## 2 Materials and Methods  
This study examines the performance and security dynamics of the IoT Cloud system implemented at UBT Smart City, focusing on the implications of introducing advanced cybersecurity mechanisms on system latency and operational efficiency. The infrastructure under analysis is deployed on Microsoft Azure and comprises core services including Azure IoT Hub for device connectivity, Stream Analytics for real-time data processing, Azure SQL Database for structured storage, and Azure Virtual Machines for administrative tasks [8,20,21]. These components are logically grouped within an Azure Virtual Network (VNet) that is further segmented into multiple subnets (e.g., IoTHubSubnet, STREAMSubnet, SQLSubnet, VMSubnet), each isolated through dedicated Network Security Groups (NSGs) to enforce granular traffic control policies. Initially, the system architecture please refer to Figure 1: Existing IoT Cloud Architecture) featured open internet communication between all major services without any encryption or access restriction. This configuration left the infrastructure vulnerable to unauthorized access, data interception, and potential denial-of-service attacks. To address these issues, a comprehensive set of security measures was implemented. These included the creation of a segmented Virtual Network with encrypted internal communication (see Figure 2: Virtual Network Encryption Setup). Figure 1: Existing IoT Cloud Architecture. And custom Route Tables that directed data flows along explicitly defined paths, thereby preventing unintended access across subnet boundaries (Figure 4). Custom route table enforcing communication control between subnets. NSG policies are shown in green, and VPN-based access is indicated by blue arrows. Data flows are directional, and restricted routes are blocked via firewall configurations. A static Public IP address (20.33.79.38) was assigned and secured using Azure's DDoS Protection, and a route-based Virtual Private Network (VPN) gateway was deployed and enabling Point-to-Site (P2S) access only for authorized devices via digital certificates (Figure 5). Management activities and administrative access to Azure VMs were strictly restricted through this VPN tunnel, while sensor data transmission to IoT Hub was limited to the public IP address space of UBT (Figure 6: Updated Logical Topology). This layered defense strategy represented a significant shift toward a zero-trust network model. Figure 3: NSG configurations. Figure 2: Virtual Network Encryption Setup. To quantify the impact of these security enhancements, a series of controlled tests were conducted both before and after implementation. Using Postman, simulated IoT devices were configured to send telemetry data to Azure IoT Hub. For each transmission, three  
Figure 4: Custom Route Tables. Figure 5: Point-to-Site (P2S). Figure 6: Updated Logical Topology. timestamps were recorded: when data was sent to IoT Hub, when it was enqueued in Stream Analytics, and when it was stored in SQL Database. From these, the Total Delay [Equation (1)] was computed using the following metric:  
\[D_{total} =T_{SQL}-T_{sent} \tag{1}\]  
Performance data was collected across 16 test samples in each scenario. Before security deployment, the average delay was 626.15 ms, while after the application of NSGs, VPN, and route enforcement, the average delay increased to 745.88 ms. The highest recorded delay after securing the system reached 1692.47 ms, indicating measurable overhead. To better understand this latency increase, the data pipeline was modeled as an M/M/1 queueing system, where data packets are treated as arriving jobs and the combined Stream Analytics and SQL stack functions as the service server. Under the M/M/1 model, we define \(\lambda\) as the arrival rate of telemetry messages and \(\mu\) as the processing rate.