Post-Quantum Security Frameworks for Internet of Things Systems: A Layered Narrative Review of Architectures, Protocols, Trust, and Emerging Challenges
Rodrigo Jara Espinoza, Yohamin Nafit Pimentel Alarcon, Angelo Rodrigo Taco Jiménez, Fabricio Martin Chavez Rodriguez
Quantum computing poses a significant threat to classical asymmetric cryptography, which is essential for ensuring confidentiality, authentication, and key exchange in contemporary digital infrastructures. Although post-quantum cryptography (PQC) provides mechanisms that resist quantum attacks, its implementation in Internet of Things (IoT) systems is challenged by constrained resources, including limitations in computation, memory, energy, latency, and bandwidth, and the heterogeneity of devices. This paper offers a comprehensive narrative review of PQC approaches applicable to IoT, systematically organizing 30 peer-reviewed studies published between 2022 and 2026 across four layers: device, communication, distributed trust, and application. Additionally, the review examines two cross-cutting dimensions, privacy and side-channel resistance. The analysis indicates a significant prevalence of lattice-based schemes, hybrid strategies, and integrations with blockchain technology, zero-knowledge proofs, federated learning, homomorphic encryption, AI, and Zero Trust architectures. Notably, key gaps remain in side-channel evaluation, migration pathways, deployment costs, and real-world validation—issues that are particularly critical given the long lifecycles of IoT devices and the ongoing threat of “harvest now, decrypt later” attacks.
Quantum computing poses a significant threat to classical asymmetric cryptography, which is essential for ensuring confidentiality, authentication, and key exchange in contemporary digital infrastructures. Although post-quantum cryptography (PQC) provides mechanisms that resist quantum attacks, its implementation in Internet of Things (IoT) systems is challenged by constrained resources, including limitations in computation, memory, energy, latency, and bandwidth, and the heterogeneity of devices. This paper offers a comprehensive narrative review of PQC approaches applicable to IoT, systematically organizing 30 peer-reviewed studies published between 2022 and 2026 across four layers: device, communication, distributed trust, and application. Additionally, the review examines two cross-cutting dimensions, privacy and side-channel resistance. The analysis indicates a significant prevalence of lattice-based schemes, hybrid strategies, and integrations with blockchain technology, zero-knowledge proofs, federated learning, homomorphic encryption, AI, and Zero Trust architectures. Notably, key gaps remain in side-channel evaluation, migration pathways, deployment costs, and real-world validation—issues that are particularly critical given the long lifecycles of IoT devices and the ongoing threat of “harvest now, decrypt later” attacks.
The rapid deployment of Internet of Things (IoT) devices across critical infrastructure’s sectors such as healthcare, transportation, and smart cities brings unprecedented security challenges; particularly as quantum computing threatens the classical cryptography. This systematic review analyzes IoT security in relation to post-quantum cryptography (PQC), highlighting vulnerabilities, evolving threat, and cryptographic countermeasures. Using the PRISMA 2020 protocol, our work employed a rigorous and reproducible search strategy, where the initial Boolean query, ((“IoT” OR “Internet of Things”) AND (“Cryptography” OR “Encryption Scheme”) AND “Quantum”), was developed and effectively customized for nine reputable databases to maximize the coverage. From an initial pool of 5,151 publications dated between 2020 and February 12, 2025, a content-based screening was conducted at the title, abstract, and full-text levels. This meticulous filtering resulted in a final corpus of 161 studies deemed relevant for in-depth analysis and synthesis. Then, we categorize and analyze PQC algorithms by vulnerabilities, suitability for resource-constrained IoT environments, performance evaluation, scalability, and quantum resilience. We also identify key limitations in implementations of current cryptographic schemes, including issues in key management and authentication; and outline major challenges such as resource constraints of IoT devices, environmental noise, quantum reversible computing, security vulnerabilities, quantum hardware constraints, and complexities in integration. To counter these threats, we propose a framework of PQC countermeasures and illustrated by a hypothetical case study of PQC adoption in a real-world IoT system. Finally, we propose future research directions in lightweight PQC, hybrid frameworks, improved key management and distribution, addressing quantum distance matters, countering quantum threats, and standardization for IoT environments.
The emergence of quantum computing seriously threatens the security of legacy cryptographic protocols in consumer electronics devices based on the Internet of Things (IoT). These are essential components of mission-critical infrastructures, such as industrial control systems, smart grids, and healthcare. In particular, this work examines how to strengthen the resistance of the IoT to classical and quantum-based cyberattacks by combining deep learning methods with post-quantum cryptography (PQC). To protect key exchange, encryption, and authentication processes in IoT-consumer devices, we will continue to use quantum-resistant cryptographic algorithms, including lattice-based, hash-based, and code-based cryptography. To provide real-time anomaly detection and response capabilities, we suggest a hybrid security framework combining PQC with deep learning-based intrusion detection systems. Our methodology ensures secure communications and data exchanges linked to quantum attacks in the future within IoT systems while leveraging continuous learning over time to allow Intrusion Detection System (IDS) models to adapt to new attack vectors. We suggest optimized algorithms for PQC solutions that are lightweight and suitable for deployment in edge computing nodes and Internet of Things devices, considering the resource-constrained IoT situations where PQC implementation would be difficult. Through comparative studies and simulations, we demonstrate how our integrated PQC-deep learning framework offers an improved IoT security solution that could safeguard vital systems in a world powered by quantum technology. The results shows the key generation time which is 12.5ms, encryption/decryption time 25.3ms, latency 18.7ms, throughput 5000 operations/sec and energy consumption 2.4mJ.
As quantum computing advances, classical public-key cryptosystems face escalating risks, driving global standardization efforts by NIST, ETSI, and ISO. This paper provides a comprehensive review of recent developments in post-quantum cryptography (PQC), focusing on lattice-based, hash-based, and multivariate approaches. We examine their security foundations, implementation challenges, and applicability across domains such as finance, blockchain, and the Internet of Things (IoT). A core contribution is the proposed Hybrid Cryptographic Framework (HCF), which combines classical and quantum-resistant primitives to enable a secure and interoperable migration path. The framework integrates hybrid key exchange, dual-signature schemes, and PQC-compatible Merkle trees, and is supported by a discrete multi-objective optimization model for selecting algorithms under real-world constraints. The paper also discusses deployment challenges, including hardware acceleration, side-channel resistance, and legacy compatibility. Real-world case studies illustrate how leading institutions are piloting PQC integration in practice. Finally, we propose a strategic roadmap for PQC adoption, incorporating adaptive triggers based on quantum capabilities and evolving threat models. By aligning cryptographic design with international standards and practical system requirements, this work offers guidance for building resilient, quantum-safe infrastructures.
The imminent arrival of quantum computing presents unprecedented challenges to Internet of Things (IoT) security, threatening to compromise the cryptographic protocols that safeguard billions of connected devices worldwide. This article examines the critical intersection of quantum computing capabilities and IoT vulnerabilities, with particular emphasis on resource-constrained devices, heterogeneous networks, and legacy system integration. This article presents a comprehensive framework for implementing quantum-resistant security measures in IoT environments, introducing a hybrid approach that combines lightweight quantum-resistant algorithms with modular architecture design. This article demonstrates traditional encryption methods like RSA and ECC remain vulnerable to quantum attacks; strategic implementation of lattice-based and hash-based cryptography can provide robust protection without overwhelming device resources. This article also addresses practical considerations for industry adoption, including development lifecycle integration, governance frameworks, and compliance requirements. Through examination of real-world implementation scenarios, this article establishes a successful quantum-resistant IoT security required for a balanced approach between immediate protective measures and long-term strategic planning, providing organizations with actionable guidelines for securing their IoT infrastructure against quantum threats.
The advent of quantum computing has precipitated an estimated attack resistant cryptography system necessitating quantum attacks. The classical asymmetric algorithms, i.e., RSA and ECC are susceptible to Shor algorithm and a transition should be made to Post-Quantum Cryptography (PQC) anymore. The novelty of this work lies in providing a unified comparative framework that analyzes PQC families through security assumptions, concrete key/ciphertext sizes, and implementation complexity an aspect not addressed collectively in prior surveys. This survey gives a general picture of the status of the design process and general evaluation of PQC accounting its application within the paradigm of the diversified networks including the IoT and 5G/6G and in the cyber-physical environment. Furthermore, this review uniquely synthesizes practical hybrid‑deployment strategies, including protocol layering, coexistence models, and backward‑compatibility mechanisms, offering actionable guidance for real‑world migration. Additionally, the manuscript contributes a prioritized list of open problems across IoT, 5G/6G, blockchain, and cyber‑physical systems, highlighting domains facing the most urgent quantum‑resilience challenges. In this paper, the authors will evaluate the most popular PQC schemes, including schemes based on lattice, code, hash, and isogeny, depending on their performance, scalability, and interoperability (with reference to the recent research). It also examines the problems of integration as implemented with respect to the computational overhead, latency and adoption of hybrid with classical cryptography. This is expounded more to the standardization of PQC by NISTs and with a focus on such algorithms as CRYSTALS-Kyber and Dilithium. The findings suggest that, hybrid PQC protocols are able to control quantum resistance and actual performance in numerous infrastructures in computing systems.
The rapid convergence of sixth-generation (6G) networks and the Internet of Things (IoT) offers enormous potential for ultra-reliable, low-latency, and massive device connectivity. However, this integration also raises security and privacy concerns, particularly in light of new threats from quantum computing that could undermine traditional cryptography. The architecture of quantum-safe IoT networks that can withstand post-quantum security threats is thoroughly discussed in this review. It addresses the challenges related to how to use blockchain technology to provide decentralized trust as well as secure transactions, how to use post-quantum cryptographic algorithms to protect data confidentiality, and the best way to use a trust management architecture to improve identity verification, authorization, and authentication in the diverse IoT environment. The paper then examines scalability considerations, resource constraints, and interoperability problems that impact safe IoT deployments in the 6G era. This work serves as a roadmap for researchers and practitioners who aim to create robust and future IoT infrastructure and then maintain their security in a post-quantum world by integrating recent research patterns, solution development, and considerations related to real-world implementation.