Industrial Internet of Things (IIoT) systems require cryptographic migration toward post-quantum key establishment without violating the tight timing constraints of sensing, control, and gateway communication. This paper proposes (Pre-Authenticated Rekey Key-Bank with Real-Time Exposure Control), a hybrid key-management architecture that combines NIST-standardized ML-KEM with an SM4-GCM authenticated data plane. The central idea is to move ML-KEM key generation and public-key delivery out of the latency-critical rekey interval. During low-utilization periods, a device creates a rolling bank of application-enforced single-activation ML-KEM public keys, commits the bank with a Merkle root, and authenticates that root once with ML-DSA. During online rekeying, the peer uses a previously authenticated bank slot, transmits only the ML-KEM ciphertext and compact context, and completes explicit key confirmation before activating the new SM4-GCM epoch. A hard exposure envelope based on key age, message count, protected-byte volume, and security risk prevents indefinite postponement, while a soft pressure function and reserve-aware scheduler place preparation work into available real-time slack. For ML-KEM-768, pre-positioning the 1184-byte encapsulation key reduces the core KEM material on the online path from 2272 bytes to 1088 bytes, an exact analytical reduction of 52.11%. A link-rate model shows that the removed public-key transfer is most valuable on constrained links, while the principal cost is protected storage for unused decapsulation keys. The paper provides protocol state rules, nonce construction, security propositions, analytical communication and memory results, and a reproducible MQTT/OPC UA hardware-validation protocol. The construction does not modify ML-KEM, ML-DSA, or SM4; its contribution is the lifecycle and scheduling architecture that integrates standardized primitives with real-time IIoT constraints.
| Published in | American Journal of Electrical and Computer Engineering (Volume 10, Issue 2) |
| DOI | 10.11648/j.ajece.20261002.11 |
| Page(s) | 35-46 |
| Creative Commons |
This is an Open Access article, distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution and reproduction in any medium or format, provided the original work is properly cited. |
| Copyright |
Copyright © The Author(s), 2026. Published by Science Publishing Group |
Industrial Internet of Things, Post-Quantum Cryptography, ML-KEM, SM4-GCM, Key Management, Real-Time Rekeying, Smart Manufacturing, Authenticated Encryption
| [1] | National Institute of Standards and Technology. Module-Lattice-Based Key-Encapsulation Mechanism Standard. FIPS 203. 2024. |
| [2] | Alagic, G., Barker, E., Chen, L., Moody, D., Robinson, A., Silberg, H., Waller, N. Recommendations for Key-Encapsulation Mechanisms. NIST Special Publication 800-227. 2025. |
| [3] | National Institute of Standards and Technology. Module-Lattice-Based Digital Signature Standard. FIPS 204. 2024. |
| [4] | Yang, P. ShangMi (SM) Cipher Suites for TLS 1.3. RFC 8998. 2021. |
| [5] | Dworkin, M. Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC. NIST Special Publication 800-38D. 2007. |
| [6] | Shahid, A. B., Mansoor, K., Bangash, Y. A., Iqbal, W., et al. Post-quantum cryptographic authentication protocol for industrial IoT using lattice-based cryptography. Scientific Reports. 2026, 16, 9582. |
| [7] | Almutairi, M. G., Sheldon, F. T. Network conditions dominate MQTT-over-TLS 1.3 performance: A comparative evaluation of ML-KEM-768, RSA-2048, and ECC-P256. Electronics. 2026, 15(17), 3914. |
| [8] | Shreyas, A., Arun Kumar, B. R., Manasa, U. Trust-Driven Risk-Adaptive Post-Quantum Authentication for Resource-Constrained IoT Systems. In: 2026 IEEE 18th International Conference on Computational Intelligence and Communication Networks (CICN). 2026. |
| [9] | Jain, K., Singh, A. IHKEM: A post-quantum ready hierarchical key establishment and management scheme for wireless sensor networks. Microprocessors and Microsystems. 2025, 118, 105205. |
| [10] | Alqattan, A., Mahdi, M., Dimitriou, T. SAOKD: Server-Assisted Oblivious Key Distribution for Resource-Constrained, Post-Quantum IoT Devices. In: 2026 22nd IEEE International Conference on Distributed Computing in Smart Systems and the Internet of Things (DCOSS-IoT). 2026, pp. 246–254. |
| [11] | Qayyum, T., Tariq, A., Belkacem, A. N. PQ-Neurolink: latency-aware post-quantum-ready secure communication for distributed brain-computer interfaces. Frontiers in Systems Neuroscience. 2026, 20, 1891041. |
| [12] | Zajac, P. Ephemeral Keys Authenticated with Merkle Trees and Their Use in IoT Applications. Sensors. 2021, 21(6), 2036. |
| [13] | Mishra, N., Islam, S. K. H., Zeadally, S. A survey on security and cryptographic perspective of Industrial-Internet-of-Things. Internet of Things. 2024, 25, 101037. |
| [14] | Halak, B., Gibson, T., Henley, M., Botea, C.-B., Heath, B., Khan, S. Evaluation of Performance, Energy, and Computation Costs of Quantum-Attack Resilient Encryption Algorithms for Embedded Devices. IEEE Access. 2024, 12, 8791–8805. |
| [15] | Cruz-Piris, L., Marín-López, A., Alvarez-Campana, M., Sanz, M., Moreno, J. I., Arroyo, D. Measuring the impact of post quantum cryptography in Industrial IoT scenarios. Internet of Things. 2025, 34, 101793. |
| [16] | Barker, E., Chen, L., Cooper, D., Moody, D., Regenscheid, A., Souppaya, M., Newhouse, W., Housley, R., Turner, S., Barker, W., Kent, K. Considerations for Achieving Crypto Agility: Strategies and Practices. NIST Cybersecurity White Paper 39. 2025. |
APA Style
Abdurakhimov, B., Abdurazzokov, J. (2026). Pre-Authenticated ML-KEM Key Banking with Exposure-Bounded SM4-GCM Rekeying for Real-Time Industrial IoT. American Journal of Electrical and Computer Engineering, 10(2), 35-46. https://doi.org/10.11648/j.ajece.20261002.11
ACS Style
Abdurakhimov, B.; Abdurazzokov, J. Pre-Authenticated ML-KEM Key Banking with Exposure-Bounded SM4-GCM Rekeying for Real-Time Industrial IoT. Am. J. Electr. Comput. Eng. 2026, 10(2), 35-46. doi: 10.11648/j.ajece.20261002.11
Share This Article
Twitter
Linked In
Facebook
Copy
Download@article{10.11648/j.ajece.20261002.11,
author = {Bakhtiyor Abdurakhimov and Javokhir Abdurazzokov},
title = {Pre-Authenticated ML-KEM Key Banking with Exposure-Bounded SM4-GCM Rekeying for Real-Time Industrial IoT},
journal = {American Journal of Electrical and Computer Engineering},
volume = {10},
number = {2},
pages = {35-46},
doi = {10.11648/j.ajece.20261002.11},
url = {https://doi.org/10.11648/j.ajece.20261002.11},
eprint = {https://article.sciencepublishinggroup.com/pdf/10.11648.j.ajece.20261002.11},
abstract = {Industrial Internet of Things (IIoT) systems require cryptographic migration toward post-quantum key establishment without violating the tight timing constraints of sensing, control, and gateway communication. This paper proposes (Pre-Authenticated Rekey Key-Bank with Real-Time Exposure Control), a hybrid key-management architecture that combines NIST-standardized ML-KEM with an SM4-GCM authenticated data plane. The central idea is to move ML-KEM key generation and public-key delivery out of the latency-critical rekey interval. During low-utilization periods, a device creates a rolling bank of application-enforced single-activation ML-KEM public keys, commits the bank with a Merkle root, and authenticates that root once with ML-DSA. During online rekeying, the peer uses a previously authenticated bank slot, transmits only the ML-KEM ciphertext and compact context, and completes explicit key confirmation before activating the new SM4-GCM epoch. A hard exposure envelope based on key age, message count, protected-byte volume, and security risk prevents indefinite postponement, while a soft pressure function and reserve-aware scheduler place preparation work into available real-time slack. For ML-KEM-768, pre-positioning the 1184-byte encapsulation key reduces the core KEM material on the online path from 2272 bytes to 1088 bytes, an exact analytical reduction of 52.11%. A link-rate model shows that the removed public-key transfer is most valuable on constrained links, while the principal cost is protected storage for unused decapsulation keys. The paper provides protocol state rules, nonce construction, security propositions, analytical communication and memory results, and a reproducible MQTT/OPC UA hardware-validation protocol. The construction does not modify ML-KEM, ML-DSA, or SM4; its contribution is the lifecycle and scheduling architecture that integrates standardized primitives with real-time IIoT constraints.},
year = {2026}
}
TY - JOUR T1 - Pre-Authenticated ML-KEM Key Banking with Exposure-Bounded SM4-GCM Rekeying for Real-Time Industrial IoT AU - Bakhtiyor Abdurakhimov AU - Javokhir Abdurazzokov Y1 - 2026/10/23 PY - 2026 N1 - https://doi.org/10.11648/j.ajece.20261002.11 DO - 10.11648/j.ajece.20261002.11 T2 - American Journal of Electrical and Computer Engineering JF - American Journal of Electrical and Computer Engineering JO - American Journal of Electrical and Computer Engineering SP - 35 EP - 46 PB - Science Publishing Group SN - 2640-0502 UR - https://doi.org/10.11648/j.ajece.20261002.11 AB - Industrial Internet of Things (IIoT) systems require cryptographic migration toward post-quantum key establishment without violating the tight timing constraints of sensing, control, and gateway communication. This paper proposes (Pre-Authenticated Rekey Key-Bank with Real-Time Exposure Control), a hybrid key-management architecture that combines NIST-standardized ML-KEM with an SM4-GCM authenticated data plane. The central idea is to move ML-KEM key generation and public-key delivery out of the latency-critical rekey interval. During low-utilization periods, a device creates a rolling bank of application-enforced single-activation ML-KEM public keys, commits the bank with a Merkle root, and authenticates that root once with ML-DSA. During online rekeying, the peer uses a previously authenticated bank slot, transmits only the ML-KEM ciphertext and compact context, and completes explicit key confirmation before activating the new SM4-GCM epoch. A hard exposure envelope based on key age, message count, protected-byte volume, and security risk prevents indefinite postponement, while a soft pressure function and reserve-aware scheduler place preparation work into available real-time slack. For ML-KEM-768, pre-positioning the 1184-byte encapsulation key reduces the core KEM material on the online path from 2272 bytes to 1088 bytes, an exact analytical reduction of 52.11%. A link-rate model shows that the removed public-key transfer is most valuable on constrained links, while the principal cost is protected storage for unused decapsulation keys. The paper provides protocol state rules, nonce construction, security propositions, analytical communication and memory results, and a reproducible MQTT/OPC UA hardware-validation protocol. The construction does not modify ML-KEM, ML-DSA, or SM4; its contribution is the lifecycle and scheduling architecture that integrates standardized primitives with real-time IIoT constraints. VL - 10 IS - 2 ER -
Department of Applied Mathematics and Computer Analysis, National University of Uzbekistan named after Mirzo Ulugbek, Tashkent, Uzbekistan
Department of Exact Sciences and Digital Technologies, Tashkent International University, Tashkent, Uzbekistan
Information