A Stochastic Framework for Evaluating Key Management Schemes in Dynamic Linear-Hierarchy Internet of Things Systems

The Internet of Things (IoT) has significantly transformed the design and operation of modern infrastructures by enabling a tight integration between the physical and digital worlds [1]. Through the interconnection of billions of sensors, devices, and actuators, IoT systems now support a wide range of critical applications, including smart cities [2], intelligent transportation [3], precision agriculture [4], and energy networks [5]. This pervasive deployment has created new opportunities for automation, monitoring, and data-driven decision making. However, it has also introduced a broad and complex threat landscape. As IoT systems continue to grow in scale and heterogeneity, they generate and exchange large volumes of sensitive data that must be protected against unauthorized access and malicious manipulation. Therefore, ensuring strong security guarantees while preserving data privacy has become a major concern for both researchers and practitioners [6]. If these issues are not properly addressed, IoT deployments may suffer from serious consequences, including privacy leakage, large-scale data breaches, and even disruptions of critical infrastructures [7].

Among the different security mechanisms required to protect IoT environments, Key Management Schemes (KMSs) play a fundamental role [8]. A KMS is responsible for generating, distributing, updating, and revoking cryptographic keys so that only authorized entities can access protected data and services. In many practical IoT applications, especially in industrial and military environments, access control is not flat, but rather hierarchical [9]. In such settings, entities are organized into ordered security classes according to their access privileges. In particular, linear hierarchical structures represent an important class of access control models in which each upper-level class is allowed to access its own data as well as the data of lower-level classes, whereas the reverse direction must be strictly prohibited. In these systems, two requirements are generally imposed. The first one is intra-class accessibility, where all members of the same class share a common group key to communicate securely within that class. The second one is inter-class derivation, where a user belonging to a higher security class can derive the keys of lower classes without requiring additional credentials. Consequently, a well-designed KMS for such environments must satisfy important security requirements [10], including confidentiality, forward secrecy, backward secrecy, and resistance against collusion.

Designing efficient KMSs for hierarchical IoT systems remains a challenging task due to both device limitations and the dynamic nature of these environments. Indeed, IoT nodes may frequently join or leave the system because of mobility, maintenance operations, battery depletion, connectivity variations, or role changes. Such membership dynamics require repeated key update operations in order to maintain the desired security properties. In recent years, several KMSs have been proposed to address these issues, including the Secure and Efficient Key Management Scheme for Internet of Things (SEKM-IoT) [9]. Although these schemes provide interesting solutions, their evaluation is often conducted under simplified assumptions. More precisely, many existing studies rely on static configurations or short-duration simulations, which do not adequately capture the cumulative and stochastic effects of continuous membership changes over long-term system operation. As a result, there is still a need for rigorous analytical frameworks capable of evaluating the long-term behavior, scalability, and overhead of hierarchical KMSs in dynamic IoT environments.

In this paper, we address this gap by proposing a stochastic framework for evaluating KMSs in dynamic linear-hierarchy IoT systems. Unlike conventional deterministic analyses, the proposed framework models the system evolution as a probabilistic process, which makes it possible to characterize the impact of user joins and leaves on the long-term behavior of the considered scheme. More specifically, the framework relies on Markov chains and Poisson processes to capture the stochastic dynamics of class membership and their effect on key management operations. In this way, the proposed approach provides a more realistic and rigorous basis for analyzing how security overheads evolve over time in steady-state conditions. To demonstrate its applicability, we instantiate the framework using SEKM-IoT as a representative case study, and we show how the obtained analytical results can support deployment decisions in resource-constrained IoT environments.

The main contributions of this paper can be summarized as follows:

•We develop a reusable stochastic evaluation workflow based on Markov chains and Poisson processes for dynamic linear-hierarchy KMSs. The workflow separates generic modeling steps from protocol-specific state-transition and overhead definitions.

•We define dedicated probabilistic models for the Key Continuity Process (KCP) and the Class Key Distribution Process (CKDP), thereby enabling a fine-grained analysis of both inter-class and intra-class key management behavior over time.

•We instantiate the proposed framework on the SEKM-IoT protocol and derive asymptotic expressions for its storage, computation, and communication overheads, thus demonstrating the ability of the framework to assess the scalability of hierarchical KMSs.

•We present a comparative evaluation with representative state-of-the-art schemes and show that the analyzed approach provides good scalability and efficiency, which makes it suitable for large-scale and dynamic IoT deployments.

Although SEKM-IoT is used as the case study in this paper, the proposed stochastic evaluation approach is not restricted to this scheme. It can be adapted to other dynamic hierarchical KMSs by defining the corresponding membership-update behavior and overhead metrics.

The remainder of this paper is organized as follows. Section 2 reviews the related work on KMSs for IoT systems and on the use of stochastic analysis in security. Section 3 presents the necessary background on SEKM-IoT, Markov chains, and Poisson processes. Section 4 details the proposed stochastic framework. Section 5 presents the analytical results and discusses the main findings. Section 6 compares the obtained results with those of previous works. Finally, Section 7 concludes the paper and outlines future research directions.

This section presents the background required for the development of the proposed framework. First, we describe the dynamic linear-hierarchy IoT model considered in this paper. Then, we present the LKH mechanism used to support efficient intra-class rekeying, followed by the SEKM-IoT scheme adopted as a representative KMS for dynamic linear-hierarchy IoT systems. Finally, we review the main concepts related to Markov chains and Poisson processes that will be used in the stochastic modeling.

3.1 Dynamic linear-hierarchy Internet of Things model

In this paper, we consider an IoT system organized according to a dynamic linear hierarchy of security classes. Let $\left(C_1, C_2, \ldots, C_N\right)$ denote the set of classes, where $C_1$ is the highest class and $C_N$ is the lowest one. Each class $C_j$ contains a set of members sharing the same access privilege level, and is associated with a class key $\mathrm{CK}_j$ used to secure intra-class communications.

The considered hierarchy follows a linear access-control structure. More precisely, a member belonging to a higher class is authorized to access the data and communications of lower classes, whereas a member of a lower class is not allowed to access the information of upper classes. Therefore, the key management process must preserve both local secure communication inside each class and hierarchical accessibility across classes.

The system is assumed to be dynamic. Indeed, members may join or leave their classes over time because of mobility, operational changes, maintenance activities, or connectivity conditions. These membership changes require the corresponding class keys to be updated in order to preserve forward secrecy and backward secrecy. In addition, when a class key is updated, the key accessibility relation between the affected class and the lower classes must remain consistent with the hierarchy.

A KS is responsible for managing the cryptographic material of the system. More precisely, the KS generates the individual keys and class keys, distributes them securely to the legitimate members, and performs the required rekeying operations whenever a membership change occurs. In this way, the KS ensures that the hierarchical access-control policy remains correctly enforced over time.

Figure 1 illustrates the dynamic linear-hierarchy IoT model considered in this paper.

tu_pian_1.png

Figure 1. Linear-hierarchy Internet of Things (IoT) model

3.2 Logical Key Hierarchy

In hierarchical IoT systems, secure intra-class communication is a fundamental requirement. Since members of the same class need to exchange data securely, they must share a common class key. This class key must be updated whenever a member joins or leaves the class in order to preserve important security properties such as forward secrecy and backward secrecy. One of the most relevant and widely used mechanisms for handling such updates efficiently is the LKH protocol.

LKH is a tree-based group key management mechanism managed by a KS. In this structure, the root node represents the class key, while the leaf nodes correspond to the individual keys of the members. The internal nodes store intermediate cryptographic keys that are used as key encryption keys in the rekeying process. This structure enables efficient multicast-based key updates and avoids the need for unicast transmission to all group members.

To explain how LKH works, let us consider a key tree composed of seven members, $\left\{m_1, m_2, \ldots, m_7\right\}$, as shown in Figure 2(a). In this tree, the member $m_2$ stores the set of keys located on the path from its leaf to the root, namely $\left\{k_2, k_{12}, k_{14}, \mathrm{CK}\right\}$. When a membership change occurs, only the keys located on the affected path need to be updated. Therefore, the communication and computation overhead of the rekeying process can be significantly reduced compared with flat group key management approaches.

2.png

Figure 2. Logical Key Hierarchy (LKH) scheme: (a) LKH key tree with seven members, (b) LKH key tree when $m_8$ joins, and (c) LKH key tree when $m_3$ leaves

3.2.1 Member join scenario

Let us consider the scenario shown in Figure 2(b), where a new member $m_8$ joins the group. First, the KS establishes a secure channel with $m_8$ and shares with it an individual key $k_8$. Then, in order to preserve backward secrecy, the KS updates the keys located on the affected path and generates the new keys $\left\{k_{78}, k_{58}, \mathrm{CK}^{\prime}\right\}$. These keys are then distributed securely as follows:

$\begin{aligned} & \mathrm{KS} \rightarrow\left\{m_7\right\}: \operatorname{Enc}\left(k_{78}, k_7\right), \operatorname{Enc}\left(k_{58}, k_{78}\right), \\ & \mathrm{KS} \rightarrow\left\{m_5, m_6\right\}: \operatorname{Enc}\left(k_{58}, k_{56}\right), \\ & \mathrm{KS} \rightarrow\left\{m_5, m_6, m_7\right\}: \operatorname{Enc}\left(\mathrm{CK}^{\prime}, k_{58}\right), \\ & \mathrm{KS} \rightarrow\left\{m_1, m_2, m_3, m_4\right\}: \operatorname{Enc}\left(\mathrm{CK}^{\prime}, k_{14}\right) .\end{aligned}$

3.2.2 Member leave scenario

Now, let us consider the leave scenario depicted in Figure 2(c), where the member $m_3$ leaves the group. In this case, the key $k_{34}$ is removed, and the keys $\left\{k_{14}, \mathrm{CK}^{\prime}\right\}$ are updated to $\left\{k^{\prime}{ }_{14}, \mathrm{CK}^{\prime \prime}\right\}$ in order to preserve forward secrecy. The updated keys are distributed as follows:

$\begin{gathered}\mathrm{KS} \rightarrow\left\{m_4\right\}: \operatorname{Enc}\left(k_{14}^{\prime}, k_4\right), \\ \mathrm{KS} \rightarrow\left\{m_1, m_2\right\}: \operatorname{Enc}\left(k_{14}^{\prime}, k_{12}\right), \\ \mathrm{KS} \rightarrow\left\{m_1, m_2, m_4\right\}: \operatorname{Enc}\left(\mathrm{CK}^{\prime \prime}, k_{14}^{\prime}\right), \\ \mathrm{KS} \rightarrow\left\{m_5, m_6, m_7, m_8\right\}: \operatorname{Enc}\left(\mathrm{CK}^{\prime \prime}, k_{58}\right) .\end{gathered}$

A major advantage of LKH is that it naturally supports multicast rekeying. Instead of sending the new class key separately to each member, KS can encrypt it with an intermediate key shared by a subgroup of members and transmit it once to all of them. In this way, LKH reduces the communication overhead from a linear cost to a logarithmic one. More precisely, for a balanced binary tree containing $n$ members, the communication and computation overheads of rekeying are of order $O(\log n)$, and each member stores at most $1+\log _2(n)$ keys.

3.3 Secure and Efficient Key Management Scheme for Internet of Things scheme

SEKM-IoT [9] was proposed to support secure and efficient key management in dynamic linear-hierarchy IoT systems. The scheme considers a set of ordered security classes ($C_1, C_2, \ldots, C_N$), where $C_1$ is the highest class and $C_N$ is the lowest one. In such a hierarchy, each class must be able to communicate securely within itself, while higher classes must also be able to access the keys of lower classes. For this reason, SEKM-IoT combines two complementary mechanisms: an LKH-based structure for intra-class key management and a hash-based derivation process for inter-class accessibility.

More precisely, each class maintains its own LKH key tree. The root of this tree is the class key, while the leaves correspond to the individual keys of the class members. Therefore, if a member belongs to class $C_j$, it stores its own individual key together with the keys located on the path from its leaf to the root. In this way, when a member joins or leaves class $C_j$, the LKH rekeying process is applied locally inside this class in order to generate a new version of the class key efficiently.

At the inter-class level, SEKM-IoT relates the class keys through a one-way hash chain. Starting from the class key of an upper class, the key of the next lower class is obtained by applying the hash function once. Thus, the class keys satisfy the relation.

$\mathrm{CK}_{i+1}=\mathcal{H}\left(\mathrm{CK}_i\right)$.

Consequently, a member of class $C_j$ can derive the keys of lower classes by applying the hash function repeatedly, whereas a member of a lower class cannot derive the key of an upper class because of the one-way property of the hash function.

Initially, the KS establishes an individual key with each member through a secure key exchange process. Then, it builds the LKH tree of each class and assigns the corresponding class key to its root. Once a member receives its class key, it can derive the keys of lower classes whenever authorized. Since class keys are updated after membership changes, we denote by $\mathrm{CK}_j^p$ the class key of class $C_j$ after $(p-1)$ updates, where $\mathrm{CK}_j^1$ is the initial version.

When a member $m_i^j$ joins or leaves class $C_j$, a rekeying process is triggered. This process affects not only class $C_j$, but also all lower classes $C_l$, where $C_l \leq C_j$. Otherwise, a joining member could access old traffic of lower classes, or a leaving member could retain access to future traffic. Therefore, SEKM-IoT updates the key of the affected class and propagates the update to the lower classes accordingly.

The rekeying process of SEKM-IoT can be summarized as follows:

Step 1: The member $m_i^j$ is inserted into or removed from the LKH key tree of class $C_j$, and the LKH rekeying process generates a new class key $\mathrm{CK}_j^{p+1}$.

Step 2: The KS computes the new keys of all lower classes $C_l$, where $C_M \leq C_l<C_j$, by applying the hash function recursively: $\mathrm{CK}_l^{p+1}=\mathcal{H}\left(\mathrm{CK}_{l-1}^{p+1}\right)$.

Step 3: The KS securely distributes each newly generated class key to the corresponding members of the lower classes by using the appropriate shared keys of their LKH trees. In practice, the keys associated with the direct children of the root are used to ensure efficient and secure multicast distribution.

Step 4: The KS sends an update message to each upper class $C_k$, where $C_j<C_k$, in order to notify them of the new version of $\mathrm{CK}_j$. More precisely, the pair $P_j=\left(j, \mathrm{CK}_j^{p+1}\right)$ is encrypted with the class key of the corresponding upper class and sent securely to its members.

Step 5: Upon receiving the update message, the members of the upper classes update their class-keys table so that subsequent key derivations remain synchronized with the new hierarchy state.

The role of the update message is particularly important. Indeed, when the key of class $C_j$ is modified, the members of higher classes cannot derive the new version of $\mathrm{CK}_j$ directly from their previously stored information, because the new key is generated through the local LKH rekeying process and not directly from the previous class key. For this reason, each member maintains a class-keys table that is updated whenever such a notification is received. When the member needs to derive the key of a lower class, it consults this table and starts the derivation from the most recent available class key.

3.3.1 Example of rekeying in Secure and Efficient Key Management Scheme for Internet of Things

Let us consider the example of a smart city IoT infrastructure composed of five classes $(N=5)$. Assume that the member $m_8^3$ leaves class $C_3$. As shown in Figure 3, the KS first applies the LKH rekeying process to the key tree of class $C_3$. As a result, the key $k_{78}^3$ is deleted and the keys $\left\{k_{58}^3, \mathrm{CK}_3^1\right\}$ are updated to $\left\{k_{58}^{\prime 3}, \mathrm{CK}_3^2\right\}$. The updated keys are then distributed securely as follows:

$\begin{aligned} & \mathrm{KS} \rightarrow\left\{m_7^3\right\}: \operatorname{Enc}\left(k_{58}^{\prime 3}, k_7^3\right), \\ & \mathrm{KS} \rightarrow\left\{m_5^3, m_6^3\right\}: \operatorname{Enc}\left(k_{58}^{\prime 3}, k_{56}^3\right), \\ & \mathrm{KS} \rightarrow\left\{m_5^3, m_6^3, m_7^3\right\}: \operatorname{Enc}\left(\mathrm{CK}_3^2, k_{58}^{\prime 3}\right), \\ & \mathrm{KS} \rightarrow\left\{m_1^3, m_2^3, m_3^3, m_4^3\right\}: \operatorname{Enc}\left(\mathrm{CK}_3^2, k_{14}^3\right) .\end{aligned}$

3.png

Figure 3. Example of rekeying process in Secure and Efficient Key Management Scheme for Internet of Things (SEKM-IoT) [9]

Then, the keys of the lower classes $C_4$ and $C_5$ are recomputed from the updated key $\mathrm{CK}_3^2$ as follows:

$\mathrm{CK}_4^2=\mathcal{H}\left(\mathrm{CK}_3^2\right), \mathrm{CK}_5^2=\mathcal{H}\left(\mathrm{CK}_4^2\right)$.

These new keys are then securely transmitted to the corresponding members of classes $C_4$ and $C_5$ by using the appropriate shared keys of their LKH trees.

In addition, the pair $P_3=\left(3, \mathrm{CK}_3^2\right)$ is securely sent to the members of the upper classes $C_1$ and $C_2$, so that they can update their class-keys tables accordingly. At the end of the process, the members of upper classes can still derive the keys of lower classes correctly by using their updated tables. For instance, a member of $C_1$ can use the updated entry associated with class $C_3$, and then apply the hash function repeatedly in order to derive the keys of classes $C_4$ and $C_5$.

From the above, it can be observed that SEKM-IoT provides an interesting trade-off between security and efficiency. On the one hand, it uses LKH to support efficient intra-class rekeying. On the other hand, it preserves hierarchical access control by linking the class keys through a one-way hash-based derivation process. For this reason, SEKM-IoT constitutes a representative case study for the stochastic framework proposed in this paper.

3.4 Markov chains

Stochastic processes provide the mathematical framework for modeling systems whose behavior evolves over time in a probabilistic manner. Among these processes, Markov chains constitute an important class of models in which the future evolution of the system depends only on its current state and not on the past history. This characteristic is known as the Markov property [34].

Let $X_t$ denote the state of the system at time $t$, and let $S=\left\{s_1, s_2, \ldots, s_n\right\}$ be the state space. The Markov property is expressed as follows:

$\begin{gathered}P\left(X_{t+1}=s_j \mid X_t=s_i, X_{t-1}, \ldots, X_0\right)=P\left(X_{t+1}=s_j \mid X_t=s_i\right)\end{gathered}$     (1)

In the discrete-time setting, the evolution of the system is characterized by a transition probability matrix $P=\left[p_{i, j}\right]$, where each entry $p_{i, j}$ denotes the probability of moving from state $s_i$ to state $s_j$ during one observation interval. Therefore,

$p_{i, j}=P\left(X_{t+1}=s_j \mid X_t=s_i\right)$            (2)

with

$\sum_{j \in S} p_{i, j}=1, \forall i \in S$         (3)

Let $\pi_t=\left(\pi_t(1), \ldots, \pi_t(n)\right)$ denote the state probability distribution at time $t$, where $\pi_t(i)=P\left(X_t=s_i\right)$. Then, the evolution of the distribution over time is governed by the transition matrix $P$.

A Markov chain is said to be homogeneous when its transition probabilities do not depend explicitly on time. It is said to be irreducible when every state can be reached from every other state through a sequence of transitions with non-zero probability. These properties are important because they determine the existence and uniqueness of the long-term equilibrium distribution.

The long-term behavior of the system is described by the stationary distribution $\pi$, which satisfies

$\pi P=\pi, \sum_{i \in S} \pi(i)=1$               (4)

If the chain is irreducible and aperiodic and the state space is finite, then the stationary distribution exists and is unique. In that case, it characterizes the asymptotic proportion of time spent in each state. This property is particularly useful in the present work, since the proposed framework aims at evaluating the long-term behavior of KMSs under stochastic membership dynamics.

3.5 Poisson processes

To model the occurrence of random events over time, such as member joins and leaves, we rely on the Poisson process [35]. A Poisson process is a stochastic process used to represent the number of discrete events occurring during a given time interval, under the assumption that these events occur independently and at a constant average rate.

Let $N(t)$ denote the number of events occurring during the interval $[0, t]$, and let $\lambda>0$ be the average event rate. Then, the probability of observing exactly $k$ events during the time interval $t$ is given by

$P(N(t)=k)=\frac{(\lambda t)^k}{k!} e^{-\lambda t}$          (5)

A fundamental property of the Poisson process is that the numbers of events occurring in disjoint time intervals are independent. In addition, the inter-arrival times between consecutive events are exponentially distributed with parameter $\lambda$. This memoryless property makes the Poisson process particularly suitable for modeling random and uncorrelated membership changes in dynamic IoT systems.

In the context of this paper, the Poisson process is used to model the stochastic occurrence of join and leave events during a given observation interval. These event counts are then used to define the transition probabilities of the Markov chains representing the behavior of the considered KMS. Combined with the Markov-chain formulation, this process provides the basis for analyzing the long-term impact of membership dynamics on the storage, communication, and computation overheads.

In this section, we present the stationary results obtained from the KCP and CKDP models introduced in Section 4. All numerical settings used in the evaluation are summarized in Table 2. The baseline configuration considers homogeneous membership dynamics across classes in order to isolate the effect of the hierarchy size and the class size on the considered overheads.

Table 2. Baseline parameter settings used for the stationary evaluation

Note: Logical Key Hierarchy (LKH), Key Continuity Process (KCP), Class Key Distribution Process (CKDP).

5.1 Evaluation settings

Each class is assumed to experience independent Poisson join and leave processes with identical rates. The baseline choice ${{\lambda }_{J}}={{\lambda }_{L}}=0.05{{\text{ s}}^{-1}}$ corresponds to an aggregate membership update rate of $0.10{{\text{ s}}^{-1}}$ per class. This balanced configuration avoids systematic population growth or shrinkage and provides a reference setting for the stationary analysis.

For the KCP, the stationary continuity is evaluated for all starting classes ${{C}_{j}}$, with $j\in \left\{ 1,\ldots ,N \right\}$, and the reported hierarchy-level result is the mean continuity over all possible starting classes. For the CKDP, the maximum class size varies from $M=1$ to $M~=\text{ }\!\!~\!\!\text{ }400$, and a binary LKH tree is considered. All reported values correspond to steady-state quantities; therefore, they do not depend on an arbitrary initial state.

5.2 Event-driven simulation validation

To validate the stationary analysis, we developed an independent event-driven Monte Carlo simulator. The simulator directly generates the Poisson-driven membership-update process and applies the corresponding update rules in continuous time. It does not use the transition matrices or the stationary solvers of the analytical framework. Therefore, this validation verifies that the analytical Markov construction reproduces the long-run behavior of the underlying event dynamics under the considered modeling assumptions.

For the KCP, we used 30 independent replications, with a warm-up period of 200 s and an observation period of 1000 s. For the CKDP, 50 independent replications were performed with a warm-up period and an observation period of $5~\times ~{{10}^{5}}$ s, respectively. Table 3 compares the analytical stationary values with the simulation estimates. All analytical values lie within the corresponding 95% confidence intervals, and the maximum absolute relative deviation is below 1.

All numerical results were implemented in Python using the parameter settings reported in Table 2. For the event-driven Monte Carlo validation, a fixed random seed of 20260630 was used.

Table 3. Validation of the stationary analytical results using independent event-driven Monte Carlo simulations. The simulation values are reported as the mean $\pm $ 95% confidence-interval half-width across independent replications

Note: Key Continuity Process (KCP), Class Key Distribution Process (CKDP).

5.3 Storage overhead

According to Eq. (7), the storage overhead of a member is the sum of the keys induced by the inter-class continuity and the local keys induced by the LKH structure. Therefore, the evaluation of the storage overhead requires the analysis of both $\left| {{\mathcal{K}}_{{{C}_{j}}}} \right|$ and $\left| {{\mathcal{K}}_{m_{i}^{j}}} \right|$.

To evaluate the class-related storage component $\left| {{\mathcal{K}}_{{{C}_{j}}}} \right|$, we solve the stationary KCP for each hierarchy size $N$ and for every starting class ${{C}_{j}}$. To summarize the behavior of an entire hierarchy, we define the system-wide mean continuity as

$\bar{C}\left( N \right)=\frac{1}{N}\underset{j=1}{\overset{N}{\mathop \sum }}\,\mathbb{E}\left[ {{C}_{t}}\left( {{C}_{j}} \right) \right]$         (33)

The mean continuity is evaluated for the nine hierarchy sizes reported in Table 2. To quantify its dependence on the hierarchy size, we fit the linear regression model using ordinary least squares. The fitting quality is assessed using the coefficient of determination ${{R}^{2}}$, the mean absolute error (MAE), and the root mean squared error (RMSE).

$\widehat{{\bar{C}}}\left( N \right)=aN+b$          (34)

The resulting regression is

$\widehat{{\bar{C}}}\left( N \right)=0.2500N+0.7500,{{R}^{2}}=1.0000$          (35)

The corresponding fitting errors are $\text{MAE}=1.41\times {{10}^{-14}}$ and $\text{RMSE}=1.41\times {{10}^{-14}}$. These residual values are at the numerical round-off level. This exact agreement results from the homogeneous and symmetric membership-update configuration considered in the baseline analysis. Therefore, under this configuration, the system-wide mean continuity grows linearly with the hierarchy size:

$\bar{C}\left( N \right)\sim \mathcal{O}\left( N \right)$           (36)

Figure 6 illustrates this behavior by showing the system-wide steady-state mean continuity as a function of the number of security classes. The results confirm the linear increase predicted by Eq. (36) under the homogeneous baseline configuration.

The continuity metric reported above characterizes the average residual continuity observed from a starting class. However, the class-related storage overhead is determined by the number of continuity segments rather than by the continuity length alone.

Let ${{\mathcal{H}}_{j}}=\left( {{C}_{j}},{{C}_{j+1}},\ldots ,{{C}_{N}} \right)$ denote the suffix of the hierarchy accessible from class ${{C}_{j}}$, and let ${{S}_{j}}$ denote the number of maximal continuity segments in this suffix. Each segment requires one anchor key. Starting from this anchor, all keys inside the segment can be derived successively through the hash function. Therefore, each continuity break requires one additional anchor key in the class-keys table.

tu_pian_3.png

Figure 6. System-wide steady-state mean continuity $\bar{C}\left( N \right)$ versus the number of security classes under the baseline configuration ${{\lambda }_{J}}={{\lambda }_{L}}=0.05\text{ }\!\!~\!\!\text{ }{{\text{s}}^{-1}}$ and $\Delta t=1~\text{s}$

For example, if the hierarchy contains continuity breaks between ${{C}_{3}}$ and ${{C}_{4}}$, and between ${{C}_{6}}$ and ${{C}_{7}}$, then a member of ${{C}_{1}}$ stores anchor keys for the segments $\left( {{C}_{1}},{{C}_{2}},{{C}_{3}} \right)$, $\left( {{C}_{4}},\text{ }\!\!~\!\!\text{ }{{C}_{5}},\text{ }\!\!~\!\!\text{ }{{C}_{6}} \right)$, and $\left( {{C}_{7}},\ldots ,{{C}_{N}} \right)$. The remaining class keys are obtained through repeated hash applications. Consequently, up to an additive constant associated with the class key already stored in the local LKH tree,

$\left| {{\mathcal{K}}_{{{C}_{j}}}} \right|=\Theta \left( {{S}_{j}} \right)$         (37)

To derive the expected number of segments, let ${{I}_{k}}$ be the indicator of a continuity break before class ${{C}_{k}}$, for $k>j$. Such a break is present when the most recent membership update among classes ${{C}_{1}},\ldots ,{{C}_{k}}$ occurred in ${{C}_{k}}$. Under the homogeneous baseline configuration, the update processes are independent and have identical rates. Therefore, each of the $k$ classes is equally likely to contain the most recent update, which gives

$\text{Pr}\left( {{I}_{k}}=1 \right)=\frac{1}{k}$            (38)

The number of continuity segments accessible from class ${{C}_{j}}$ is thus

${{S}_{j}}=1+\underset{k=j+1}{\overset{N}{\mathop \sum }}\,{{I}_{k}}$            (39)

Taking the expectation yields

$\mathbb{E}\left[ {{S}_{j}} \right]=1+\underset{k=j+1}{\overset{N}{\mathop \sum }}\,\frac{1}{k}=1+{{H}_{N}}-{{H}_{j}}$      (40)

where, ${{H}_{n}}=\underset{r=1}{\overset{n}{\mathop \sum }}\,1/r$ is the $n$th harmonic number. Since ${{H}_{n}}\text{ }\!\!~\!\!\text{ }=\text{ }\!\!~\!\!\text{ }\Theta \left( \text{log}n \right)$, the expected class-related storage overhead is

$\mathbb{E}\left[ \left| {{\mathcal{K}}_{{{C}_{j}}}} \right| \right]=\mathcal{O}\left( \text{log}\left( \frac{N}{j} \right)+1 \right)$         (41)

Thus, the inter-class storage contribution grows logarithmically with the hierarchy size. In the practical IoT regime considered in this work, the number of security classes is substantially smaller than the maximum number of members in a class, i.e., $N\ll M$. Therefore, this inter-class component does not change the dominant storage order when combined with the local LKH component.

To evaluate the local storage component $\left| {{\mathcal{K}}_{m_{i}^{j}}} \right|$, we solve the stationary class-population process for each maximum class size $M$. The resulting distribution characterizes the long-term probability of each population state. For every population state, the number of locally stored keys is obtained from the corresponding balanced binary LKH-tree depth.

tu_pian_4.png

Figure 7. Expected number of local Logical Key Hierarchy (LKH) keys per member versus the maximum class size $M$ for a balanced binary LKH tree

tu_pian_5.png

Figure 8. Analytical local-key storage values and their logarithmic fit as a function of the maximum class size $M$

Figure 7 shows that the expected number of local LKH keys increases slowly with the maximum class size. Figure 8 compares the analytical values with a least-squares logarithmic fit. The resulting approximation is

$\mathbb{E}\left[ {{K}^{\left( j \right)}} \right]=0.9412\text{lo}{{\text{g}}_{2}}\left( M \right)+0.0914,{{R}^{2}}=0.9976$       (42)

The high goodness-of-fit value confirms that the local key-storage component grows logarithmically with the class size. Therefore,

$\left| {{\mathcal{K}}_{m_{i}^{j}}} \right|\sim \mathcal{O}\left( \text{log}M \right)$     (43)

Finally, by combining the inter-class bound in Eq. (41) with the local LKH bound in Eq. (43), the general per-member storage overhead is

$\text{stor}_{i}^{j}=\mathcal{O}\left( \text{log}\left( \frac{N}{j} \right)+1+\text{log}M \right)$         (44)

Since $j\ge 1$ and $N\le M$ in the practical regime considered in this work, we have

$\text{log}\left( \frac{N}{j} \right)+1\le \text{log}N+1=\mathcal{O}\left( \text{log}M \right)$         (45)

Consequently, the overall per-member storage overhead simplifies to

$\text{stor}_{i}^{j}=\mathcal{O}\left( \text{log}M \right)$        (46)

This result shows that the storage overhead remains logarithmic with respect to the maximum class size in the considered regime.

5.4 Scaling evaluation

To assess scalability beyond the moderate ranges illustrated in the previous figures, we extended the stationary evaluation up to $N=10\,000$ security classes and $M=10\,000$ members per class. Table 4 shows that the class-related anchor key requirement at the highest class grows slowly, from $6.5699$ keys for $N=400$ to $9.7876$ keys for $N=10\,000$. Similarly, the expected local LKH storage increases from $8.2753$ keys for $M=400$ to $12.9000$ keys for $M=10\,000$. These results provide a numerical illustration of the logarithmic storage growth at larger scales.

Table 4. Extended-scale stationary results under the baseline configuration. The class-anchor value corresponds to the upper-level class ${{C}_{1}}$

5.5 Sensitivity to membership dynamics

To assess the effect of membership dynamics, we consider five rate configurations: low balanced churn, baseline balanced churn, high balanced churn, join-dominated dynamics, and leave-dominated dynamics. The evaluated rate pairs are summarized in Table 5.

Table 5. Sensitivity of the stationary results to join and leave rate combinations. The reported local-key values correspond to $M~=\text{ }\!\!~\!\!\text{ }100$, while the Key Continuity Process (KCP) continuity value corresponds to $N~=\text{ }\!\!~\!\!\text{ }100$

For the KCP, both join and leave events trigger a class-key update and therefore have the same structural effect on the continuity relation. Under homogeneous rates across classes, the stationary KCP depends on the relative update rates between classes rather than on the common update-rate scale.

Consequently, the stationary system-wide mean continuity remains unchanged across the considered scenarios. For the reference hierarchy size $N=100$, we obtain for all five rate configurations. The absolute update rates affect the transient speed at which the stationary regime is reached, but not the stationary continuity value under the homogeneous assumptions adopted here.

$\bar{C}\left( 100 \right)=25.75$         (47)

In contrast, the CKDP is directly affected by the join-to-leave rate ratio

$\rho =\frac{{{\lambda }_{J}}}{{{\lambda }_{L}}}$             (48)

When $\rho =1$, the stationary population distribution is uniform over the admissible population states, and changing the common scale of ${{\lambda }_{J}}$ and ${{\lambda }_{L}}$ does not modify the steady-state local storage. When $\rho >1$, the population distribution shifts toward the maximum class size, which increases the expected number of local LKH keys. Conversely, when $\rho <1$, the stationary distribution concentrates near the minimum class size and reduces the local storage requirement.

tu_pian_6.png

Figure 9. Sensitivity of the expected local Logical Key Hierarchy (LKH) keys to membership-rate combinations. The balanced curve represents all configurations with ${{\lambda }_{J}}={{\lambda }_{L}}$, which have identical stationary local-storage values

Figure 9 illustrates the effect of these dynamics on the expected local LKH storage over a range of maximum class sizes. The balanced curve represents all balanced configurations, since they lead to identical stationary values. The join-dominated configuration produces higher local storage because the stationary population is concentrated near the upper boundary, whereas the leave-dominated configuration remains close to one local key per member because the population is concentrated near the lower boundary.

5.6 Computation overhead

To evaluate the computation overhead, we rely on the results of both the KCP and the CKDP. Let us consider a hierarchy of $N$ classes, where each class ${{C}_{j}}$ contains at most $M$ members.

5.6.1 Server side

When a member joins or leaves a class ${{C}_{j}}$, the $\text{KS}$ must update the affected local keys and distribute the corresponding rekeying messages. In the LKH tree, only the keys located on the path from the affected leaf to the root are updated. Therefore, if the tree has depth $h$, the number of updated nodes is proportional to $h$. Since each updated key must be securely distributed, the server-side computation overhead is proportional to the tree depth.

From Eq. (43), the depth of the LKH tree grows logarithmically with the class size. Hence,

$h\sim \mathcal{O}\left( \text{log}M \right)$

Therefore, the server-side computation overhead can be expressed as

$\text{comp}_{i}^{j,\text{server}}\sim \mathcal{O}\left( \text{log}M \right)$           (49)

5.6.2 User side

At the user side, the computation overhead includes two components: the overhead induced by the inter-class continuity and the overhead induced by the local LKH rekeying process.

For the inter-class part, the worst-case number of hash derivations or decryptions associated with the continuity chain is proportional to the length of the continuity segment. From Eq. (36), this contribution is

$\mathcal{O}\left( N \right)$          (50)

For the intra-class part, the number of decryptions performed by a member depends on its position in the LKH tree.

Joining Event. When a new member joins a class ${{C}_{j}}$, the affected path is updated. In the worst case, the existing member that is closest to the inserted member in the tree may need to process one updated key per level. Therefore, the worst-case number of decryptions is proportional to the tree depth:

$\text{De}{{\text{c}}_{\text{join}}}\sim \mathcal{O}\left( h \right)$          (51)

Since $h\sim \mathcal{O}\left( \text{log}M \right)$, we obtain

$\text{De}{{\text{c}}_{\text{join}}}\sim \mathcal{O}\left( \text{log}M \right)$         (52)

Leaving Event. When a member leaves the class, the keys along the affected path are refreshed. In the worst case, the member most closely related to the leaving member in the tree performs a number of decryptions proportional to the tree depth. Hence,

$\text{De}{{\text{c}}_{\text{leave}}}\sim \mathcal{O}\left( h \right)\sim \mathcal{O}\left( \text{log}M \right)$       (53)

By combining the inter-class and intra-class contributions, the user-side computation overhead is

$\text{comp}_{i}^{j,\text{user}}\sim \mathcal{O}\left( N+\text{log}M \right)$           (54)

If the number of classes is small compared with the class size, that is, if $N\ll M$, then the logarithmic term dominates in practical large-scale classes. In that case, the complexity can be approximated by

$\text{comp}_{i}^{j,\text{user}}\sim \mathcal{O}\left( \text{log}M \right)$        (55)

5.7 Communication overhead

The communication overhead represents the number of rekeying messages sent by the $\text{KS}$ after a join or leave event. As in the previous analysis, this overhead is evaluated by combining the inter-class behavior captured by the KCP and the intra-class behavior captured by the CKDP.

For the inter-class part, when a membership change affects a class ${{C}_{j}}$, the continuity structure may be split or updated, and the affected upper classes must receive the corresponding update information. In the considered KMS, this inter-class overhead remains bounded, and therefore it is constant asymptotically:

$\mathcal{O}\left( 1 \right)$     (56)

For the intra-class part, let us consider the two events separately.

Joining Event. When a new member joins class ${{C}_{j}}$, the $\text{KS}$ updates the keys located on the affected path of the LKH tree. Since the number of updated levels is proportional to the tree depth $h$, the number of rekeying messages generated inside the class is also proportional to $h$. Therefore,

$\text{com}{{\text{m}}_{\text{join}}}\sim \mathcal{O}\left( h \right)$          (57)

Since $h\sim \mathcal{O}\left( \text{log}M \right)$, it follows that

$\text{com}{{\text{m}}_{\text{join}}}\sim \mathcal{O}\left( \text{log}M \right)$           (58)

Leaving Event. Similarly, when a member leaves class ${{C}_{j}}$, the $\text{KS}$ refreshes the keys on the affected path and distributes the corresponding rekeying messages. The resulting number of messages is again proportional to the depth of the tree. Hence,

$\text{com}{{\text{m}}_{\text{leave}}}\sim \mathcal{O}\left( h \right)\sim \mathcal{O}\left( \text{log}M \right)$           (59)

By combining the inter-class and intra-class contributions, the overall communication overhead becomes

$\text{comm}_{i}^{j}\sim \mathcal{O}\left( 1+\text{log}M \right)$           (60)

Therefore,

$\text{comm}_{i}^{j}\sim \mathcal{O}\left( \text{log}M \right)$           (61)

This result shows that the communication overhead of the considered KMS increases logarithmically with the maximum number of members in a class.