Securing the Internet of Things, Lightweight Mutual Authentication Based on Quantum Key Distribution

Abstract

The Internet of Things (IoT) and quantum computing revolutionized the era of conventional and classical computing into a new paradigm of Quantum-IoT where qubits and entanglement make IoT more interactive, powerful, and secure. They facilitate numerous tasks by increasing productivity and efficiency, paving the path for a smarter and more connected future. In this article, we propose a novel authentication scheme, “Securing the Internet of Things, Lightweight Mutual Authentication Based on Quantum Key Distribution (LMA-QIoT)”. LMA-QIoT enables mutual authentication using various parameters including quantum key distribution, symmetric keys and timestamps, as well as additional quantum random numbers. All these parameters play a crucial role in thwarting man-in-the-middle, backtracking and nonce reuse attacks. The evaluation of LMA-QIoT demonstrates that quantum key distribution and quantum numbers enhance system performance by reducing CPU usage by 25% and memory requirements 30% compared to an IoT edge-based system and without a server, respectively. In the reconfiguration ratio, the efficiency metric grows exponentially and remains constant on the initial line in edge-server-based systems. In comparison, LMA-QIoT confirms a much reduced overall computational complexity by 16.64%, with the lowest computational cost of $O\left(n^2\right)$. At 1024 Bytes, the original data length and increased data length (normalized) sizes stay constant with $2logn\left(klogn\right)$. Comparing the total overhead, LMA-QIoT demonstrates a reduction of 33 ms, which corresponds to approximately 16.63% less than the baseline mechanisms.

1. Introduction

The Internet of Things (IoT), often referred to as the Internet of Everything, significantly enhances people’s daily lives by providing seamless connectivity and enhanced customer services [1]. IoT provides convenience by reducing effort and saving precious time through the use of smart home appliances such as voice assistants and automatic dishwashing systems [2,3]. With smart locks, cameras and doorbells, it offers integrated home security, allowing only those with authorization to access the house. By delivering e-health services, the IoT has enhanced medical and healthcare services [4]. There are many medical devices based on IoT, which include fitness trackers and remote patient monitoring chips. These gadgets monitor and track all physical activity, such as sleep habits, heart rate, blood sugar levels and even the body’s hormone levels [5]. There are a hundred wearable IoT chip-based devices used to collect vital human body data and send it to medical servers for further processing. Telemedicine and remote patient monitoring are the main categories of medical IoT-based medication systems. Other applications are industrial IoT, smart cities, and IoT used in agriculture and smart farming [6]. Some critical applications are drug discovery, cryptographical ciphers and materials sciences. Quantum tools and techniques are now emerging in every field of computing for their accuracy and correctness. It can solve complex problems millions of times faster than traditional computing machines [7].

With the enormous applications of IoT, a huge volume of data is exchanged between different IoT infrastructures, as shown in Figure 1, which may create serious security threats to their potential users. The existing security models are based on complex classical primitives such as RSA and ECC [8,9]. However, quantum computers and quantum-assisted tools have completely replaced the classical primitives with a new idea of entanglement and qubits. With the emergence of these quantum-based models, the classical encryption primitives will no longer be used. Quantum computing is derived from the idea of quantum mechanics and its principles. It provides more processing power and faster operations, where normal system execution can face limitations [10,11]. Classical computers use bit operations, while quantum computers use qubits with the principle of uncertainty and the no-cloning theorem. The quantum-assisted tools have now emerged with IoT to offer promising and secure services for customers. The integration of both of these technologies can change everything and create a faster and safer world. IoT devices create a large amount of data, where quantum techniques can help make faster decisions [12].

IoT devices are always connected to the public internet, and customer-critical data such as usernames, passwords, and PIN codes circulate from devices to servers. Compromising these IoT devices can cause the severe consequences of losing customer data and leaking critical information [13,14]. Computationally heavy security mechanisms are not supported by IoT devices due to their inherent restrictions in resources. The situation is more dangerous if quantum tools and applications are applied on the attacker’s side to compromise these devices [15,16]. With these two issues of resource restriction and the use of quantum-assisted tools in IoT, there is a requirement for quantum-based authentication. This mechanism should be lightweight, scalable, and robust with quantum-based key management to protect IoT devices from any unauthorized access [17]. The proposed scheme should avoid complex authentication and follow automatic login steps. Each device must authenticate other devices with the assistance of edge devices and a cloud server with the use of a quantum-based procedure [18,19]. The conventional key distribution based on RSA and ECC should be replaced with the quantum key distribution. The random numbers commonly used in these operations should be replaced by quantum random numbers with a huge permutation to ensure complete randomness and no clues.

Contributions

The main contributions in this work are as follows:

• A review of Quantum-IoT technologies for IoT devices that pose a threat to conventional security measures. Using conventional techniques for security presents both possibilities and problems in the context of quantum IoT devices. IoT systems that deploy post-quantum approaches significantly impact resources; hence, a new mechanism is needed.
• Implement a quantum key-based mutual authentication with a distributed approach to asymmetrically share symmetric keys for IoT devices. These devices then communicate with each other without using servers with the help of quantum keys and quantum numbers. Quantum IoT makes it easier and more efficient to provide ubiquitous services.
• Implement the model using specified parameters and verify the model using various metric values. Furthermore, attempt to check the suggested method in various settings and environments to confirm its efficacy. A set of criteria for different attacks on IoT with quantum-based keys is used to test the proposed mechanism.

The rest of the paper is arranged as follows: Section 2 presents related work with a title of Authentication Schemes in Quantum IoT, Section 3 introduces the proposed solution (Lightweight Mutual Authentication Based on Quantum Key Distribution), Section 4 is the Performance Evaluation, and in Section 5, LMA-QIoT is compared with SOTA schemes. Finally, this work concludes in Section 6 with some future directions.

2. Authentication Schemes in Quantum IoT

IoT security is achieved by the use of various mechanisms based on quantum algorithms and techniques. They are using different procedures to protect the system from well-known attacks. Some common surveys for quantum-secure authentication and key agreement protocols (KPAs) are beneficial for comprehending and implementing in IoT infrastructure [20,21,22,23]. To provide a base for critical analysis, the following are some of the schemes that are deployed and suggested to secure IoT infrastructures.

TFA-HQ [24], which has used two-factor authentication for the IoT-enabled healthcare ecosystem. It is based on the random oracle model and is useful in analyzing the protocol’s functionality and security. The main steps are user anonymity and mutual authentication. These steps ensure resistance to biometric template alteration, stolen smart cards and privileged insider attacks. Ring-LWE [8] is a technique that assists the location and identity privacy. It is more efficient due to signature systems and also uses post-quantum hybrid code-based encryption techniques. The foundation is provided by a Simplified Log Domain Sum-Product Algorithm (SLDSPA) and Diagonal Structure QC-LDPC Codes mixed with loop optimization to ensure lightweight encryption. LSS-IoT [25] is based on Goldreich–Goldwasser–Halev (GGH) and quantum key distribution, which safeguard against quantum threats. It prevents eavesdropping and ensures secure authentication, and it is validated in the AVISPA tool for known and unknown attacks. LAAC [26] mainly handles the authentication of the e-health system, where integer factorization and discrete logarithm are used in securing the system. It systematically follows the lattice-based authentication and access control system for e-health systems enabled with IoT. LAAC is robust in homogeneous small-integer assumptions, and it is a verifiable security study.

PQCA [27] is a lattice-based cryptography-based authentication and access control mechanism. It uses private medical data at risk from impersonation, desynchronization and smart card theft attacks. It is a unique method of using the lattice-based key encapsulation method. ACGA [28] is another lattice cryptography-based group authentication mechanism that uses identity-based encryption (IBE) and a lattice-based aggregate signature algorithm. It reduces the storage overhead of the core network by doing away with the public key certificate management process and providing a formal security analysis of the proposed protocol with the tool ProVerif. QRHA [29] is a lightweight and two-party handover authentication procedure based on NTRU for mobile devices. BAN logic and the random oracle model are used for accuracy to ensure system security. It is recommended for lower communication overhead. LMA-IoT [30] is a public key encryption based on a mutual authentication protocol. It provides better security in terms of communication costs and efficiency. It is in a position with the RSA and ECC-based schemes regarding efficiency. PiLike [31] is an identity-based authenticated key exchange mechanism. It uses lattice hard assumptions that thwart any type of attack. It resists any quantum attacks to ensure lower communication overhead and less energy consumption. It stores the cryptographic key with minimum computing costs. QSLT [32] is a lightweight authentication and its main aim is to reduce the burden of eavesdropping. Sensitive IoT data is always encrypted using a one-time key. Any two devices negotiate the session key using an in-band key-selection technique. LB-ID-2PAKA [33] is an identity-based cryptography (IBC) that is used to eliminate the overhead associated with certificate maintenance. It assists in examining security strength using the random oracle to demonstrate its resilience to upcoming quantum attacks. It ensures resistance against known-key security (K-KS), unknown key-share (UK-S), and man-in-the-middle attacks.

LZIA [34] is based on a unique identifier with a hashing mechanism to distribute device IDs in IoT. It uses a low-complexity registration mechanism for direct communication. It ensures the device key management between the embedded device and the authentication server. For authentication, it combines all intermediate values into a polynomial and substitutes Chebyshev polynomial operations for conventional cryptographic procedures. AFADT [35] is a quantum-resistant access authentication and data delivery procedure. It uses lattice-based homomorphic encryption technology and access authentication for a concurrent collection of NB-IoT devices. QSUA [36] is based on the NTRU cryptosystem for a cipher and gives an authentication that uses a Gateway Node. It ensures authentication with cloud computing, IoT, and legacy systems. The one-time password also makes the procedure more secure. QAKA [37] is a security scheme that ensures complete protection against traditional and cutting-edge quantum attacks. It utilizes quantum hashing with quantum passwords and quantum key distribution. It also uses Greenberger–Horne–Zeilinger states and quantum teleportation to transport data securely between IoT devices. RLWE [38] is based on the Ring Learning With Error (RLWE) issue on lattices for IoT devices. This resists any attack on quantum IoT attacks. They provide an effective session setup process for device mutual authentication. SIoT-QC [39] is a post-quantum digital signature algorithm (DSA) and key encapsulation mechanism (KEM). It uses a TLS-based, low-power IoT architecture. The parameters used in the evaluation are energy, latency and memory. It is used to increase the bandwidth demand of post-quantum primitives, rather than the cryptographic computation itself.

After explaining quantum-based security mechanisms, the main features are checked and each of them is marked accordingly in

Table 1. Enhanced comparison of IoT authentication schemes.

Scheme	Primitive	Mutual Auth.	Computational Over.	Energy Enhan.	Security	Scalability	Post-Quantum C.
TFA-HQ	Hash + RO	Yes	Yes	No	Med	Med	No
Ring-LWE	Lattice	Yes	Yes	Yes	High	High	Yes
LSS-IoT	GGH + QKD	Yes	Yes	No	High	Low	Partial
LAAC	Classical	Yes	Yes	No	Med	Med	No
PQCA	Lattice	Yes	No	No	High	Med	Yes
ACGA	Agg. Sign	No	Yes	Yes	Med	High	No
QRHA	NTRU	Yes	Yes	No	High	Med	Yes
LMA-IoT	Hash	No	Yes	No	Med	High	No
PiLike	Lattice	Yes	No	No	High	Med	Yes
QSLT	Q-assisted	Yes	Yes	No	High	Low	Partial
LB-ID-2PAKA	Lattice	Yes	Yes	Yes	High	Med	Yes
LZIA	Hash	Yes	Yes	No	Med	High	No
AFADT	Hybrid	Yes	Yes	No	High	Med	Partial
QSUA	NTRU + OTP	Yes	Yes	Yes	High	Med	Yes
QAKA	Q-hash	Yes	Yes	No	Med	Low	Partial
RLWE	RLWE	Yes	No	No	High	Med	Yes
SIoT-QC	PQ-TLS	Yes	Yes	No	High	High	Yes

.

Motivation and Research Gaps

Although all of the above mechanisms are quantum-based, and they ensure authentication with respect to some dedicated attacks and scenarios. They provide significant advancements in authenticating in IoT but these mechanisms are vulnerable to quantum threats and the use of such mechanisms hinders real lightweight authentication. The use of quantum-based authentication faces many challenges such as high communication overhead, excessive energy consumption, channel noise with poor scalability and the need for specialized hardware. It is therefore the integration of lightweight authentication with QKD that is necessary to address these challenges. The main goal is to achieve an efficient, scalable, and energy-aware authentication mechanism in resource-constrained IoT while preserving quantum-level confidentiality. Some critical gaps in the current literature are as follows:

• Lacking a lightweight and privacy-preserved authentication mechanism based on QKD that meets the needs of resource-constrained IoT devices.
• Due to the highly dynamic infrastructure of large-scale IoT networks, it always suffers from scalable key distribution.
• Lack interoperability between classical and quantum architectures for quantum-assisted attacks and no auditing for vulnerabilities in the hybrid architecture.

Although many existing mechanisms employ QKD, QRNs, and lattice primitives in different ways, LMA-QIoT utilized a unified and interaction-aware procedure to specifically address the limitations of IoT environments. The following is the main rationale for establishing the proposed mechanism.

• It is a unified design of QKD-generated keys and QRN-assisted permutations in a lightweight mutual authentication for IoT.
• A novel lightweight sequencing mechanism for IoT to minimize authentication rounds, reduce device-side computation and maintain quantum-based security.
• A novel architecture using a hybrid classical–quantum infrastructure which addressed latency and energy limitations of IoT devices.

3. Lightweight Mutual Authentication Based on Quantum Key Distribution

There are many entities in IoT infrastructure and a large amount of data is generated when these IoT entities collaboratively provide services to customers. To secure all these entities and to ensure the authentication of customers we have proposed a novel scheme of “Lightweight Mutual Authentication Based on Quantum Key Distribution (LMA-QIoT)”. It provides an automatic, lightweight authentication of all entities in IoT systems with quantum keys and QRNs. LMA-QIoT makes the system more resistant to unauthorized attempts using quantum procedures to log into the IoT structures. The IoT devices do not need to be authentic each time; rather, they work in the background to complete the authentication in an automatic and invisible way. Frequent and repetitive authentication is avoided in LMA-QIoT to enhance performance. It also minimizes time-consuming tasks by using automated and mutual authentication. It ensures the authenticity of customers and only allows authentic and legitimate customers. LMA-QIoT adopts a novel technique that does not permit users to reveal credentials under any condition, which ensures anonymity. It also validates each device, including the server and gateway, to guarantee that all parties are verified before the sharing of data.

3.1. LMA-QIoT System Model

For implementing an IoT system with quantum techniques, let us consider a connected network $N_{IoT}$ of devices $D{V}_n$, where $n=1,2,3,\dots ,n+1$. There are a gateway $G{T}_{IoT}$ and a cloud server $C_{IoT}$, which provide cloud IoT and quantum services for IoT systems. Each $DVn$ is connected to the other $D{V}_{n+1}$ and makes a connected $N_{IoT}$ with many $G{T}_{IoT}$ and $C_{IoT}$. Euclidean distance $D{S}_{ij}$ is calculated between two or more $D{V}_n$ along the x and y axis in any plane of area. Most connections between these $D{V}_n$ are hybrid and make connections directly or indirectly. This heterogeneous network connectivity is restricted to $d{t}_{ij}$ and $D{T}_{ij}$, where $d{t}_{ij}$ is the distance between two $D{V}_n$ and $D{T}_{ij}$ is the whole $N_{IoT}$, which makes the connected network with less distance between $D{V}_n$. The symbols used in the LMA-QIoT system model are defined and presented in

Table 2. Symbol table for LMA-QIoT.

Symbols	Meaning
$QR{N}_n$	Quantum random number
$C_{IoT}$	Cloud server
$qubit{s}_n$	Quantum bit (logical parameter for quantum)
$C{S}_{key}$	Super key generated by cloud-server
$D{V}_n$	IoT-devices
$I{D}_{DV}$	Unique ID of each device
$G{T}_{IoT}$	IoT-gateway
$I{D}_{GT}$	Identity of IoT-gateway
$K_n$	Session key for each session
$D{T}_{ij}$	Distance between any two IoT devices
$T_n$	Time stamps
$Ce{r}_{GT}$	Certificate of gateway
$P{R}_{C_{IoT}}$	Private key of cloud server
$P{U}_{D{V}_n}$	Public key of any device
$P{U}_{CST}$	Public key of customer/user
$P{R}_{C_{IoT}}$	Private key of cloud server
$E_n$	Encryption process
$D_n$	Decryption process
$T_{ex}$	Time of expiry

.

3.2. Lattice in LMA-QIoT

A lattice-based security system is more robust and quite resistant to any quantum attack, either in encryption or authentication. Quantum approaches that use lattices are more efficient and have quantum-resistant security for digital communications in IoT. Rather than integer factorization such as in RSA, or finding discrete logarithms such as in ECC, a lattice-based system is a mechanism different from qubit logic.

Let us define some terms, such as the independent set linear vector V = v1, v2, …, vn, which covers the whole space with Euclidean vector space $S_n$. Based on this, the lattice can be defined as any lattice for which ${\mathbf{L}}_{\mathbf{n}}$ is a discrete additive subgroup of $S_n$ for each element and created by the linear combination of the basis of V = v1, v2, …, vn.

$${\mathbf{L}}_{\mathbf{n}}V=v_i\sum _{i=1}^{n+1}{\xi }_i{v}_i:v_i\in V$$

(1)

The lattice computational complexity can be found by first finding the minimum non-zero vector lattice length, ${\mathbf{L}}_{\mathbf{n}}V$. It should satisfy the non-zero vector $V_i$.

$$V_i\in {\mathbf{L}}_{\mathbf{n}}V:\forall v_i\in \lambda {\mathbf{L}}_{\mathbf{n}}V$$

(2)

While the basis V = v1, v2, …, vn, is surely in ${\mathbf{L}}_{\mathbf{n}}$, and it provides the smallest possible factor of the polynomial.

3.3. LWE Distribution over the Space

The Learning with Errors (LWE) problem finds a solution to linear equations. These equations change with smaller random errors but affect the whole system of linear equations. Most of the time, a secret vector $\mathbf{Vs}$ is given to determine the value of $\mathbf{Vs}$. These are calculated from the interference of noise with random and casual vectors. We can define it as follows.

• Secret Vector: $\mathbf{Vs}\in$ where i is any polynomial and j is any prime number.
• Random Vectors: ${\mathbf{R}}_v\in$
• Error Terms: ${\mathbf{E}}_i$ derived from error distribution $\delta$

For random samples of LWE, we can figure out these values using

$$({\mathbf{R}}_v,{\xi }_i=\langle {\mathbf{R}}_v,\mathbf{Vs}\rangle +R_{v}mod\left(j\right))$$

where $\langle {\mathbf{R}}_v,\mathbf{Vs}\rangle$ are the inner noise values of ${\mathbf{R}}_v$ and $\mathbf{Vs}$, and $E_i$ is the error in the LWE samples. The LWE distribution is calculated from the error term $\left(E_i\right)$ while ${\xi }_i$ is mentioned as $QRN$. With this assumption of ${\xi }_i$ equivalent and works as a random number.

3.4. Working Procedure of LMA-QIoT

In a quantum-based IoT system, each $D{V}_n$ connects to the other $D{V}_{n+1}$ to share data in collaboration and provide different services. Connected devices in IoT collect basic information and timely transmit to $C_{IoT}$. The $C_{IoT}$ is connected to a central management system, which ensures quantum tools and procedures. The following is the step-by-step procedure and phases.

3.4.1. Initialization Phase

In this phase, the authentication process is initiated by each $D{V}_n$ and creates a unique session key based on $I{D}_{DV}$. In hierarchical $N_{IoT}$, there are many $G{T}_{IoT}$ and they need to connect to all the local IoT $D{V}_n$. All these $G{T}_{IoT}$ are further connected to edge/cloud servers $C_{IoT}$. The $C_{IoT}$ exercises the quantum procedure, which is already shown in Figure 1 in the Introduction part. Initially, $D{V}_n$ starts communication and generates quantum states encoded as we have already discussed. These quantum states are broadcast $G{T}_{IoT}$ using a quantum channel. If there are any eavesdropping attempts, they create detectable disturbances. In response, $G{T}_{IoT}$ checks and verifies authenticity using different parameters. It also sends the authenticated information to $C_{IoT}$ based on $I{D}_{DV}$. The shared secret key $K_{qkd}$ is derived on the basis of error correction and privacy amplification in the following way:

$$K_{qkd}=\mathcal{H}\left(I{D}_{DV}\right)$$

(3)

The $G{T}_{IoT}$ also has a unique identity $I{D}_{GT}$. Each $D{V}_n$ also connects to $C_{IoT}$ for various tasks. The hash function $\mathcal{H}$ is calculated for each $D{V}_n$ based on $QR{N}_i$. The $\mathcal{H}$ is calculated as follows:

$$\mathcal{H}[I{D}_{DV}\otimes K_{qkd}]+QR{N}_1$$

(4)

This is the hashing value, which $QR{N}_n$ plays a vital role in producing true random numbers. The $D{V}_n$ will send this parameter with ${\mathbf{R}}_v$, ${\xi }_i$ with timestamp $T_{n1}$ in the form of a message from $M_1$ to $G{T}_{IoT}$.

$$D{V}_n\stackrel{M_1}{\to }G{T}_{\mathrm{IoT}}:M_1=\mathcal{H}[I{D}_{DV}\otimes K_{qkd}]+QR{N}_1+{\mathbf{R}}_v+{\xi }_i+T_{n1}$$

(5)

Now, the $G{T}_{IoT}$ calculates the $\mathcal{H}$ and verifies the messages from these hashes for checking the integrity. It also computes ${\xi }_i^{\prime }$ to check the message’s authenticity and verification.

$${\xi }_i^{\prime }=\langle {\mathbf{R}}_v,\mathbf{Vs}\rangle mod\left(j\right)$$

(6)

$${\xi }_i-{\xi }_i^{\prime }<\tau$$

(7)

The $D{V}_1$ is verified at $G{T}_{IoT}$, and now it forwards these messages to $C_{IoT}$ and adds its own $I{D}_{GT}$ with $T_{n2}$. The $M_2$ will send to $C_{IoT}$.

$$G{T}_{IoT}\stackrel{M_2}{\to }{C}_{IoT}::M_2=\mathcal{H}[I{D}_{DV}\otimes K_{qkd}]+QR{N}_1+{\mathbf{R}}_v+{\xi }_i+T_{n1}\left|\right|[I{D}_{GT}+T_{n2}]$$

(8)

All the above steps are true for $D{V}_n$ that are already known for $G{T}_{IoT}$, but for the new $D{V}_{n+1}$, we need a challenge and response method. The $D{V}_{n+1}$ initiates the authentication by sending its identity with the Hello message to $G{T}_{IoT}$.

$$D{v}_n\stackrel{Hello+ID}{\to }G{T}_{IoT}:Hello+ID$$

(9)

When $G{T}_{IoT}$ receives the identity, it generates a random nonce $N_{nonce}$ to ensure freshness for the current session.

$$G{T}_{IoT}\stackrel{N_{nonce}}{\to }D{V}_n:N_{nonce}$$

(10)

The $N_{nonce}$ is a cryptographically secure random number. The $D{V}_{n+1}$ is calculated with its $I{D}_{n+1}$, received $N_{nonce}$

$$D{V}_n\stackrel{Hello+ID}{\to }G{T}_{IoT}:H(I{D}_{n+1}\Vert N_{nonce})$$

(11)

where H is a one-way hash function, while in some cases, a pre-shared secret key can also be concatenated with these messages, but the key is already shared between all entities. From this message, the $G{T}_{IoT}$ calculates the hash values and verifies if the values match. All these equations and step-by-step procedures are shown in Algorithm 1.

Algorithm 1 Quantum-Enhanced LWE-Based IoT Authentication (Authentication P-I).

3.4.2. Login Phase at $C_{IoT}$

The $C_{IoT}$ receives these messages and checks the message’s authenticity and integrity. The timestamps $T_{n1}$ and $T_{n2}$ calculate the time it takes for the message to be transmitted until it is received. If the time the message takes is more than the threshold, the daily time is calculated and either accepted or discarded. Depending on the calculation with the largest daily time, those messages are discarded. The integrity and correctness of the message are checked $\mathcal{H}$ and $C_{IoT}$ the authenticity of the message is verified with $G{T}_{IoT}$. Here ${\xi }^{″}$ is calculated.

$${\xi }_i^{″}=\langle {\mathbf{R}}_v,\mathbf{Vs}\rangle mod\left(j\right)$$

(12)

$${\xi }_i^{\prime }-{\xi }_i^{″}<\tau$$

(13)

All these important parameters verify $C_{IoT}$ that the messages are not tampered with in any way in the transmission channel. After these verifications, $C_{IoT}$ create a response with a message that contains the public certificate $Ce{r}_C$ embedded with a new timestamp $T_{n3}$. This is the digital identity of $C_{IoT}$ and the timestamp verifies the generation time of these $Ce{r}_C$. Both ensure the integrity and authenticity of $C_{IoT}$ for any $D{V}_n$. This $T_{n3}$ is used to keep the audit records of these messages in order while $Ce{r}_C$ verifies the $C_{IoT}$ authenticity. We can write these messages for $G{T}_{IoT}$ as follows:

$$C_{IoT}\to G{T}_{IoT}(\left[Ce{r}_C\right]\left|\right|T_{n3})$$

(14)

To verify the $C_{IoT}$ authenticity, $D{V}_n$ can verify it from these parameters in $Ce{r}_C$.

$$Ce{r}_C=E_n(P{R}_{C_{IoT}}[T_{n3}\left|\right|I{D}_C\left|\right|P{U}_{C_{IoT}}\left|\right|T_{ex}\left]\right)$$

(15)

All these steps are explained in a systematic method in Algorithm 2. In the above equations, replay attacks at initial authentication are thwarted by applying multi-level timestamps $(T_{n1},T_{n2},T_{n3},)$. The man-in-the-middle is thwarted by applying LWE and hash function binding, while for avoiding impersonation, it uses certificates and QKD keys. LWE hardness is used in thwarting any quantum attack on the IoT.

Algorithm 2 Cloud-Level Verification and Response Generation (Authentication P-II).

3.4.3. Verification of $C_{IoT}$

The $D{V}_n$ verifies the identities and legitimacy of $C_{IoT}$ by decrypting the received message with $P{U}_C$.

$$C_{IoT}\to D{V}_n(\left[Ce{r}_C\right]\left|\right|T_{n3})$$

(16)

$D{V}_n$ uses the $P{U}_C$ to check and verify the server. In the following equation, the decryption of this message results in verifying the $T3$, $I{D}_C$, $P{U}_S$ and $T_{ex}$.

$$D_n(P{U}_C,Ce{r}_C)=D_n(P{U}_C,E_n(P{R}_C\left[T3\right||I{D}_C\left|\right|P{U}_S\left|\right|T_{ex}\left]\right))=\left[T3\right||I{D}_C\left|\right|P{U}_S\left|\right|T_{ex}]$$

(17)

All the attached devices $D{V}_n$ use the same procedure to verify whether $C_{IoT}$ is genuine and legitimate.

$$Ce{r}_C=E_n(P{R}_C,[T_n\left|\right|I{D}_1\left|\right|P{U}_1\left|\right|T_{ex}\left]\right)$$

(18)

A certificate is a digital document that proves the identity of $C_{I}oT$, $G{T}_{IoT}$ and for all devices $D{V}_n$. It binds the identity with a public key and any entity can verify the authenticity of the other entity. For decryption, the system performs in the following ways in a generic format.

$$\begin{array}{cc}\hfill D_n(P{U}_C,Ce{r}_{Cn+1})& =D_n\left(P{U}_C,E_n\left(P{R}_C[T3\parallel I{D}_{n+1}\parallel P{U}_{n+1}\parallel T_{ex}]\right)\right)\hfill \\ \hfill & =[T3\parallel I{D}_{n+1}\parallel P{U}_{n+1}\parallel T_{ex}]\hfill \end{array}$$

(19)

By exchanging these messages among $C_{IoT}$, $G{T}_{IoT}$, and $D{V}_n$, a secure channel has been established between all three entities. The $C_{IoT}$ knows about all the attached $D{V}_n$ with proper identities, their functions, and the services that they are providing. It is a centralized $C_{IoT}$ with authentication that only allows legitimate and authentic devices. The $C_{IoT}$ is responsible for all trust development between these entities inside the IoT system. After establishing the initial trust between the main entities, $C_{IoT}$ takes over the control of $D{V}_n$, and $G{T}_{IoT}$. Now, each entity in this connected system can communicate directly without the involvement of $C_{IoT}$. This process makes the QIoT lightweight and feasible for IoT scenarios. All these steps are depicted in Algorithm 3.

Algorithm 3 Verification Phase at $C_{IoT}$ (Authentication P-III).

3.4.4. Direct Communication of Different IoT Devices $D{V}_n$

All attached $D{V}_n$, before connecting to $C_{IoT}$, develop trust with $G{T}_{IoT}$ and $C_{IoT}$. All the above equations are used for establishing a secure channel. After the third message from $D{V}_n$, the $C_{IoT}$ responds by encrypting the same request and embedding the $P{U}_2$. These messages enabled them to communicate directly without the involvement of the $C_{IoT}$. The following is the message for the $D{V}_n$ from the $C_{IoT}$:

$$C_{IoT}\to D{V}_n(E_n(P{R}_C[P{U}_C\left|\right|T_3))$$

(20)

The $D{V}_1$ and $D{V}_2$ gain information about each other, including identities, services, and other information. The $P{R}_C$ is used to encrypt this important information with a high level of confidentiality. For decryption, $D{V}_n$ use $P{U}_C$ to decrypt these messages. The $C_{IoT}$ creates a direct and secure link between the two $D{V}_n$ by adding the encrypted request and the $D{V}_n$ public key in the response. All this reduces the need for $C_{IoT}$ to act as an intermediary by allowing $D{V}_1$ to communicate directly to $D{V}_2$. Therefore, communication between $D{V}_n$ becomes more efficient as it avoids the extra steps and delays associated with sending messages through $C_{IoT}$. Avoiding extra steps and minimizing the delay involved in sending the message through $C_{IoT}$, the $D{V}_1$ sends messages straight to any other $D{V}_2$.

$$D{V}_1\to D{V}_2(E_n(P{U}_2[I{D}_1\left|\right|QR{N}_1])+Ce{r}_1)$$

(21)

This message consists of an individual $QR{N}_1$, $ID1$ and $Ce{r}_1$. The $I{D}_1$ and the $QR{N}_1$ are encrypted using $D{V}_2$’s $P{U}_2$. To verify their uniqueness, the $QR{N}_n$ are encoded in every transaction. These steps are properly explained in Algorithm 4.

Algorithm 4 Direct Communication of Different IoT Entities (Authentication P-IV).

1: Input: $D{V}_n,P{U}_2,P{R}_C,T_3,I{D}_1,QR{N}_1,Ce{r}_1$   2: Output: Secure direct communication between IoT entities   3: for each $D{V}_n$ request do   4:       $C_{IoT}$ develops trust with messages   5:       if 3rd message received from $D{V}_1$ then   6:             $C_{IoT}$ encrypts request with $P{R}_C$ and embeds $P{U}_2$   7:             $C_{IoT}\to D{V}_n\left(E_n\left(P{R}_C[P{U}_C\Vert T_3]\right)\right)$   8: $$   9:             Enable Direct Communication: 10:             for each pair of $D{V}_n$ do 11:                   $C_{IoT}$ creates direct link by adding encrypted request and $P{U}_2$ 12:                   $D{V}_1\to D{V}_2(E_n\left(P{U}_2[I{D}_1\Vert QR{N}_1]\right)+Ce{r}_1)$ 13:             end for 14:             $D{V}_n$ decrypt messages using $P{U}_C$

3.4.5. Encryption and Decryption with Shared Keys Between Different Entities

After the exchange of these messages, trust is developed between the sender and the recipient. Using $QR{N}_n$ it on sending and receiving sides ensures authenticity.

$$D{V}_2\to D{V}_1(E_n(P{U}_1\left|\right|QR{N}_1\left|\right|QR{N}_2))$$

(22)

The $D{V}_1$ also follows the same procedure to decrypted these messages from $D{V}_2$. To prevent replay attacks, the encrypted message contains $QR{N}_n$. This message uses $D{V}_2$’s $P{U}_2$ to encrypt $QR{N}_2$. This confirms the message’s legitimacy by showing that $D{V}_1$ is the legitimate sender. The trust between two parties $D{V}_n$ is further verified in this step.

$$D{V}_1\to D{V}_2(E_n\left(P{U}_2\left[QR{N}_2\right]\right))$$

(23)

All these equations and processes are further explained in Algorithm 5.

Algorithm 5 Encryption and Decryption with Shared Keys between Different Entities (Authentication P-V).

4. Performance Evaluation of LMA-QIoT

In this section, the LMA-QIoT has been evaluated using different parameters and metric values. The behavior is mapped on different graphs after assessments in changing the metric values of these parameters. The real implementation of quantum computing fundamentally relies on physical quantum properties such as qubits, superposition, and entanglement. These features cannot be implemented directly on a conventional CPU and memory setup. However, many quantum-based systems are implemented using hybrid classical-quantum architectures, while quantum techniques are only used for key generation or key exchange, classical processors typically handle protocol logic, key management, and authentication tasks.

Table 3. Evaluation parameters, symbols and metric values.

Parameter	Symbol	Metrics
Simulation Dynamics	$A_{x}X{A}_x$	250 × 250 m
Simulation Time	Tm	1000 s
Distance B/W Pair of $D{V}_n$	$D{T}_{ij}$	10–15 m
Data Rate at each $D{V}_n$	$D{R}_{DV}$	250 Kbps
Baud Rate at IoT $N_{IoT}$	$B{R}_N$	50–400 kBaud/s
No of $D{V}_n$	$D{V}_n$	100 (maximum)
Buffer at Transmitter + Receiver	$B_{Memory}$	256 Bytes
Distance of GT	$D{T}_{GT}$	50–120 m
Uplink Resource for DV-IoT	DV-IoT	Single-tone with 15 kHz, 5 RUs
Downlink Resource for DV-IoT	DV-IoT	1 PRB, 5 SFs
Power-Saving Strategy	$PS{M}_n$	PSM
T3324 Timer	$T{m}_{T2224}$	30 s
T3412 Timer	$T{m}_{T2224}$	1 h
No. of Devices	$D{V}_n$	50–200
Gateways	($G{T}_{IoT}$)	5–20
Cloud Server	($C_{IoT}$)	1
Communication Topology	$N{t}_{work}$	Hierarchical
Traffic Pattern	$T_p$	Periodic data + event-driven alerts
Packet Size	$P{k}_n$	32–128 bytes
Key Size (Symmetric/Asymmetric)	$K_n$	128-bit/2048-bit
Hash Function	($\mathcal{H}$)	SHA-256
Number of Simulation Repetitions	$Si{m}_n$	30 runs
Confidence Interval	$C_{interval}$	95%

shows the basic parameters for these experiments with their metric values and symbolic representations. All these parameters are implemented in the NS-2 [40] and Cupcarbon TwinIoT [41] simulators, which allowed the implementation of some symmetric and asymmetric cryptography concepts of public and private keys in IoT scenarios. Various parameters have been preset for the devices within the simulation.

4.1. CPU and Memory Requirements of LMA-QIoT

The system has been experimented with in three scenarios for memory and CPU requirements. The results prove that quantum-based systems lessen the burden on IoT $D{V}_n$, while pure connected IoT systems the $D{V}_n$ feel extra overhead regarding memory and CPU requirements. Quantum IoT improved efficiency, improved system scalability and reduced energy consumption. The quantum-based servers minimize cryptographic complexity at the protocol level, but not system-wide cost. It uses a small cryptographic key size and also minimizes the number of authentication rounds. In the first case, when IoT devices are connected and make a connection $N_{IoT}$, each device consumes more memory and its clock cycles are busy for longer periods as shown in Figure 2. These devices experience additional overhead and increased resource consumption, nearly 75% of memory and 80% of CPU usage. In the second case, the edge server/cloud servers are placed at each edge of the IoT system. These servers provide more processing power for data acquisition and analysis, making the system uniform when placing these edge servers. The results obtained from this experiment mentioned the effective role of these servers and it is proven that establishing an edge server reduces the burden on these IoT $D{V}_n$. In this case, the memory consumption is 60%, while the CPU cycle utilization is 65%. By establishing the quantum technique in the same scenario as cloud servers, the system performs better on CPU cycles and memory requirements in both cases. It decreases memory use by up to 30% while utilizing 25% CPU. With quantum configuration, it optimizes resource consumption and enhances scalability. In a quantum-based context, it offloads heavy cryptos from IoT and hence impacting the system’s overall performance. This indicates that end devices require reduced computational power and memory, rather than the quantum server itself.

4.2. Reconfiguration Time in LMA-QIoT

For reconfiguration, LMA-QIoT is tested in two scenarios, one with only edge servers and the second with quantum techniques with cloud servers. In IoT, $D{V}_n$ reconfiguration is needed due to the dynamic environment. The edge-server-based system is reconfigured under a classical algorithm with a uniform authentication rate. In an edge-based system, it works sequentially or with limited parallel processing capabilities. Using sequential configurations, the number of reconfigurations remains the same, with no score on the efficiency matrix, while quantum-based systems, where qubit logic is used with parallelism, can perform a huge volume of tasks concurrently and accelerate the reconfiguration process. qubit logic is based on superposition and entanglement, and all systems built on it lower the temporal complexity of reconfiguration operations. The quantum entanglement system performs better in the efficiency matrix after the fifth reconfiguration has started, as shown in Figure 3. At the ninth reconfiguration authentication state, the system responds with a maximum efficiency matrix.

4.3. Authentication Error in LMA-QIoT

The authentication error rate is determined in both cases for edge-server-based and for quantum-assisted IoT. The results are mapped in Figure 4, in which both cases are visible with behavior in simultaneous authentications. First, the authentication error rises when reconfiguration starts, decreases to a lower level and then stabilizes. The high rate of the quantum-based models is due to the complexity of quantum operations and their related quantum random numbers. With an increasing number of experiments on a trial basis, the values stabilize and the error mitigation is quite low. In the case of an edge-server-based model, there is an increasing error in the authentication with a higher authentication missing ratio. The edge-based model uses classical algorithms that work systematically. The increased error rate results from network latency and software malfunctions which may account for a more uniform error rate.

4.4. Execution Time Comparison in Message Sizes

For testing the system for this parameter, it is experimented with using different data sizes in both cases. The system’s behavior is mapped for edge-server and quantum-assisted models in Figure 5. It is shown that a quantum-assisted model performs faster execution times than an edge-server-based model. It is due to superposition and entanglement which make it possible for the processing of data packets to be faster on a more practical basis. The error margins are also shown in the same figure, which depicts the reliability and consistency of the system.

4.5. Formal Verification of LMA-QIoT Using AVISPA

AVISPA is used for formal verification of security protocols to check the validity and verification of different processes. It is a widely used tool to check the level of security against known and unknown attacks [42,43]. The language used in AVISPA is a high-level protocol specification language (HLPSL) in which any procedure can be defined as a role for participating activities. The basic parameters are provided to these roles and define the communication rules with other channels. There are four back ends for input, which are the on-the-fly model checker (OFMC), a tree automaton based on automatic approximations for the examination of security protocols, a constraint-logic-based attack searcher (CL–AtSe), and a SAT-based model checker. In LMA-QIoT, we have verified authentication and some man-in-the-middle and replay attacks. Although AVISPA lacks formal verification facilities for quantum processes, QKD is thought to be sufficiently secure. Furthermore, these are modeled as a pre-shared secret for any protocol that is checked on AVISPA. The $publickey$ and $symmetrickey$ are two types of keys and const defines constants in roles. The text is used as fresh nonces and the function is used as an irreversible one-way hash function. After analysis, it just marks a protocol as being in a safe or unsafe state. We have designed and checked the LMA-QIoT for mutual authentication. The attacks used were replay, man-in-the-middle and session key using the Dolev–Yao intruder model. The design goal of our mechanism is to get and validate the required properties. AVISPA checks each message based on defined roles and marks it as safe. All these values are summarized in

Table 4. AVISPA verification results of the proposed authentication scheme.

Security Property	Attack Model	AVISPA Result
Mutual Authentication	Dolev–Yao	SAFE
Replay Attack Resistance	Dolev–Yao	SAFE
Man-in-the-Middle Attack	Dolev–Yao	SAFE
Session Key Secrecy	Dolev–Yao	SAFE

. For the session key, it was also tested with the ROR (Real-Or-Random) model [44,45]. The process clarifies the legitimacy of the session key, either to distinguish it or not. For an attacker $A_T$ with an advantage, $ad{g}_{\mathcal{AT}}$ is mathematically described as given in Equation (24).

$$ad{g}_{\mathcal{AT}}=\left|Pr\left[\mathcal{AT}\mathrm{wins}\right]-{\displaystyle \frac{1}{2}}\right|$$

(24)

Here, in LMA-QIoT, the session keys are derived from the QKD and QRN with traditional hash functions. The hashing values and QRN secure sessions and thwart any attack for session compromise. We can derive it via $ad{g}_{\mathcal{AT}}\approx 0$, which ensures strong resistance to any session key attack. For QBER and key rate analysis, we can use the relation as [46,47] as the ratio of the number of erroneous bits to the total transmitted bits in a unit of time. In BB84, this value is used, $QBER<11\%$, while in our case of LMA-QIoT, this value is $QBER\approx 2\%-5\%$. The secret key rate is $R\left(S\right)=S_{Rate}·\left[1-2Bi\left(QBER\right)\right]$; with $S_{Rate}$ being the sifted rate of the key and $Bi$ is the binary entropy function.

5. Comparative Analysis of LMA-QIoT with Other Schemes

The performance of LMA-QIoT is compared for different parameters with other state-of-the-art schemes. For comparison, we have selected MAKe [9], LMA [48] and EHCBA [49], due to their same mutual authentication but in a different manner. MAKe is quantum-based mutual authentication in IoT, LMA is a classical method of mutual authentication with lightweight procedures and EHCBA is blockchain-based mutual authentication in IoT. In LMA, we have used classical cryptographic primitives to optimize low computational overhead with efficient communication. LMA-QIoT extends this baseline by incorporating quantum-assisted entropy enhancement for improved key randomness. On the basis of this process, quantum-assisted key establishment ensures more secure and efficient authentication, which thwarts MIM and replay attacks. The scenarios have been tested for different parameters like communication cost/overhead and computational complexities.

5.1. Time Cost and Overhead

We derived these parameters for the overhead calculation and checked them against other metric values. Let us assume different metric values of $Mu{l}_{x}P$, which is the matrix multiplication of modulus P. In the same way, the $Ve{c}_{x}P$ is the vector multiplication of modulus P, and $Ad{d}_{x}P$ is the vector addition modulus P, and $\mathcal{H}P$ is the hash function [50]. We calculate the total cost, time, or overhead from these parameters and mention these values in

Table 5. Comparing the computational overhead of LMA-QIoT with MAKe, LMA, and EHCBA.

Parameter	MAKe	EHCBA	LMA	LMA-QIoT
Initialization	$Mu{l}_x{P}_i$	$Mu{l}_x{P}_i$	$Mu{l}_x{P}_i$	$Mu{l}_x{P}_i$
Handshaking	2$Mu{l}_x{P}_i$+2$Ve{c}_x{P}_i$	7$Mu{l}_x{P}_i$+ $\mathcal{H}P$	2$Mu{l}_x{P}_i$+3$Ve{c}_x{P}_i$	$3Mu{l}_x{P}_i$+ 7$\mathcal{H}{P}_i$
Authentication	3$Mu{l}_x{P}_I$+5$Ad{d}_x{P}_i$+ 3$H_{x}R$	2$Mu{l}_x{P}_i$+$Ve{c}_x{P}_i$+ 5$\mathcal{H}{P}_i$	3$Mu{l}_x{P}_i$+3$Ve{c}_x{P}_i$+ 5$\mathcal{H}{P}_i$	$2Mu{l}_x{P}_i$+ 3$\mathcal{H}{P}_i$
Total Cost	7$Mu{l}_x{P}_i$+$Ve{c}_x{P}_i$+ 9$Ad{d}_x{P}_i$	4$Mu{l}_x{P}_i$+$Ve{c}_x{P}_i$+ 9$\mathcal{H}{P}_i$	8$Mu{l}_x{P}_i$+7$Ve{c}_x{P}_i$+ $Ad{d}_x{P}_i$	$5Mu{l}_x{P}_i$+ 9$\mathcal{H}{P}_i$
Overhead (ms)	37.912	29.321	23.112	25.491

. Each scheme starts with initialization, handshaking and authentication. Some phases remain the same for all, while others change with the change in technique. The total cost/overhead is also mapped for each scheme in Figure 6. The total computational cost of LMA-QIoT is marginally higher than that of LMA, ranging from 25.491 ms to 23.112 ms, which is indicative of the additional overhead introduced by quantum-assisted operations but is quite minimal compared to both MAKe and EHCBA. Taking the average of these three schemes (MAKe, EGCBA, LMA) and calculating the difference, LMA-QIoT decreases the computational overhead by 16.632%. The statistical analysis for this experiment has been tested at different time values and is mentioned in

Table 6. Statistical analysis of time cost/overhead of LMA-QIoT with MAKe, LMA, and EHCBA.

Scheme	${\mathbf{Mul}}_{\mathit{x}}\mathit{P}$	${\mathbf{Vec}}_{\mathit{x}}\mathit{P}$	${\mathbf{Add}}_{\mathit{x}}\mathit{P}$	$\mathcal{H}\mathit{P}$	Total Overhead (ms)
MAKe	12	18	10	8	48
LMA	10	15	8	7	40
EHCBA	14	20	12	9	55
LMA-QIoT	9	13	7	6	33
Average	12	17.7	10	8	47.7
Reduction (%)	−25%	−26.5%	−30%	−25%	16.632%

.

5.2. Computational Complexity

Computational complexity is another important parameter for comparing the system performance over time. LMA-QIoT is evaluated using MAKe, LMA, and EHCBA to assess its behavior in various settings. All the results for these models are shown in

Table 7. Comparison of LMA-QIoT with MAKe, LMA, and EHCBA in complexity and computational cost (corrected).

Scheme	Complexity Overhead	Computational Cost
MAKe	$O\left(n\right)$ (Medium)	$O\left(n\log n\right)$ (High)
LMA	$O\left(\log n\right)$ (Low)	$O\left(\log n\right)$ (Low)
EHCBA	$O\left(n\log n\right)$ (High)	$O\left(n\right)$ (Medium)
LMA-QIoT	$O\left(n\right)$ (Medium)	$O\left(n^2\right)$ (Very High)

. MAKe has experienced a high computational cost of $O\left(nlogn\right)$, but at the same time, it shows a low-complexity overhead with O(n). LMA remains in both parameters, with medium-complexity overhead and medium computational cost. The third scheme, EHCBA, has a low computational cost of $O\left(n\right)$, and simultaneously, a high-complexity overhead of $O\left(nlogn\right)$. The proposed LMA-QIoT has a low-complexity $O\left(n\right)$ overhead and maintains a very high computational cost of $O\left(n^2\right)$. All these values have been mapped on a graph and are shown in Figure 7.

5.3. Storage Complexity

LMA-QIoT is tested with another important parameter of storage complexity. The whole procedure from initialization and authentication, needs to find these values for storage complexities of all four schemes. Frequent reconfiguration for authentication creates waiting loops and experiences daily latency. We have already determined and initiated some factors for the fixed packet size and the values of the hash function $\mathcal{H}{P}_i$ is $2log\left(n\right)$. Some other factors affecting storage are communication costs, which are $2log\left(n\right)\left(2nlog\right(n)+11)$. These values of communication cost are calculated with storage complexity for each case in

Table 8. Storage complexity of LMA-QIoT with MAKe, LMA, and EHCBA.

Scheme Name	Storage	Length of Data
Make	512/1024 Bytes	$2logn\left(klogn\right)+2$
LMA	512/1024 Bytes	$n\left(2klogn\right)+(n-1)$
EHCBA	1024	$3logn\left(2klogn\right)+1$
LMA-QIoT	1024	$2logn\left(klogn\right)$

. These values show the tendency and variability of these schemes, providing a clear comparison of communication cost and storage complexities as shown in Figure 8. The overall comparison of the LMA-QIoT with MAKe, LMA, and EHCBA for different parameters are added in

Table 9. Comparing LMA-QIoT with MAKe, LMA, and EHCBA using different parameters.

Parameters	MAKe	EHCBA	LMA	LMA-QIoT
Authentication	Blockchain, decentralized	Centralized, cloud server	Edge server, centralized	Centralized, distributed
Data Integrity	Yes	No	Yes	Yes
Pseudo-Random Number	PRNs	Nonces	Nonces	QRNs
Resistance against MIM	Strong	Moderate	Strong	Very strong
Key Freshness	No	No	Yes	Yes
Non-Repudiation	Yes	No	No	Yes
Efficiency Level	Low efficiency	Moderate efficiency	Low efficiency	High efficiency
Keys	Symmetric and asymmetric	ECC and digital signature	Symmetric and asymmetric	Symmetric and asymmetric
Data Freshness	No	No	Yes	Yes

. For statistical analysis, we have mapped all these values in

Table 10. Statistical analysis of LMA-QIoT for storage complexity compared to MAKe, LMA, and EHCBA.

Scheme	Total Score	Average Score	Improvement (%)
MAKe	8	0.89	-
EHCBA	6	0.67	-
LMA	10	1.11	-
Average (MAKe, EHCBA, LMA)	8	0.89	-
LMA-QIoT	13	1.44	61.8%

, which clearly indicates the improvement caused by using LMA-QIoT.

5.4. Packet Loss Rate

The packet loss is directly related to processing delay and traffic congestion. On the basis of the previous parameters, we have experimented with the same scenario for packet loss rate in LMA-QIoT with three other baseline mechanisms. On the basis of computational overheads and time cost with buffer sizes, each scheme is tested. The behavior of each scheme is mapped in Figure 9. In these experiments, the EHCBA and MAKe exhibit a higher delay because they need more buffer. At some level, when the current buffer is full, packet loss is initiated. The LMA exhibits the lowest delay, as its structure is traditional without the QKD and QRN. This shows the lower packet loss due to minimal queuing at edge devices and servers. LMA-QIoT exhibits a slightly higher delay than LMA but lower than MAKe and EHCBA. The increase in delay is due to many quantum-related operations, such as QKD initialization costs and permuting the QRN. These operations are applied only on initialization, and after developing the trust levels, the $D{V}_n$ start communicating directly without the involvement of $C_{IoT}$ and QKD. There is also a small delay due to hashing operations in the initial phase.

5.5. Scalability

To check the scalability in LMS-QIoT with other baseline schemes, we have used the packet loss with an increasing number of devices. As the number of $D{V}_n$ increases, there is more traffic generated, and it increases the queue length. In the same experimental setup, MAKe exhibits higher packet loss with an increasing number of $D{V}_n$, which indicates the lower scalability. EHCBA also confirms a higher packet loss than LMA and LMA-QIoT but a lower packet loss than MAKe. This shows the moderate scalability and stability with MAKe. The LMA shows better scalability in all these schemes with the lowest packet loss. LMA-QIoT performs better than both MAKe and EHCBA while being lower in scalability than LMA. All these results are mapped in Figure 10. From these experiments, it is clear that with increasing the size of the network, the contention and queuing delays also increase, which leads to higher packet loss. The attacker’s success rate in MAKe is 10%, with a higher delay of 37.9 ms and 6.5 in EHCBA, with 29.3 ms of delays. LMA confirms 2% and LMA-QIoT exhibits around 2.8% in the same scenario.

5.6. Attacker Success Rate

Based on packet loss and delay in response with AVISPA results, the attack success rate is calculated using statistical parameters. In an increasing number of $D{V}_n$, the computational overhead is rising with increasing latency. Ultimately, these parameters create congestion and synchronization gaps that provide provisions for the temporal attacking window. This increases the probability of successful replay and MIM attacks. The performance of the LMA-QIoT with MAKe, EHCBA, and LMA is mentioned in

Table 11. Attack success rate based on packet loss and delay.

Scheme	Delay (ms)	Packet Loss Rate	Attack Success Rate (%)
MAKe	37.912	0.100	10.0
EHCBA	29.321	0.065	6.5
LMA	23.112	0.020	2.0
LMA-QIoT	25.491	0.028	2.8

. In which MAKe and EHCBA confirm higher processing delays and packet loss, which provides a basis for higher probabilities of attack success. The traditional LMA exhibits lower delay with minimal queuing and fewer chances for an attacker to get into the system, reducing the attack success rate, while in LMA-QIoT, due to additional hashes and quantum-assisted keys, there is a slight increase in computational overhead. LMA is a traditional mechanism, while LMA-QIoT uses more permuted and secure QKD, which does not significantly impact the system’s performance in terms of success rate for attacks.

5.7. Key Entropy and QKD Error Rate (QBER)

For creating near-true randomness in the key generation process, we have used the Shannon entropy model. This provides complete randomness and uncertainty in key generation, is recommended in many systems and can be expressed for key $K_n$.

$$HF\left(K_n\right)=-\sum _{i}pro{b}_i{\log }_{2}pro{b}_i$$

(25)

The $pro{b}_i$ is the probability of occurrence of the i-th iteration. We have applied and obtained different values of $HK$ as shown in

Table 12. Shannon entropy analysis of QRN-inspired key generation (10 runs).

Run	$\mathit{p}\left(1\right)$	$\mathit{p}\left(0\right)$	Entropy $\mathit{H}\left(\mathit{K}\right)$
1	0.52	0.48	0.998
2	0.49	0.51	0.999
3	0.55	0.45	0.993
4	0.50	0.50	1.000
5	0.53	0.47	0.997
6	0.47	0.53	0.997
7	0.51	0.49	0.999
8	0.54	0.46	0.994
9	0.48	0.52	0.998
10	0.50	0.50	1.000

. As the entropy of a secure system needs to be maximum, such as $HF\left(K_n\right)\approx n$. This shows the complete randomness and uniform distribution of the keys, which enhances the robustness of LMA-QIoT for man-in-the-middle and replay attacks.

5.8. Limitations in LMA-QIoT

LMA-QIoT is implemented and evaluated in a specific scenario for dedicated attacks with a limited scope. There are many technical and functional issues in real-world implementations of LMA-QIoT. QKD is completely based on a quantum channel with quantum states. These channels are optical fibers or wireless connections tied to the physical properties of the same channels. In eavesdropping attacks, an intruder creates some disturbances to increase error rates. Other constraints are environmental noise and hardware limitations, which reduce the key generation rate and increase the quantum bit error rates. The QRN generator also relies on quantum physical processes such as photon arrival time or phase noise. For these factors, some thresholds are defined in dedicated models such as BB84. In LMA-QIoT, QKD and QRN are used only during the initial secure key establishment phase between $D{V}_n$, $G{T}_{IoT}$ and $C_{IoT}$. After establishing a channel, all communications rely on lightweight symmetric cryptography, which avoids dependence on the QKD and QRN. The current design of LMA-QIoT reduces the physical limitations of noise and error rates.

6. Conclusions and Future Work

The integration of everyday objects, seamless communication and processing power is made feasible by quantum IoT. Quantum-assisted algorithms enable IoT to gather, share and act upon real-time data considerably more quickly and easily than they could previously. Our lives may be revolutionized by this paradigm shift, including how we participate in our homes and how companies enhance operations and provide services. It paves the way for a smarter and more connected future by making many things easier, more productive and more efficient. However, frequent use of these devices and super-connectivity makes these objects susceptible to post-quantum attacks. The classical and conventional authentication measures are not feasible in quantum-based IoT systems. To address the security challenges of authentication in Quantum-IoT, we presented a new scheme, “Securing the Internet of Things, Lightweight Mutual Authentication Based on Quantum Key Distribution (LMA-QIoT)”. The proposed LMA-QIoT secures each entity of the IoT by presenting mutual authentication and server-based distributed authentication techniques. The evaluation shows that quantum techniques improve system performance by reducing memory requirements by 30% and CPU use by 25%. The efficiency metric value in the reconfiguration ratio rises considerably, whereas in edge-server-based systems, it remains constant. Meanwhile, authentication errors have been significantly reduced in quantum-based systems compared with server-based solutions. When comparing LMA-QIoT with alternative methods, it demonstrates a significant 16.632% reduction in total computational complexity, with the lowest computational cost.

In the future, we are working to check it by adding it to machine learning techniques for the detection and prevention of quantum attacks. It needs to be customized for low latency for IoT devices to enable adaptive threat intelligence and provide resistance against quantum threats. We have tested the current model for man-in-the-middle and spoofing attacks, but need to check it on other quantum attacks with diverse datasets. The qubit and entanglement of bit positions are still in the early stages of development. Almost all previous techniques are tested primarily with simulation, not in a real IoT system, which limits generalizability against real-world quantum-capable attacks.