# QESIF: A Lightweight Quantum-Enhanced IoT Security Framework for Smart Cities
## 3 System Design and Components
### Hybrid Protocol Stack Design  
To enable efficient and interoperable integration QKD with existing IoT communication protocol stacks, we propose a hybrid protocol stack. It is flexible to accommodate variations in device capabilities within the IoT and the state of the quantum channel, allowing for efficient and secure communication while maintaining backward compatibility with classical IoT infrastructure. Due to its hybrid nature, the protocol stack naturally switches between quantum-secured and classically secured states based on device capabilities, noise levels of the environment, and prevailing conditions within the system. The protocol dynamically adjusts between quantum-secured and classical encryption modes using the \(Q_{\text{adapt}}(t)\) function, which governs mode switching at session boundaries based on entropy availability and channel stability. The standard security measures, such as TLS 1.3, DTLS, and authenticated encryption, are integrated to protect classical data transmission. The core idea behind the hybrid protocol is to incorporate quantum-secured communication on the transport layer and maintain classical IoT communication protocols on the application layer, e.g., MQTT, CoAP, or HTTP. Transmission between the layers is controlled using a decision module that considers both the availability of the quantum key and network performance. ```
Input: Quantum entropy \(H_{q}(t)\), Reference entropy \(\bar{H}_{q}\), QBER at time \(t\), Reference QBER\(QBER_{\text{ref}}\), Key drop stats in window \([t-\Delta t,t]\), Prior intrusion threshold \(\alpha_{\text{intrude}}^{t}\), Noise probability estimate \(\mathcal{P}_{n}(t)\) Output: Intrusion status: Flagged or Safe
1 Compute entropy deviation: \(\Delta H_{q}(t)\leftarrow|H_{q}(t)-\bar{H}_{q}|\); Compute normalized QBER ratio: \(QBER_{\text{ratio}}\leftarrow\frac{\text{QBER}(t)}{QBER_{\text{ratio}}}\); Compute key drop ratio: \(\Lambda_{K}(t)\leftarrow\frac{\text{Keys Dropped}}{\text{Keys Attempted}}\); // Calculate quantum anomaly score (Equation (3)) \(\mathcal{A}_{q}(t)\leftarrow\omega_{1}\cdot\Delta H_{q}(t)+\omega_{2}\cdot QBER _{\text{ratio}}+\omega_{3}\cdot\Lambda_{K}(t)\); // Update detection threshold (Equation (4)) Estimate \(\frac{\partial\mathcal{A}_{q}(t)}{\partial t}\) using finite difference method; \(a_{\text{intrude}}^{t+1}\leftarrow a_{\text{intrude}}^{t}+\eta\cdot\left( \frac{\partial\mathcal{A}_{q}(t)}{\partial t}\right)\cdot(1-\mathcal{P}_{n}(t ))\); if\(\mathcal{A}_{q}(t)\geq a_{\text{intrude}}^{t+1}\)then return Flagged (Intrusion Detected); else return Safe (No Intrusion);
```  
**Algorithm 2**Quantum-Aware Intrusion Detection System (Q-IDS)  
The quantum adaptation function \(\mathcal{Q}_{\text{adapt}}(t)\) is defined for deciding the communication mode based on quantum key availability and real-time system conditions. The function is given by  
\[\mathcal{Q}_{\text{adapt}}(t)=\left\{ \begin{array}{ll}1,&\text{if }\mathcal{K}_{\text{IoT}}(d_{i},t)\geq \epsilon_{\text{min}}\\ 0,&\text{if }\mathcal{K}_{\text{IoT}}(d_{i},t)<\epsilon_{\text{min}}\end{array} \right. \tag{5}\]  
where  
* \(\mathcal{K}_{\text{IoT}}(d_{i},t)\) is the dynamic key rate at time \(t\) for device \(d_{i}\) (calculated from Equation (1)). * \(\epsilon_{\text{min}}\) is the minimum required key rate for enabling quantum-secured communication. The quantum-secured communication mode is activated when \(Q_{\text{adapt}}(t)=1\), allowing IoT devices to utilize quantum-derived keys for secure encryption and authentication. While \(Q_{\text{adapt}}(t)\) is defined as a binary function for modeling purposes, its practical implementation follows a session-level switching mechanism with threshold smoothing to avoid instability from transient channel fluctuations. The transition incurs minimal latency as it is executed at the session level rather than on a per-packet basis, ensuring reliable and non-disruptive communication.