Research Article
Pre-Authenticated ML-KEM Key Banking with Exposure-Bounded SM4-GCM Rekeying for Real-Time Industrial IoT
Bakhtiyor Abdurakhimov
,
Javokhir Abdurazzokov*
Issue:
Volume 10, Issue 2, December 2026
Pages:
35-46
Received:
20 September 2026
Accepted:
5 October 2026
Published:
23 October 2026
DOI:
10.11648/j.ajece.20261002.11
Downloads:
Views:
Abstract: Industrial Internet of Things (IIoT) systems require cryptographic migration toward post-quantum key establishment without violating the tight timing constraints of sensing, control, and gateway communication. This paper proposes (Pre-Authenticated Rekey Key-Bank with Real-Time Exposure Control), a hybrid key-management architecture that combines NIST-standardized ML-KEM with an SM4-GCM authenticated data plane. The central idea is to move ML-KEM key generation and public-key delivery out of the latency-critical rekey interval. During low-utilization periods, a device creates a rolling bank of application-enforced single-activation ML-KEM public keys, commits the bank with a Merkle root, and authenticates that root once with ML-DSA. During online rekeying, the peer uses a previously authenticated bank slot, transmits only the ML-KEM ciphertext and compact context, and completes explicit key confirmation before activating the new SM4-GCM epoch. A hard exposure envelope based on key age, message count, protected-byte volume, and security risk prevents indefinite postponement, while a soft pressure function and reserve-aware scheduler place preparation work into available real-time slack. For ML-KEM-768, pre-positioning the 1184-byte encapsulation key reduces the core KEM material on the online path from 2272 bytes to 1088 bytes, an exact analytical reduction of 52.11%. A link-rate model shows that the removed public-key transfer is most valuable on constrained links, while the principal cost is protected storage for unused decapsulation keys. The paper provides protocol state rules, nonce construction, security propositions, analytical communication and memory results, and a reproducible MQTT/OPC UA hardware-validation protocol. The construction does not modify ML-KEM, ML-DSA, or SM4; its contribution is the lifecycle and scheduling architecture that integrates standardized primitives with real-time IIoT constraints.
Abstract: Industrial Internet of Things (IIoT) systems require cryptographic migration toward post-quantum key establishment without violating the tight timing constraints of sensing, control, and gateway communication. This paper proposes (Pre-Authenticated Rekey Key-Bank with Real-Time Exposure Control), a hybrid key-management architecture that combines N...
Show More
