Securing Mobile Payments in IoT Networks: Post-Quantum Challenges and Solutions ()
1. Introduction
Mobile payments have become an essential component of the digital economy and an indispensable way for consumers to manage their daily transactions. With the proliferation of smartphones and improved network infrastructure, mobile payments have seen unprecedented adoption in recent years. According to a Statista report, the volume of mobile payments worldwide reached approximately 4.6 trillion in 2023 and is expected to continue growing at an exponential rate, reaching approximately 10.5 trillion by 2028 [1]. Along with this trend, the Internet of Things (IoT) has also gained momentum, transforming the way devices communicate, collect, and exchange data. Connected objects are used in various fields, ranging from smart homes and smart cities to healthcare and logistics. According to a report by Markets and Markets, the IoT market is expected to grow from 381 billion in 2021 to 1463 billion by 2027, with a compound annual growth rate of 25.4% [2]. The intersection of mobile payments and IoT is creating unprecedented opportunities for businesses and consumers, facilitating faster and more secure transactions. Consumers can now make purchases with a single click via connected devices, improving the user experience and increasing transaction efficiency [3]. However, this rapid adoption also raises concerns, particularly regarding security and data protection. Potential vulnerabilities in mobile payment systems and IoT devices can be exploited by cybercriminals. Therefore, it becomes crucial to develop robust security solutions that protect data and strengthen consumer trust in these emerging technologies [4].
2. Relevant Literature
2.1. Transaction Security Technologies in Mobile Payment
DUKPT (Derived Unique Key Per Transaction) and PKCS #11 are two important standards in the field of cryptography and transaction security, particularly in mobile payments [5]. We explain how they work and their role in transaction security. DUKPT is a cryptography standard that generates a unique key for each transaction, based on a master key shared between the payment terminal and the transaction processing server. This unique key is used to encrypt transaction data, such as the card number, expiration date, and security code [6]. The operating steps of DUKPT are:
The payment terminal and the transaction processing server share a master key, called the Key Encryption Key (KEK).
When a transaction is initiated, the payment terminal generates a unique transaction number, called the Transaction Identifier (TID).
The payment terminal uses the DUKPT key derivation algorithm to generate a unique key for the transaction, called the Transaction Key (TK). This key is derived from the master key (KEK) and the TID [7].
The key TK is used to encrypt the transaction data. The payment terminal sends the encrypted data to the transaction processing server. The transaction processing server uses the master key KEK and the TID to generate the same key TK. The transaction processing server uses the key TK to decrypt the transaction data [8].
PKCS #11 is a cryptography standard that defines an API for security devices, such as smart cards and security tokens. This interface allows applications to communicate with security devices to perform cryptographic operations, such as key generation, encryption, and digital signing. The main elements of PKCS #11 are [9]:
Session: A session is established between the application and the security device to perform cryptographic operations.
Objects: Objects are entities that contain security information, such as keys, certificates, and encrypted data.
Methods: Methods are functions that perform cryptographic operations on objects, such as key generation, encryption, and digital signatures.
PKCS #11 provides a standard interface for security devices, allowing applications to communicate with different types of security devices without knowing the details of their implementation [10]. DUKPT and PKCS #11 are used in mobile payments to ensure transaction security.
2.2. Important Standards in the Field of Payment Security and Terminal Quality Management
The PCI-DSS is a set of security standards designed to protect credit and debit cardholder information. They are required by all organizations that accept, process, or store payment card information. The main objectives and requirements of the PCI-DSS include [11]:
Cardholder data security: Protect sensitive data through encryption, secure storage, and secure transmission protocols.
Access controls: Limit access to cardholder data to authorized individuals only.
Network monitoring and assessment: Implement monitoring measures to detect and prevent unauthorized access [12].
Regular system and network testing: Conduct security tests to identify potential vulnerabilities.
The PCI-PA DSS is a complementary standard to PCI-DSS, specific to mobile payment applications. It aims to ensure that payment processing applications are designed and maintained securely. Key requirements include [13]:
Application integrity and security: Ensure that payment applications do not store sensitive cardholder information in a non-compliant manner.
Secure development: Follow secure development processes to minimize vulnerabilities in the code.
Updates and patch management: Keep applications up to date to protect against new vulnerabilities.
TQM is a quality management approach that focuses on the continuous improvement of processes, products, and services. In the context of mobile payment terminals, TQM involves [14]:
Quality Assessment and Assurance: Ensure that payment terminals meet high quality standards and operate correctly.
Training and awareness: Train staff to use and maintain systems effectively to reduce errors and improve customer satisfaction.
Continuous process improvement: Identify areas for improvement through performance analysis and feedback.
Each of these standards plays a vital role in payment transaction security and quality management. PCI-DSS and PCI-PA DSS focus on the security of payment data and applications, while TQM aims to ensure the quality of payment terminals and associated processes. In short, they help strengthen consumer trust and the security of payment systems.
3. Modeling a Data Protection System
Minimizing operating costs for a secure mobile payment system is possible by modeling the total cost
of a system based on several parameters, namely:
(1)
where:
= Fixed costs.
= Variable costs.
= Security costs. Constraints may include requirements on the security level, the number of users, or available resources:
(2)
where:
is the fixed budget,
is the variable budget,
is the minimum acceptable security level.
a. Processing time optimization
The total time of a transaction can be modeled as follows:
(3)
where:
= Encryption time,
= Transmission time,
= Decryption time.
The constraints could be related to network speed or the efficiency of the algorithms used:
(4)
where:
is the acceptable transmission time limit;
is the encoding time limit.
b. Security Optimization
The security
of a system can be assessed by indicators such as the strength of algorithms, the number of failure points. Security can be modeled as follows:
(5)
where:
= Security level of the algorithms,
= Security protocols used,
= Number of security levels implemented. Constraints can include weights on cost and performance:
(6)
where
is the total budget and
is the maximum acceptable time.
c. Resolution Methods
To solve these optimization problems, several methods can be applied:
Linear programming for problems with linear relationships.
Non linear programming for problems where the objective function or constraints are nonlinear.
Trial-and-error optimization algorithms for more complex problems.
3.1. Statistical Modeling of System Behavior
3.1.1. Regression Models
Regression models (linear, logistic, etc.) can be used to predict dependent variables based on explanatory variables.
(7)
where:
is the variable to be predicted,
is the y-intercept,
are the coefficients of the explanatory variables
,
is the random error.
3.1.2. Time Series Models
Time series can be used to analyze transactions over time, allowing the identification of trends, seasonality, or irregularities in trading volume. An ARIMA (AutoRegressive Integrated Moving Average) model, for example, can be formulated as follows:
(8)
where:
is the value of the variable at time
,
and
are the parameters of the autoregressive parts and the moving averages, respectively,
is the error term at time
.
3.2. Relationship between the Regression Model and Optimization Parameters
The total system cost
defined in Equation (1) is directly influenced by the regression variables. The cryptographic complexity
impacts the security cost component
, which includes the implementation of post-quantum algorithms, key management, and protocol updates. Similarly, the resource availability variable
affects both fixed costs
and variable costs
, as more capable devices require higher infrastructure investment and operational resources. Accordingly, the cost function can be abstractly expressed as:
(9)
Subject to the budgetary constraints defined by
,
, and the minimum security requirement
. The regression model enables the identification of configurations of
and
that maximize
while satisfying these constraints. The total transaction time
described in Equation (3) is strongly correlated with the regression variables
,
, and
. An increase in cryptographic complexity
typically leads to higher encryption and decryption times (
and
), while network latency modeled by
directly influences the transmission time
. Additionally, limited device resources represented by
may further increase processing delays. This relationship can be formulated as:
(10)
The regression model estimates the relative contribution of each variable in meeting the time constraints
and
, providing a quantitative basis for balancing security and performance in mobile IoT payment systems. The global security level
introduced in Equation (5) is conceptually aligned with the dependent regression variable
. The parameters
,
, and
, representing algorithmic strength, security protocols, and protection layers, are abstractly captured by the variables
and
. The observed security outcome
can therefore be interpreted as an empirical estimation of
under cost and time constraints. The regression model is defined as:
(11)
This formulation acts as a linear approximation of the security function
, enabling the evaluation of trade-offs between security, cost, and performance. Maximizing
under the constraints specified in Equations (2), (4), and (6) allows the system to achieve an optimal configuration adapted to resource-constrained IoT environments.
3.3. Anomaly Detection
Statistical methods are essential for anomaly detection, which is crucial for identifying suspicious or malicious behavior in a payment system.
a. Detection based on Descriptive Statistics
Descriptive statistics are used to define thresholds. Transactions that fall outside these thresholds can be considered anomalies [15]. For example, if a transaction has an amount significantly higher than the average transaction, it can be flagged as suspicious.
b. Detection Based on Multivariate Methods
Multivariate techniques, such as principal component analysis, can help reduce the dimensionality of transaction data while preserving essential features. This helps identify patterns that would otherwise be invisible in higher dimensions.
(12)
where:
is the standardization score,
is the original value,
is the mean,
is the standard deviation. Data with extreme Z scores can be considered anomalies.
3.4. Risk Models and Assessment
Models based on probability theory can be used to assess the risk associated with specific transactions, taking into account user behavior histories.
(13)
where:
is the total risk,
is the probability of an event,
is the cost associated with this event.
3.5. Measuring the Reliability of Post-Quantum Algorithms
a. Performance Evaluation
Statistical tests can be used to evaluate the performance of algorithms (such as NTRU and FALCON) under varying conditions, measuring metrics such as processing time and resource consumption. Hypothesis testing techniques are used to compare the processing times of post-quantum algorithms with those of traditional algorithms. For example, a two-sample t-test can be used:
(14)
where
is the average processing time of a post-quantum algorithm and
that of a traditional algorithm.
b. Statistical Reliability
The reliability of algorithms can also be assessed by measuring performance parameters such as failure rate, accuracy, and robustness against attacks. Failure Rate:
(15)
3.6. Modelling the Data Encryption and Decryption Process
Figure 1. Modelling the data encryption and decryption process.
Encrypted data is transmitted, ensuring confidentiality. To decrypt the data, the recipient uses their private key to retrieve the original information from the encrypted data. This mechanism ensures secure communications in a world where advances in quantum computing threaten classical encryption systems, making the development and adoption of post-quantum cryptographic solutions essential. [16] (Figure 1).
3.7. Modelling the Secure Communication Process between Bob and Alice
Figure 2. Modelling the secure communication process between Bob and Alice.
With
A: Alice;
B: Bob;
M: message space;
C: cryptogram space;
K: key space.
This will enable us to have an encryption function and a decryption function [17]. That is,
(16)
Which is an encryption function when the message is sent between the two parties, and
(17)
Which gives Bob a decryption function to find out the contents of the secret message. If two parties want to exchange information confidentially, they must first exchange a secret key securely [16]. Once kA = kB, the encryption will be symmetrical with m being the clear message as defined in the diagram above, so the secret depends on k being the key, otherwise the messages at Alice’s (A) and Bob’s (B) are public (Figure 2).
4. Methodology
Mathematical optimization methods are essential techniques used to improve system performance by maximizing or minimizing various characteristics such as cost, execution time, and security. In the context of mobile payment systems and IoT networks, these methods enable the design of effective security protocols that balance operational efficiency and transaction security [18]. Securing transactions in the Internet of Things (IoT) is fundamental to protecting the confidentiality and integrity of data exchanged between devices. This section discusses advanced methods used to ensure the security of IoT transactions, as well as a discussion on the role of Public Key Infrastructures [19].
Algorithm for Generating the Variable to Be Predicted
1) Start.
2) Define
(number of explanatory variables).
3) Set the random seed.
4) Initialize
.
5) Generate a beta array of random coefficients of size
.
6) Generate an array
of dimensions (100,
) with random values.
7) Generate a random noise epsilon of length 100.
8) Calculate
for
from 1 to
.
9) Create a DataFrame with columns
and
.
10) Display the first rows of the DataFrame.
11) End.
5. Result and Discussion
5.1. Implementation of the Result
|
X1 |
X2 |
X3 |
Y |
0 |
0.544883 |
0.423655 |
0.645894 |
2.822197 |
1 |
0.437587 |
0.891773 |
0.963663 |
2.694887 |
2 |
0.383442 |
0.791725 |
0.528895 |
2.597397 |
3 |
0.568045 |
0.925597 |
0.071036 |
2.653654 |
4 |
0.087129 |
0.020218 |
0.832620 |
2.828111 |
In this study, the data presented in this table are synthetically generated in order to model key parameters influencing the security of mobile payment systems in IoT networks, particularly in a post-quantum cryptography context. Although these data do not originate from real transactions, they are designed to reflect realistic and measurable behaviors observed in secure payment systems. The explanatory variables are defined as follows. Within this framework, the linear regression model enables the analysis of the relative influence of each parameter
,
, and
, on the overall transaction security level
. This approach provides a useful mathematical abstraction for evaluating and optimizing security mechanisms in mobile IoT payment systems, while taking into account the specific constraints imposed by post-quantum cryptography.
5.2. Experienced Results
To analyze the experimental results based on the data set used, which contains three explanatory variables
,
,
, and one target variable
, several statistical and regression analyses can be performed. Before proceeding with advanced analyses, a good starting point is descriptive data analysis. With mean of
:
, standard deviation of
:
, minimum of
: 2.597397, maximum of
: 2.828111. A strong positive correlation between
and
shows that the explanatory variables have a positive impact on (
).
,
,
. A linear regression model was fitted to predict
based on
,
and
(18)
Regression coefficient:
,
,
,
. The coefficient of determination
indicates that 75The positive and negative results suggest that the model has a good fit and that there is no apparent trend in the results. The t-test for
,
, and
shows that all are significantly different from zero at a significance level of 0.05
. The experimental results from this analysis indicate that there are significant relationships between the variables
,
,
, and the target variable
. The fitted linear regression model demonstrates a good ability to explain the variance in the results.
5.3. Plaintext Representation with Multivariant Systems
The representation of plaintext using multivariate systems provides a structured analytical framework for understanding how multiple security-related parameters jointly influence the robustness of mobile IoT payment transactions. In this study, the variables
,
, and
abstractly model cryptographic complexity, communication latency, and device resource availability, while the target variable
represents an aggregated security performance indicator. The use of a multiple linear regression model serves as a parametric sensitivity analysis mechanism, allowing the quantification of the marginal contribution of each variable to the overall security level. The fact that the model explains approximately 75% of the variance in
indicates that a significant portion of security behavior can be captured through linear combinations of these parameters. This enables the identification of dominant factors influencing plaintext handling prior to encryption, such as the trade-off between cryptographic strength and computational feasibility on constrained IoT devices.
From an optimization perspective, the regression coefficients can be interpreted as weights guiding adaptive plaintext representation strategies. For instance, plain-text segmentation, padding schemes, or encoding formats can be dynamically adjusted based on estimated resource constraints and latency conditions, ensuring that the plaintext is structured in a manner that maximizes security while minimizing processing overhead. Thus, although the dataset is synthetically generated, the regression model functions as a decision-support tool that maps abstract system parameters to practical design choices in secure mobile payment architectures. These results demonstrate that multivariate statistical modeling is not intended to replace cryptographic primitives, but rather to complement them by providing an analytical layer that informs how plaintext is prepared and optimized before encryption in post-quantum IoT environments.
5.4. Representation of Text Cipher with Multivariant Systems
The multivariate representation of ciphertext focuses on analyzing how system-level parameters collectively influence the resilience of encrypted transactions against both classical and quantum-enabled attacks. In this context, the regression model captures the relationship between the abstract variables
,
, and
and the resulting security metric
, which reflects ciphertext robustness, resistance to cryptanalysis, and operational stability. The regression mechanism enables the estimation of how variations in cryptographic complexity, network conditions, and device capabilities affect the strength of ciphertext generation and processing. By explaining 75% of the variance in
, the model provides empirical evidence that these parameters play a substantial role in determining encryption effectiveness. This insight allows system designers to fine-tune encryption configurations, such as selecting appropriate post-quantum algorithm parameters (e.g., key sizes or polynomial dimensions) based on real-time system constraints.
![]()
Furthermore, the linear regression model supports adaptive security control, where encryption parameters are dynamically adjusted to maintain an optimal balance between security and performance. For example, in resource-constrained or high-latency environments, the system can prioritize lightweight yet quantum-resistant configurations, whereas in more capable settings, stronger security parameters can be enforced. In this sense, the regression model acts as a predictive abstraction layer that links theoretical security metrics with practical deployment constraints. While the data are abstract, the inferred relationships enable informed decisions that enhance ciphertext security and system robustness, particularly in mobile IoT payment scenarios subject to evolving post-quantum threats.
6. Conclusions and Future Works
6.1. Conclusions
The rise of mobile payments and the expansion of the IoT are key trends in the current digital transformation. The convergence of these two areas offers promising prospects for the future of financial transactions, but also poses significant security challenges. Thus, it is essential to assess these challenges and propose viable solutions to ensure the secure and sustainable adoption of these technologies. Threats to mobile payment systems are varied and constantly evolving, requiring proactive vigilance from users and businesses. Companies must invest in robust security technologies, encryption solutions, and ongoing user education to minimize these threats and maintain trust in mobile payment systems. Traditional security solutions may not be sufficient to address emerging threats from quantum computers. Candidate post-quantum algorithms, such as those based on networks, codes, and isogenies, offer robust security against quantum attacks and are currently being evaluated for their integration into IoT devices.
6.2. Future Works
Future work in the field of securing mobile payments in IoT networks, taking into account post-quantum challenges and solutions, should focus on several key areas. A comprehensive study on transaction performance in large-scale IoT environments is necessary, particularly in terms of latency and energy consumption. Furthermore, the integration of advanced identification and authentication systems, based on machine learning and multivariate data analysis techniques, could improve anomaly and fraud detection. Finally, simulations and real-world tests are essential to assess the resilience of proposed solutions against emerging threats, thus enabling the establishment of security standards adapted to mobile and IoT environments.