DUKPT (Derived Unique Key Per Transaction) and PKCS #11 are two important standards in the field of cryptography and transaction security, particularly in mobile payments [5]. We explain how they work and their role in transaction security. DUKPT is a cryptography standard that generates a unique key for each transaction, based on a master key shared between the payment terminal and the transaction processing server. This unique key is used to encrypt transaction data, such as the card number, expiration date, and security code [6]. The operating steps of DUKPT are:

The payment terminal and the transaction processing server share a master key, called the Key Encryption Key (KEK).When a transaction is initiated, the payment terminal generates a unique transaction number, called the Transaction Identifier (TID).The payment terminal uses the DUKPT key derivation algorithm to generate a unique key for the transaction, called the Transaction Key (TK). This key is derived from the master key (KEK) and the TID [7].The key TK is used to encrypt the transaction data. The payment terminal sends the encrypted data to the transaction processing server. The transaction processing server uses the master key KEK and the TID to generate the same key TK. The transaction processing server uses the key TK to decrypt the transaction data [8].

PKCS #11 is a cryptography standard that defines an API for security devices, such as smart cards and security tokens. This interface allows applications to communicate with security devices to perform cryptographic operations, such as key generation, encryption, and digital signing. The main elements of PKCS #11 are [9]:

Session: A session is established between the application and the security device to perform cryptographic operations.Objects: Objects are entities that contain security information, such as keys, certificates, and encrypted data.Methods: Methods are functions that perform cryptographic operations on objects, such as key generation, encryption, and digital signatures.

PKCS #11 provides a standard interface for security devices, allowing applications to communicate with different types of security devices without knowing the details of their implementation [10]. DUKPT and PKCS #11 are used in mobile payments to ensure transaction security.

The PCI-DSS is a set of security standards designed to protect credit and debit cardholder information. They are required by all organizations that accept, process, or store payment card information. The main objectives and requirements of the PCI-DSS include [11]:

Cardholder data security: Protect sensitive data through encryption, secure storage, and secure transmission protocols.Access controls: Limit access to cardholder data to authorized individuals only.Network monitoring and assessment: Implement monitoring measures to detect and prevent unauthorized access [12].Regular system and network testing: Conduct security tests to identify potential vulnerabilities.

The PCI-PA DSS is a complementary standard to PCI-DSS, specific to mobile payment applications. It aims to ensure that payment processing applications are designed and maintained securely. Key requirements include [13]:

Application integrity and security: Ensure that payment applications do not store sensitive cardholder information in a non-compliant manner.Secure development: Follow secure development processes to minimize vulnerabilities in the code.Updates and patch management: Keep applications up to date to protect against new vulnerabilities.

TQM is a quality management approach that focuses on the continuous improvement of processes, products, and services. In the context of mobile payment terminals, TQM involves [14]:

Quality Assessment and Assurance: Ensure that payment terminals meet high quality standards and operate correctly. Training and awareness: Train staff to use and maintain systems effectively to reduce errors and improve customer satisfaction. Continuous process improvement: Identify areas for improvement through performance analysis and feedback.

Each of these standards plays a vital role in payment transaction security and quality management. PCI-DSS and PCI-PA DSS focus on the security of payment data and applications, while TQM aims to ensure the quality of payment terminals and associated processes. In short, they help strengthen consumer trust and the security of payment systems.

3.1.1. Regression Models

Regression models (linear, logistic, etc.) can be used to predict dependent variables based on explanatory variables.

where: Y is the variable to be predicted, β 0 is the y-intercept, β i are the coefficients of the explanatory variables X i , ϵ is the random error.

3.1.2. Time Series Models

Time series can be used to analyze transactions over time, allowing the identification of trends, seasonality, or irregularities in trading volume. An ARIMA (AutoRegressive Integrated Moving Average) model, for example, can be formulated as follows:

where: Y t is the value of the variable at time t , ϕ and θ are the parameters of the autoregressive parts and the moving averages, respectively, ϵ t is the error term at time t .

The total system cost C defined in Equation (1) is directly influenced by the regression variables. The cryptographic complexity X 1 impacts the security cost component C s , which includes the implementation of post-quantum algorithms, key management, and protocol updates. Similarly, the resource availability variable X 3 affects both fixed costs C f and variable costs C t , as more capable devices require higher infrastructure investment and operational resources. Accordingly, the cost function can be abstractly expressed as:

Subject to the budgetary constraints defined by B f , B t , and the minimum security requirement S m i n . The regression model enables the identification of configurations of X 1 and X 3 that maximize Y while satisfying these constraints. The total transaction time T described in Equation (3) is strongly correlated with the regression variables X 1 , X 2 , and X 3 . An increase in cryptographic complexity X 1 typically leads to higher encryption and decryption times ( T e n c and T d e c ), while network latency modeled by X 2 directly influences the transmission time T t r a n s . Additionally, limited device resources represented by X 3 may further increase processing delays. This relationship can be formulated as:

The regression model estimates the relative contribution of each variable in meeting the time constraints E m a x and D m a x , providing a quantitative basis for balancing security and performance in mobile IoT payment systems. The global security level S introduced in Equation (5) is conceptually aligned with the dependent regression variable Y . The parameters A , P , and L , representing algorithmic strength, security protocols, and protection layers, are abstractly captured by the variables X 1 and X 3 . The observed security outcome Y can therefore be interpreted as an empirical estimation of S under cost and time constraints. The regression model is defined as:

This formulation acts as a linear approximation of the security function S = f ( A , P , L ) , enabling the evaluation of trade-offs between security, cost, and performance. Maximizing Y under the constraints specified in Equations (2), (4), and (6) allows the system to achieve an optimal configuration adapted to resource-constrained IoT environments.

Statistical methods are essential for anomaly detection, which is crucial for identifying suspicious or malicious behavior in a payment system.

a. Detection based on Descriptive Statistics

Descriptive statistics are used to define thresholds. Transactions that fall outside these thresholds can be considered anomalies [15]. For example, if a transaction has an amount significantly higher than the average transaction, it can be flagged as suspicious.

b. Detection Based on Multivariate Methods

Multivariate techniques, such as principal component analysis, can help reduce the dimensionality of transaction data while preserving essential features. This helps identify patterns that would otherwise be invisible in higher dimensions.

where: Z is the standardization score, x is the original value, μ is the mean, σ is the standard deviation. Data with extreme Z scores can be considered anomalies.

Models based on probability theory can be used to assess the risk associated with specific transactions, taking into account user behavior histories.

where: R is the total risk, P ( ⋅ ) is the probability of an event, C ( ⋅ ) is the cost associated with this event.

a. Performance Evaluation

Statistical tests can be used to evaluate the performance of algorithms (such as NTRU and FALCON) under varying conditions, measuring metrics such as processing time and resource consumption. Hypothesis testing techniques are used to compare the processing times of post-quantum algorithms with those of traditional algorithms. For example, a two-sample t-test can be used:

where μ 1 is the average processing time of a post-quantum algorithm and μ 2 that of a traditional algorithm.

b. Statistical Reliability

The reliability of algorithms can also be assessed by measuring performance parameters such as failure rate, accuracy, and robustness against attacks. Failure Rate:

Figure 1. Modelling the data encryption and decryption process.

Encrypted data is transmitted, ensuring confidentiality. To decrypt the data, the recipient uses their private key to retrieve the original information from the encrypted data. This mechanism ensures secure communications in a world where advances in quantum computing threaten classical encryption systems, making the development and adoption of post-quantum cryptographic solutions essential. [16] (Figure 1).

Figure 2. Modelling the secure communication process between Bob and Alice.

With

A: Alice;

B: Bob;

M: message space;

C: cryptogram space;

K: key space.

This will enable us to have an encryption function and a decryption function [17]. That is,

Which is an encryption function when the message is sent between the two parties, and

Which gives Bob a decryption function to find out the contents of the secret message. If two parties want to exchange information confidentially, they must first exchange a secret key securely [16]. Once kA = kB, the encryption will be symmetrical with m being the clear message as defined in the diagram above, so the secret depends on k being the key, otherwise the messages at Alice’s (A) and Bob’s (B) are public (Figure 2).

1) Start.

2) Define n (number of explanatory variables).

3) Set the random seed.

4) Initialize β 0 .

5) Generate a beta array of random coefficients of size n .

6) Generate an array x of dimensions (100, n ) with random values.

7) Generate a random noise epsilon of length 100.

8) Calculate Y = β 0 + ∑ ( x i ∗ β i ) + ϵ for i from 1 to n .

9) Create a DataFrame with columns x 1 , x 2 , ⋯ , x n and Y .

10) Display the first rows of the DataFrame.

11) End.

In this study, the data presented in this table are synthetically generated in order to model key parameters influencing the security of mobile payment systems in IoT networks, particularly in a post-quantum cryptography context. Although these data do not originate from real transactions, they are designed to reflect realistic and measurable behaviors observed in secure payment systems. The explanatory variables are defined as follows. Within this framework, the linear regression model enables the analysis of the relative influence of each parameter X 1 , X 2 , and X 3 , on the overall transaction security level Y . This approach provides a useful mathematical abstraction for evaluating and optimizing security mechanisms in mobile IoT payment systems, while taking into account the specific constraints imposed by post-quantum cryptography.

To analyze the experimental results based on the data set used, which contains three explanatory variables X 1 , X 2 , X 3 , and one target variable Y , several statistical and regression analyses can be performed. Before proceeding with advanced analyses, a good starting point is descriptive data analysis. With mean of Y : Y ¯ ≈ 2.7439 , standard deviation of Y : σ Y ≈ 0.0865 , minimum of Y : 2.597397, maximum of Y : 2.828111. A strong positive correlation between X i and Y shows that the explanatory variables have a positive impact on ( Y ). r ( X 1 , Y ) ≈ 0.421 , r ( X 2 , Y ) ≈ 0. 525 , r ( X 3 , Y ) ≈ 0. 218 . A linear regression model was fitted to predict Y based on X 1 , X 2 and X 3

Regression coefficient: β 0 ≈ 2.5 , β 1 ≈ 0.5 , β 2 ≈ 0.3 , β 3 ≈ 0.1 . The coefficient of determination R 2 ≈ 0.75 indicates that 75The positive and negative results suggest that the model has a good fit and that there is no apparent trend in the results. The t-test for β 1 , β 2 , and β 3 shows that all are significantly different from zero at a significance level of 0.05 p < 0.05 . The experimental results from this analysis indicate that there are significant relationships between the variables X 1 , X 2 , X 3 , and the target variable Y . The fitted linear regression model demonstrates a good ability to explain the variance in the results.

The representation of plaintext using multivariate systems provides a structured analytical framework for understanding how multiple security-related parameters jointly influence the robustness of mobile IoT payment transactions. In this study, the variables X 1 , X 2 , and X 3 abstractly model cryptographic complexity, communication latency, and device resource availability, while the target variable Y represents an aggregated security performance indicator. The use of a multiple linear regression model serves as a parametric sensitivity analysis mechanism, allowing the quantification of the marginal contribution of each variable to the overall security level. The fact that the model explains approximately 75% of the variance in Y indicates that a significant portion of security behavior can be captured through linear combinations of these parameters. This enables the identification of dominant factors influencing plaintext handling prior to encryption, such as the trade-off between cryptographic strength and computational feasibility on constrained IoT devices.

From an optimization perspective, the regression coefficients can be interpreted as weights guiding adaptive plaintext representation strategies. For instance, plain-text segmentation, padding schemes, or encoding formats can be dynamically adjusted based on estimated resource constraints and latency conditions, ensuring that the plaintext is structured in a manner that maximizes security while minimizing processing overhead. Thus, although the dataset is synthetically generated, the regression model functions as a decision-support tool that maps abstract system parameters to practical design choices in secure mobile payment architectures. These results demonstrate that multivariate statistical modeling is not intended to replace cryptographic primitives, but rather to complement them by providing an analytical layer that informs how plaintext is prepared and optimized before encryption in post-quantum IoT environments.

The multivariate representation of ciphertext focuses on analyzing how system-level parameters collectively influence the resilience of encrypted transactions against both classical and quantum-enabled attacks. In this context, the regression model captures the relationship between the abstract variables X 1 , X 2 , and X 3 and the resulting security metric Y , which reflects ciphertext robustness, resistance to cryptanalysis, and operational stability. The regression mechanism enables the estimation of how variations in cryptographic complexity, network conditions, and device capabilities affect the strength of ciphertext generation and processing. By explaining 75% of the variance in Y , the model provides empirical evidence that these parameters play a substantial role in determining encryption effectiveness. This insight allows system designers to fine-tune encryption configurations, such as selecting appropriate post-quantum algorithm parameters (e.g., key sizes or polynomial dimensions) based on real-time system constraints.

Furthermore, the linear regression model supports adaptive security control, where encryption parameters are dynamically adjusted to maintain an optimal balance between security and performance. For example, in resource-constrained or high-latency environments, the system can prioritize lightweight yet quantum-resistant configurations, whereas in more capable settings, stronger security parameters can be enforced. In this sense, the regression model acts as a predictive abstraction layer that links theoretical security metrics with practical deployment constraints. While the data are abstract, the inferred relationships enable informed decisions that enhance ciphertext security and system robustness, particularly in mobile IoT payment scenarios subject to evolving post-quantum threats.

The rise of mobile payments and the expansion of the IoT are key trends in the current digital transformation. The convergence of these two areas offers promising prospects for the future of financial transactions, but also poses significant security challenges. Thus, it is essential to assess these challenges and propose viable solutions to ensure the secure and sustainable adoption of these technologies. Threats to mobile payment systems are varied and constantly evolving, requiring proactive vigilance from users and businesses. Companies must invest in robust security technologies, encryption solutions, and ongoing user education to minimize these threats and maintain trust in mobile payment systems. Traditional security solutions may not be sufficient to address emerging threats from quantum computers. Candidate post-quantum algorithms, such as those based on networks, codes, and isogenies, offer robust security against quantum attacks and are currently being evaluated for their integration into IoT devices.

Future work in the field of securing mobile payments in IoT networks, taking into account post-quantum challenges and solutions, should focus on several key areas. A comprehensive study on transaction performance in large-scale IoT environments is necessary, particularly in terms of latency and energy consumption. Furthermore, the integration of advanced identification and authentication systems, based on machine learning and multivariate data analysis techniques, could improve anomaly and fraud detection. Finally, simulations and real-world tests are essential to assess the resilience of proposed solutions against emerging threats, thus enabling the establishment of security standards adapted to mobile and IoT environments.