# Secure and Scalable Internet of Things Model Using Post-Quantum MACsec
## 4 Methodology
### Network Architecture of SSI-PQM  
SSI-PQM features a network architecture similar to that of traditional SSI but introduces enhancements to improve the confidentiality of secret keys and control unauthorized access. The network diagram of SSI-PQM is depicted in Figure 4, where it is compared with the conventional SSI diagram. It introduces additional functionalities provided by the authentication server and CN to bolster the security against vulnerabilities inherent in the original SSI system. Authorized IoT devices gain access to the CN by receiving authentication information from the L2 TP authentication server and updating access control settings  
Figure 3: PQC-TLS is applied to the configuration of information provision and EAP communication within the SSI-PQM system. TLS 1.3 is utilized to minimize the overhead associated with TLS communication. accordingly. The Attribute Value Pairs (AVPs) received after 802.1X and the configuration information for L2 TP authentication are encrypted using the AES algorithm with a secret key securely shared via PQC-TLS. This ensures that they are not exposed externally. Furthermore, the CN controller identifies authorized IoT devices, thereby preventing abnormal access attempts. Figure 5 illustrates the two-layer end-to-end session formation process by SSI-PQM. The SSI framework undergoes a four-step process to establish end-to-end and many-to-many communications. SSI-PQM retains all of the functionalities of the SSI along with enhancing the confidentiality of config information and CAK and strengthening the access control of the IoT devices. Additionally, SSI-PQM applies the following enhancements to steps #1 to #3 of the SSI process:  
Step #1: IoT Device Authentication and Config Info. Provision--When an IoT device attempts authentication, the server redirects communication to the nearest CN. Subsequently, the IoT device initiates a PQC-TLS handshake process with the CN. After successfully completing the handshake, the IoT device proceeds to authenticate via the CN. This step allows the IoT device to receive the necessary configuration information for L2 TP from the authentication server. Step #2: L2 TP Tunnel with Communication Node (CN)--The CN receives the IP address of the authorized IoT device, along with the provisioned Tunnel ID and Session ID from the L2 TP authentication server. When the IoT device attempts to establish an L2 TP session, the CN grants access based on the provisioning information previously received from the authentication server. Step #3: 802.1X Authentication/Authorization--The IoT devices access the CN via the L2 TP tunnel and undergo 802.1X authentication using EAP. Upon receiving authorization from the 802.1X authentication server, the CN acquires AVPs through encrypted communication. Figure 5 illustrates the detailed process of our proposal. Although NTRUs have reduced the encryption and decryption times compared with RSA, they have led to an increase in overall computing resource usage due to the enhanced security level. This trend could potentially degrade the performance of the IoT devices. Our SSI-PQM system integrates PQC-TLS into L2 TP and MACsec to securely store critical information such as secret keys. One of the previous studies reported that NTRUs demonstrated shorter encryption and decryption times than RSA [27]. The authors observed that as the security level increased, so did the demand for computing resources, which in turn could have decreased the performance of IoT devices. In this study, we have designed a system that  
Figure 4: SSI-PQM using global IaaS: The SSI platform, constructed using the global IaaS, maintains the same Layer 2 network and MACsec encryption. L2 TP and EAP communications over the public internet are secured using PQC-TLS. securely shares a secret key for encrypting essential information in L2 TP and MACsec within a single PQC TLS session. Table 2 details the process by which SSI-PQM minimizes the transmission of PQC-TLS's public key and the encryption/decryption of the session key.