A PQC-Aware Secure Communication Architecture for NB-IoT: Control-Plane Post-Quantum Onboarding with Lightweight Data-Plane Protection

Received: 28 December 2025 | Revised: 8 February 2026, 25 February 2026, and 28 February 2026 | Accepted: 4 March 2026 | Online: 1 May 2026

Corresponding author: Thi-Bac Do

Abstract

The advent of large-scale quantum computing poses a fundamental threat to widely deployed public-key cryptographic mechanisms, particularly in Internet of Things (IoT) systems with long operational lifetimes and limited upgrade capabilities. Narrowband Internet of Things (NB-IoT), as a representative Low-Power Wide-Area Network (LPWAN) technology, is especially vulnerable to this transition due to its strict constraints on packet size, bandwidth, and Radio-Frequency (RF) energy consumption. Although Post-Quantum Cryptography (PQC) has progressed rapidly through standardization efforts led by the National Institute of Standards and Technology (NIST), the direct and frequent application of PQC primitives in NB-IoT communication remains impractical. Large ciphertexts and digital signatures, although cryptographically sound, conflict with the fundamental design principles of LPWANs and may significantly degrade reliability, scalability, and device lifetime. This paper proposes a PQC-aware secure communication architecture for NB-IoT that reconciles long-term quantum resistance with the operational realities of constrained radio networks. Rather than treating PQC as a drop-in replacement for classical public-key cryptography, the proposed design adopts a two-plane security architecture that explicitly separates control-plane onboarding from data-plane communication. Post-quantum primitives are confined to infrequent onboarding operations, where higher overhead can be tolerated, while routine data transmission relies exclusively on lightweight symmetric authenticated encryption. Specifically, the architecture employs CRYSTALS-Kyber for post-quantum key encapsulation and CRYSTALS-Dilithium for device authentication during onboarding, selected for their standardization status and comparatively compact message sizes. After onboarding, all data traffic is protected using ChaCha20-Poly1305, combined with a key-derivation-based ratcheting mechanism that provides per-message forward secrecy without recurring PQC overhead. This design is explicitly aligned with NIST guidance on the intended use of post-quantum signatures and the constraints of LPWAN deployments. The proposed framework was implemented and evaluated on an ESP32-based NB-IoT platform with a commercial cellular module. Experimental results demonstrate that post-quantum onboarding can be completed within NB-IoT packet-size constraints with acceptable reliability, while routine data transmission incurs minimal computational, bandwidth, and energy overhead. The findings confirm that quantum-resistant security for NB-IoT is achievable only when PQC is applied selectively and system-aware, rather than uniformly across all communication phases.