and Technology (NIST) as ML-KEM, has shown efficiency and practicality for constrained IoT devices. Most existing research has focused on PQC within the Transport Layer Security (TLS) protocol. Consequently, a critical gap exists in understanding PQC’s performance in lightweight IoT protocols. These are Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP), particularly under adverse network conditions. To address this gap, this paper provides a systematic review of the literature on the network resilience and performance of CRYSTALS-Kyber when integrated into these protocols operating over lossy and high-latency networks. Additional challenges include non-standardized integration, resource limitations, and side-channel vulnerabilities. This review provides a structured synthesis of current knowledge, highlights unresolved trade-offs between security and efficiency, and outlines future research directions, including protocol-level optimization, lightweight signature schemes, and resilience testing of PQC-secured IoT protocols under realistic conditions.
Narrowband Internet of Things (NB-IoT) is a wireless communication technology that enables a wide range of applications, from smart cities to industrial automation. As a part of the 5G extension, NB-IoT promises to connect billions of devices with low-power and low-cost requirements. However, with the advent of quantum computers, the incoming NB-IoT era is already under threat by these devices, which might break the conventional cryptographic algorithms that can be adapted to secure NB-IoT devices on large scale. In this context, we investigate the feasibility of using post-quantum key exchange and signature algorithms for securing NB-IoT applications. We develop a realistic ns-3 environment to represent the characteristics of NB-IoT networks and analyze the usage of post-quantum algorithms to secure communication. Our findings suggest that using NIST-selected post-quantum key-exchange protocol Kyber does not introduce significant overhead, but post-quantum signature schemes can result in impractical latency times and lower throughputs