Secure Data Transmission and Privacy-Preserving Path Control for Distributed IoT Based on SDN and Mathematical Optimization

PQ-AuthV: Post-Quantum Secure Authentication With Aggregated Signatures in IoT-Enabled Smart Vehicle Networks

LPP-GKM: a lightweight and privacy-preserving group key management scheme to enhance security in the internet of things

The rapid proliferation of the Internet of Things (IoT) has enabled large-scale connectivity among heterogeneous and resource-constrained devices. Although this connectivity supports applications in healthcare, transportation, industrial automation, and cyber–physical systems, it also increases the difficulty of providing secure, efficient, and privacy-preserving group communication. Conventional group key management (GKM) schemes may impose substantial rekeying, communication, and credential-management overhead, while static identifiers or public credentials can expose devices to identity tracing and session linkage. This paper presents Lightweight and Privacy-Preserving Group Key Management (LPP-GKM), a group key management scheme for dynamic IoT groups. The revised design combines pseudonym-based ECC mutual authentication, transcript-bound session-key establishment, hierarchy-based encrypted rekeying, and controlled pseudonym refresh. During normal authentication, a device sends its current pseudonym, an ephemeral ECC point, and freshness information without transmitting its stable public key. The trusted Group Manager (GM) resolves the corresponding public key internally from a protected registration record and establishes an authenticated device–GM session key. For membership changes, LPP-GKM uses a balanced symmetric key hierarchy. The GM refreshes the affected keys from the changed member leaf to the root and encrypts replacement keys under keys held only by authorized sibling subtrees. Consequently, a revoked device may record public rekey-update messages but cannot decrypt the replacement hierarchy keys required to derive the new group key. The design requires $$O(\log N)$$ refreshed hierarchy keys and encrypted update components for a single membership change in a balanced group of N active members, while routine rekeying uses symmetric-key operations only. The security analysis scopes mutual authentication, session-key establishment, post-revocation key exclusion, backward secrecy for newly admitted members, replay resistance, and identity protection under the stated trust and cryptographic assumptions. Privacy is limited to protection against direct identity exposure and transcript-level linkage by external observers and honest-but-curious infrastructure; it is not claimed against the trusted GM, traffic analysis, physical-layer tracking, or GM compromise. The performance evaluation distinguishes device-side operations, GM-side processing, and total network-level rekey delivery cost.

Blockchain-Assisted Trust-Evidence Retrieval for Secure IoT/WSN Routing in Edge-Assisted Communication Systems

Secure routing is a critical requirement for Internet of Things (IoT) and wireless sensor networks (WSNs) that form the sensing layer of future internet and edge-assisted communication systems. Shortest-path routing alone cannot provide reliable delivery when intermediate nodes exhibit selective forwarding, malicious dropping, or inconsistent behavior. This paper presents HBTV-SR, a permissioned blockchain-assisted trust-evidence retrieval method for secure IoT/WSN routing. The proposed design keeps ordinary sensor nodes lightweight by allowing them to generate signed trust observations, while miner/gateway edge nodes verify signatures, freshness, the absence of duplicate hashes, evidence completeness, and trust-value ranges. Storage nodes maintain Merkle-rooted trust records for tamper-evident retrieval. A reproducible packet-level simulator evaluates HBTV-SR against AODV-like routing, TARF-style trust routing, a direct She et al. blockchain trust baseline, and other baselines surveyed in the literature for the same scenario. Across 30 fixed-seed Monte Carlo runs, HBTV-SR achieved 83.12% packet delivery ratio in the representative 100-node, 20% malicious-node scenario, compared with 78.21% for the She et al. baseline. The results indicate that edge-assisted ledger-backed trust retrieval improves secure routing reliability while avoiding excessive blockchain workload on constrained IoT/WSN nodes.

Quantum-resilient secure key distribution and deep adaptive intelligence for hybrid IIoT-SDN network defense

OPAQUE-IoT: an optimization-driven PUF-Blockchain authenticated key agreement protocol with adaptive resource management for constrained IoT networks

Security in resource-constrained IoT deployments remains a persistent challenge: devices used in industrial control, smart healthcare, and transportation must authenticate quickly, consume minimal energy, and resist physical attacks — yet existing protocols rarely address all three requirements at once. To the best of current knowledge, no prior protocol jointly optimises security, energy, and latency within a single formally verified framework. This paper presents OPAQUE-IoT, an Optimization-driven PUF-Blockchain AKA Protocol for constrained IoT networks. The framework integrates PUF-based hardware identity verification, a permissioned blockchain for decentralized trust management, and the Adaptive Security-Energy Trade-off Optimizer (ASETO), which jointly minimizes authentication latency and energy consumption under formal security constraints. Convergence of ASETO is proven under Lipschitz-continuous objective functions. Formal security analysis under the Real-or-Random (RoR) model with explicit Random Oracle and ECDH hardness assumptions demonstrates resistance to replay, impersonation, man-in-the-middle, PUF modeling, insider, and side-channel attacks, with a security advantage bound of approximately 2^(-68). Simulation results across heterogeneous IoT topologies (N = 50 to 5000 devices) show 31.8% lower energy consumption, 30.2% reduced authentication latency, and 41.1% higher throughput compared to the best-performing blockchain-capable baseline, with O(log N) Merkle-indexed blockchain query complexity and O(T_max·N·P) per-epoch optimiser complexity.

Smart Energy-Aware HMAC-BLAKE2s based PEGASIS Routing Protocol for IoT-Integrated Next-Generation Wireless Sensor Networks

Next-generation Wireless Sensor Networks (WSNs) connected to the Internet of Things (IoT) necessitate routing protocols that are both energy-efficient and resilient to emerging cyber threats. Traditional PEGASIS (Power-Efficient Gathering in Sensor Information Systems)-based routing approaches primarily focus on minimizing energy consumption while often overlooking data integrity and authentication necessities. To overcome these difficulties, this study offers a smart energy-aware PEGASIS routing protocol for IoT-enabled WSN environments that incorporates HMAC-BLAKE2 security measures. PEGASIS is employed to reduction communication overhead by forming energy-optimal chains, thereby minimizing the number of long-range transmissions. To development security, the protocol incorporates HMAC (Hash-based Message Authentication Code) utilizing BLAKE2s, a fast and cryptographically strong message authentication algorithm suitable for resource-constrained devices. This integration ensures data integrity, authentication, and resistance to spoofing and tampering attacks. A key innovation of this work is the modification of the standard PEGASIS protocol to include energy-aware chain construction and dynamic leader selection based on both residual and harvested energy levels. Besides, a Residual Energy-based Chain Leader Election Algorithm (RECLEA) is proposed to extend node lifetime and maintain balanced energy distribution throughout the network. In terms of latency, throughput, Packet Delivery Ratio (PDR), and energy economy, MATLAB simulation results demonstrate notable gains over the conventional PEGASIS and RECLEA protocols. Experimental findings show that the proposed smart energy-aware HMAC-BLAKE2s-based PEGASIS routing protocol provocatively developments performance. Energy consumption is decreased to 3.42 J, representing a reduction of approximately 27.5% associated to baseline PEGASIS (4.72 J). The Packet Delivery Ratio (PDR) progresses to 95.8%, reflecting an development of 10.7% over the baseline (85.1%), while network lifetime is extended to 1689 rounds, representing an progress of approximately 46.9% connected to 1150 rounds in conventional PEGASIS. Additionally, the integration of HMAC-BLAKE2s introduces less than 1% additional energy overhead, ensuring robust data authentication and integrity with negligible impact on overall network performance.