Lightweight confidentiality framework for TinyML-enabled IoT edge communication

1 Introduction

The rapid growth of the IoT (Internet of Things) ecosystem has resulted in the large-scale integration of low-power embedded devices in our daily environments. Over 18.8 billion connected IoT devices are already present in the world by 2024, and the figure is likely to reach 40 billion by 2030 (Duarte, 2021). This rapid expansion significantly increases the attack surface, necessitating robust and adaptive security mechanisms.

Traditional cryptographic techniques, although robust, are often insufficient in situations where computing resources, memory, and power are limited (Kapudasu and Jain, 2023; Pilla and Jain, 2023; Julian Okello et al., 2017). Their limitations make it challenging to use standard encryption methods such as AES or RSA since they are mathematically strong but also demanding in terms of computation and may introduce higher computational overhead in ultra-constrained deployments. Lightweight cryptography addresses these constraints by providing security mechanisms optimized for embedded and edge devices. The Tiny Encryption Algorithm (TEA) is the most prominent example in this type of the area due to its straightforwardness, very low memory requirement, and possibility of fast encryption without the need for special hardware acceleration (Kaur and Singh, 2021; Pothumarti et al., 2021). TEA is widely adopted in embedded systems due to its simplicity, small memory footprint, and efficient execution (Wheeler and Needham, 1995; Needham and Wheeler, 1997). However, the basic TEA and its modifications still show vulnerability to cryptanalysis, which is mainly due to their fixed key scheduling technique.

TEA was selected as the baseline cipher because of its simple computational structure and low memory requirements. These characteristics make it suitable for software based deployment in constrained edge and IoT environments. Modern lightweight ciphers and AEAD schemes such as Ascon-128 provide stronger integrated security guarantees. However, they introduce additional computational and memory overhead due to authentication mechanisms and permutation based operations. In contrast, TEA's ARX-based structure enables predictable execution behavior and efficient implementation in latency sensitive TinyML inference workflows. The proposed enhancement therefore leverages TEA as a lightweight foundation while addressing its known limitations through dynamic key diversification, enabling a balance between security improvement and computational efficiency.

However, TEA and its direct derivatives (including XTEA and XXTEA) exhibit limitations Jinwala et al. (2009) due to their static key scheduling mechanisms (Bogdanov et al., 2007; Rivest, 1995). These limitations are discussed in detail in Section 2.

Recent advances in lightweight cryptography have led to the standardization of authenticated encryption schemes such as Ascon-128, selected by NIST for constrained environments (Dworkin, 2023); however, their computational and memory overhead may limit suitability for ultra-constrained TinyML edge deployments.

Recent works have explored post-quantum secure frameworks for IoT provisioning using lattice-based cryptography and intelligent routing mechanisms (Sethu Subramanian et al., 2025a), but these approaches often introduce significant computational overhead, limiting their applicability in ultra-constrained TinyML-driven environments.

In order to overcome the aforementioned drawbacks, authors at Bhagya et al. (2024) suggested the Enhanced Tiny Encryption Algorithm (Enhanced TEA) study, which uses cryptographic hashing to apply a dynamic round key scheduling mechanism. By using SHA-256 hash outputs extracted from the plaintext, the enhancement introduces dynamic subkey variation, reducing structural predictability associated with static key scheduling. This design enhances input-dependent key variation while retaining the lightweight operational features of TEA.

Enhanced TEA supports confidentiality protection for both data transmission and storage in constrained IoT environments. It can be incorporated into the application layer of communication protocols such as MQTT or CoAP, thus allowing encryption of the messages sent in wireless sensor networks or edge-to-cloud infrastructures from start to finish. Enhanced TEA enables low-overhead encrypted transmission under bandwidth-constrained IoT communication conditions.

Unlike traditional IoT systems that transmit raw sensor streams, TinyML-based edge devices primarily communicate compact inference metadata, which fundamentally alters the security design space. This change requires encryption mechanisms that can efficiently handle small payload sizes and support low-latency processing. It also requires tighter integration with inference-driven communication workflows used in TinyML enabled edge systems.

While the initial assessments based on both theory and simulations showed significant improvements in avalanche effect, entropy, and empirical diffusion characteristics under differential attack resistance, it still remains necessary to validate those improvements under practical deployment conditions. To evaluate deployment feasibility across different classes of embedded hardware, the proposed framework was evaluated on both an edge computing platform (Raspberry Pi 4) and representative resource-constrained microcontroller platforms, including ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico and Vicharak Shrike Lite. The Raspberry Pi 4 was used for complete TinyML-MQTT system integration, whereas the microcontroller platforms were used to evaluate algorithm-level cryptographic performance under constrained hardware conditions.

The work of Bhagya et al. (2024) presented the Enhanced TEA cryptographic design and showed better statistical diffusion and entropy properties through simulation based analysis. The present study extends the contribution in a few major directions. First, this work proposes a comprehensive TinyML-based secure IoT communication architecture that integrates encryption into the edge intelligence workflows. Second, the study offers real-world system-level deployment and benchmarking on edge computing hardware, thus enabling the evaluation of computational, memory, and network performance under practical operating constraints. Third, we experimentally validate the framework in terms of execution time, runtime memory utilization, average operating power and energy consumption on representative embedded platforms.

While several lightweight cryptographic algorithms and TEA-based enhancements have been proposed for resource-constrained IoT environments, most existing studies primarily focus on algorithmic optimization or isolated cryptographic performance evaluation. Limited attention has been given to integrating lightweight encryption mechanisms directly into emerging TinyML-driven edge communication workflows, where security requirements differ from conventional sensor data protection models.

Recent system-level approaches integrating blockchain and reinforcement learning have demonstrated improved security in edge-enabled IoT environments (Sethu Subramanian et al., 2025b), yet lightweight cryptographic solutions for ultra-constrained inference-driven communication remain underexplored.

The novelty of this work lies not merely in proposing a new cryptographic primitive or modifying of a classical lightweight cipher. Instead it is in the design of a system-level, application-driven confidentiality framework tailored specifically for TinyML enabled IoT communication. Most of the prior TEA based enhancements focus primarily on algorithmic improvements such as key variation or diffusion optimization. In contrast, this work integrates plain text dependent key diversification within a complete edge intelligence pipeline, where compact inference metadata (typically 1–32 bytes) is selectively protected. The contribution therefore extends beyond cryptographic modification to include (i) inference aware payload security design, (ii) seamless integration with lightweight communication protocols such as MQTT and CoAP, and (iii) real world deployment and performance validation under edge computing constraints. This combined system-level perspective differentiates the proposed approach from existing lightweight cryptographic schemes and TEA-based variants. The novelty of this work therefore stems from the identification and exploitation of a distinct design space in which compact inference metadata, rather than raw sensor data, is selectively protected. This approach reduces communication overhead while preserving confidentiality, enabling practical deployment in latency sensitive edge environments. Unlike classical TEA variants that rely on static or partially static key scheduling, the proposed Enhanced TEA introduces a plaintext-dependent dynamic key diversification mechanism that improves empirical diffusion behavior while preserving the computational efficiency of ARX-based cipher structures. In contrast to standardized lightweight authenticated encryption schemes that prioritize integrated confidentiality and authentication, this work explores a complementary confidentiality-focused design strategy optimized for latency-sensitive TinyML edge inference communication.

Despite significant advances in lightweight cryptography and system-level IoT security frameworks, there remains a critical gap in designing lightweight, inference-aware encryption mechanisms tailored for TinyML driven edge communication. Existing approaches either focus on algorithm-level optimization without system integration or introduce excessive overhead unsuitable for ultra-constrained deployments.

The research presents a complete secure TinyML enabled IoT communication system which researchers tested through system experiments and network performance assessments. To the best of our knowledge, this is among the early works that jointly investigates plaintext-driven key diversification, TinyML inference-aware payload protection, and system-level IoT communication security evaluation within a unified lightweight cryptographic framework.

This work deliberately focuses on confidentiality as a primary security objective for TinyML inference communication, while assuming that integrity, authentication, and replay protection are handled through existing protocol-level or system-level security mechanisms.

1.1 Contributions of this work

The main contributions of this work are summarized as follows:

• We propose a lightweight confidentiality framework for TinyML-enabled IoT edge communication that integrates encryption directly within edge inference workflows, enabling secure transmission of compact inference metadata in resource-constrained environments.
• The TEA-based encryption scheme has been improved through our development of a new dynamic key diversification system which generates encryption keys based on the content of the plaintext using SHA-256. The system achieves better security through its ability to produce 54.69% avalanche effect and 7.66 bits per byte of ciphertext entropy.
• The development of our system-level communication architecture which uses TinyML technology for secure communication results in reduced communication requirements through its decision to encrypt inference outputs instead of using unprocessed sensor data. This approach enables improved bandwidth performance together with energy savings for edge deployments.
• The proposed framework which we developed was assessed through practical deployment on Raspberry Pi 4 together with algorithm-level benchmarking on ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico and Vicharak Shrike Lite. The system achieved its operational requirements by using only 15.7 KB of memory maximum and maintaining CPU work at below 13%.
• The network-level validation tests use MQTT-based communication to demonstrate that the system maintains over 95% throughput The system demonstrates only small increases in latency which allows it to operate effectively in real-time IoT applications.
• The design explicitly incorporates TinyML driven communication characteristics. It includes compact inference payloads, event driven transmission, and latency-sensitive operation. This establishes a direct link between edge intelligence and encryption design.
• The proposed system level security framework combines lightweight encryption with TinyML inference workflows through an application driven design approach. The framework is intended to support efficient integration within edge based communication systems rather than replace traditional cryptographic methods.
• Our study presents a comparative assessment of traditional TEA methods against selected lightweight cryptographic algorithms which demonstrate their performance trade-off between better spreading abilities and processing speed under TinyML system limitations.

Authenticated encryption schemes like Ascon-128 (NIST LWC) provide combined confidentiality, integrity and authenticity. Such schemes are suitable for the security-critical IoT applications requiring stronger end-to-end protection. However, authenticated encryption usually requires additional computational and memory overhead due to authentication and permutation-based processing.

However, the proposed approach is intended for scenarios where the main requirement is confidentiality of compact inference meta-data. The framework is also intended for environments in which low latency and lower resource consumption are important. This work focuses on an application driven security design that aligns encryption mechanisms to practical TinyML communication constraints. Hence, the proposed framework will be regarded as a complementary solution for AEAD-based approaches, rather than a direct replacement.

2 Related works

Recent comprehensive surveys provide structured comparative evaluations of lightweight cryptographic primitives for IoT deployments, highlighting implementation trade-offs between hardware-oriented and software-oriented encryption designs. These studies emphasize that security evaluation for constrained devices must consider not only theoretical strength but also computational efficiency, memory footprint, and deployment feasibility across heterogeneous sensor platforms (Rana et al., 2022; Al-Shargabi et al., 2024). In addition to TEA-based constructions, several lightweight block ciphers have been proposed for constrained IoT environments, including PRESENT and GIFT (Bogdanov et al., 2007; Banik et al., 2017), as well as ARX-based designs such as SPECK (Beaulieu et al., 2015). However, these approaches primarily emphasize algorithmic efficiency without considering integration into TinyML-driven communication workflows.

The Tiny Encryption Algorithm (TEA) has been a major player in the field (Wheeler and Needham, 1995), and it attracted much attention because it offers simple design and minimal resource requirements and consistent performance across embedded systems. TEA operates with 64-bit data blocks and a 128-bit key through the implementation of Feistal network architecture and using XOR and mod block addition and rotation as its operational methods. The algorithm reaches its highest point of effectiveness because it serves as the optimal solution for wireless sensor networks and low-power IoT applications (Kelsey et al., 1997).

TEA encryption system shows security flaws because it uses a fixed method for generating its encryption keys. Cryptography researchers discovered that attackers can use key patterns to break the cipher when they possess two or more plaintext-ciphertext pairs which leads to vulnerabilities against related-key and differential cryptanalysis attacks (Kelsey et al., 1997). The new features of XTEA and XXTEA variants enhanced their security protection but the systems kept using their original key scheduling methods which limited their defense capabilities against present-day threats (P et al., 2023).

While these improvements enhance algorithmic robustness, they largely remain confined to cipher-level optimizations without considering system-level deployment constraints in modern IoT communication environments.

In parallel with TEA-based enhancements, the broader lightweight cryptography community has focused on standardized primitives emerging from the NIST Lightweight Cryptography (LWC) process. These efforts emphasize authenticated encryption schemes and structured diffusion mechanisms designed specifically for constrained IoT platforms, reinforcing the importance of evaluating both security behavior and deployment overhead in edge-centric systems (Dworkin, 2023).

Nevertheless, such standardized approaches often introduce additional computational and protocol overhead that may limit their applicability in latency-sensitive TinyML-based edge deployments.

The lightweight cryptography ecosystem has been studied through authenticated encryption schemes which include GIFT-COFB and Grain-128AEAD beyond Ascon-128. These schemes demonstrate different design methods which protect both confidentiality and integrity in resource-limited IoT deployments according to (Sonmez Turan et al. 2023).

The research in (Abdulraheem et al. 2021) proved that modified TEA systems achieve performance levels which match those of particular lightweight cryptographic systems, including SIMON. The authors of (De Leon et al. 2019) used key rotation methods together with TEA round execution which resulted in better avalanche effect performance and stronger protection against cryptanalysis attacks. The authors in (Shoeb and Gupta, 2023; Rajesh et al., 2019) conducted studies on design improvements which maintained security while achieving efficient computational processes.

The Enhanced Tiny Encryption Algorithm (Enhanced TEA) uses SHA-256-based dynamic key scheduling which was conducted by authors (Bhagya et al., 2024) in their earlier work. The algorithm generates subkeys through plaintext-based hashing which increases non-linear properties and protects against statistical and differential analysis attacks. The technical improvements received validation through both critical assessment and simulation tests which measured higher avalanche and entropy results and additional performance indicators.

Table 1 shows a comparison between different lightweight cryptographic schemes. The comparison shows how the two systems differ in their ability to protect information, their processing needs, and their effectiveness in limited resource systems. The classical TEA variants use basic mathematical operations for their processing which requires minimal memory space. The characteristics make them appropriate for devices which have extreme resource limitations. The schemes provide basic security measures yet they lack built-in security features for authentication and integrity validation.

Table 1. Comparison of lightweight cryptographic schemes.

Overhead is qualitative relative to classical TEA. Measured per-byte cost on constrained MCUs (Table 9) is higher than Ascon-128 owing to the SHA-256 diversification stage; see Section 7.5.

The proposed Enhanced TEA framework extends the lightweight characteristics of classical TEA variants. The framework introduces plaintext-dependent dynamic key diversification to mitigate structural weaknesses. The framework maintains a low computational footprint, making it suitable for resource-constrained edge devices.

Ascon-128 and other current lightweight cryptographic standards provide better combined security features than traditional cryptographic systems. The system achieves security through its authenticated encryption methods which protect both confidentiality and integrity and authenticity. The security functions need extra processing power and memory space to operate. The system incurs extra processing costs because it needs to perform both authentication tasks and permutation-based functions.

The lightweight ciphers PRESENT, GIFT, and SPECK show different hardware efficiency, software performance, and security strength trade-offs because they represent various intermediate design options. This comparison shows that no single cryptographic scheme is universally optimal for all IoT scenarios. The choice of an appropriate cryptographic primitive primarily hinges on application specific needs and system limitations.

In TinyML enabled edge systems, communication latency is often critical and payload sizes are typically small. In such conditions, lightweight confidentiality focused approaches such as the proposed Enhanced TEA framework can provide a practical balance between security, computational efficiency and resource usage.

To address this gap, the present study experimentally benchmarks TEA, XTEA, XXTEA, Enhanced TEA, and Ascon-128 under identical conditions and evaluates computational performance, runtime memory utilization, power consumption, and energy consumption across representative embedded platforms (Fernando et al., 2019; Maitra et al., 2019; Singh et al., 2024; Saran and Jain, 2023; Hassan, 2021).

The security of IoT systems which operate at the network edge has reached new heights through its recent development of security frameworks which employ both adaptive intelligence and distributed trust systems. The research in Sethu Subramanian et al. (2025b) presents a 5G edge networks security framework which combines blockchain technology with reinforcement learning for secure task offloading. The research shows that using dynamic decision-making together with decentralized trust systems leads to better security results and resource efficiency in environments with limited resources. The research mainly investigates network-level security together with task orchestration while it only briefly examines lightweight cryptographic methods which protect application-level data transmission. The research creates a solution to developing efficient encryption systems which require minimal resources and suit IoT and TinyML communication environments.

Recent studies in IoT communication security demonstrate that constrained devices face a trade-off between transport-layer encryption overhead and application-layer payload protection. Researchers explored lightweight payload encryption methods which decrease TLS handshake latency while minimizing memory usage and simplifying session management tasks in publish-subscribe IoT communication systems. The development of 5G RedCap devices according to recent research (I et al., 2026) demonstrates the creation of mid-tier IoT systems which offer balanced performance and efficiency yet create new security risks. The existing methods concentrate on system architecture design instead of developing lightweight cryptographic systems for IoT communication that depends on inference.

Modern lightweight cryptographic standards such as Ascon-128 (NIST LWC) provide authenticated encryption with strong security guarantees, including confidentiality, integrity, and authenticity. However, these schemes typically introduce additional computational and memory overhead due to permutation-based operations and authentication mechanisms.

In contrast, the proposed Enhanced TEA framework is designed for scenarios where confidentiality of compact TinyML inference outputs is the primary requirement, while minimizing latency and computational overhead. Consequently, the comparison with Ascon-128 and other lightweight cryptographic schemes should be interpreted in the context of their differing design objectives. Authenticated encryption schemes such as Ascon-128 provide integrated confidentiality, integrity and authenticity, whereas the proposed framework targets lightweight confidentiality for latency-sensitive TinyML enabled IoT communication.

To enable a fair and reproducible comparison, TEA, XTEA, XXTEA, Enhanced TEA, and Ascon-128 were implemented and experimentally evaluated under identical conditions on representative embedded platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico and Vicharak Shrike Lite. All algorithms were executed using the same plaintext sizes, implementation methodology, compiler configuration, optimization settings, hardware platforms, and measurement procedures. The resulting benchmark, presented in Section 7.5, provides a controlled comparison of execution time, runtime memory utilization, average operating power, and energy consumption, and complements the Raspberry Pi 4 system-level evaluation of the complete TinyML-enabled MQTT communication framework.

Table 2 summarizes the principal security characteristics of the evaluated algorithms. It should be noted that only the Ascon-128 avalanche effect and ciphertext entropy values are adopted from standardized reference implementations, NIST Lightweight Cryptography evaluation reports, and published benchmark studies, where these security metrics have already been extensively validated. In contrast, all performance metrics reported in Section 7.5, including execution time, runtime memory utilization, average operating power, and energy consumption, were obtained through direct experimental measurements under identical hardware, software, compiler, and measurement conditions for all evaluated algorithms. Consequently, the benchmark in Section 7.5 represents a direct same-environment performance comparison, whereas Table 2 provides a comparison of established security characteristics.

Table 2. Focused security comparison of TEA variants.

2.1 Standard compliance and positioning

The study of the Enhanced TEA algorithm is informed by testing considerations and operational characteristics discussed in the NIST Lightweight Cryptography (LWC) standardization project. The NIST lightweight cryptography evaluation process tests security protection methods which IoT devices are able to use under their operational restrictions. The Enhanced TEA system meets multiple lightweight design requirements which NIST Lightweight Cryptography evaluation frameworks specify for assessment purposes. It includes:

• Block cipher structure: The algorithm follows a symmetric block cipher structure, which aligns with design models like GIFT and PRESENT.
• Lightweight footprint: The proposed Enhanced TEA shows runtime memory utilization and computational features compatible with representative resource-constrained embedded platforms like ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico and Vicharak Shrike Lite. The extra SHA-256 based dynamic key diversification raises the computational and memory costs compared to classical TEA variants, but the experimental results in Section 7.5 demonstrate that the proposed framework is suitable for practical deployment on these representative platforms. The benchmark results show that Enhanced TEA is applicable to representative edge devices with moderate resource constraints.
• Security margin: Empirical metrics such as avalanche effect (54.69%) and ciphertext entropy (7.6618 bits/byte) are within recommended ranges for unpredictability and diffusion.
• Configurability: The round count and key scheduling mechanism in Enhanced TEA can be tuned for deployment in NIST-targeted application layers, including authenticated encryption in protocols like CoAP or MQTT-SN.

Table 3 compares TEA and its main variants with representative lightweight cryptographic schemes in terms of security functionality, lightweight features, memory profile and typical deployment scenarios. The comparison shows that classical TEA variants have low computational complexity and low resource requirements, but lack the enhanced security capabilities required by many modern IoT communication systems.For the proposed Enhanced TEA, the reported 7 KB corresponds to the static code size of the cryptographic module, while the 15.7 KB value reported in Section 7.2 represents the peak runtime RAM usage measured during encryption execution.

Table 3. Comparative overview of TEA variants and lightweight cryptographic schemes in IoT communication contexts.

The performance characteristics of TEA, XTEA, XXTEA, Enhanced TEA, and Ascon-128 presented in this work are supported by the experimental benchmarking described in Section 7.5, where all algorithms were evaluated under identical experimental conditions using the same implementation methodology, compiler configuration, plaintext sizes, and measurement procedures across representative embedded platforms. It should be noted that only the Ascon-128 avalanche effect and entropy values are adopted from standardized reference implementations and NIST Lightweight Cryptography evaluation reports, as these security metrics are well established in the literature. Accordingly, the comparative performance results presented in this study represent direct experimental measurements, whereas the Ascon-128 avalanche effect and entropy values serve as standardized reference values for contextual comparison.

The benchmark results presented in Section 7.5 show that the proposed Enhanced TEA framework can be executed on all representative embedded platforms evaluated, while keeping a peak runtime RAM usage of 15.7 KB. While the additional SHA-256-based dynamic key diversification adds some computational overhead over the classical TEA family, we demonstrate through experimental results that the proposed framework remains computationally feasible for representative TinyML-enabled IoT edge devices. This study's evaluation platform does not consider 8-bit and 16-bit microcontrollers with highly limited resources.

To provide a consolidated comparison across classical TEA variants, representative lightweight cryptographic schemes, and the proposed Enhanced TEA framework, Table 2 summarizes the principal security characteristics of the evaluated algorithms. The avalanche effect and entropy values reported for Ascon-128 are adopted from standardized reference implementations, NIST Lightweight Cryptography evaluation reports, and publicly available benchmark studies, where these security metrics have been extensively validated.

The comparison highlights the need for lightweight cryptographic techniques that improve diffusion while maintaining low computational overhead. The existing literature contains multiple unaddressed limitations which researchers have worked on for lightweight cryptographic algorithms and TEA-based improvements. The majority of TEA variants work to enhance diffusion properties while they also strive to defend against particular cryptanalytic threats yet they do not examine how their technologies will function in actual IoT networks. The recent lightweight cryptographic standards which include NIST LWC finalists deliver strong security protection yet they create unnecessary computing costs and integration challenges which impede performance for edge intelligence systems that require low latency. Researchers have conducted limited studies about application-layer encryption methods which protect TinyML-based IoT systems because these systems use compact inference metadata as secure transmission to reduce their data transmission requirements compared to complete sensor stream encryption. The existing research needs lightweight encryption solutions which can improve diffusion performance while using minimal resources and enabling smooth operation with edge communication systems. The work presents the Enhanced TEA framework which solves this organizational need.

3 System architecture and algorithm design

3.1 Architecture for TinyML-Enabled Secure IoT

The proposed system-level architecture for secure TinyML-enabled IoT deployments is depicted in Figure 1. The architecture follows a layered edge-to-cloud design enabling both intelligence and security functions at the IoT edge.

The edge device employs a TinyML inference engine to perform local data stream processing which enables users to make immediate decisions without needing cloud access. The inference stage produces compact outputs which include class labels and anomaly flags and confidence scores.

The Enhanced TEA encryption module receives the TinyML inference output to secure the data prior to transmission. The architecture reduces processing overhead by encrypting inference outputs rather than full raw sensor streams and it maintains security for vital information. The system uses lightweight IoT communication protocols which include MQTT and CoAP to transmit encrypted inference outputs, making it suitable for networks that have both bandwidth and energy limitations. Smart city platforms and cloud services at the upper layer process secured data for three purposes: visualization, long-term analysis, and coordinated decision-making. The architecture integrates intelligence, security, and efficiency at the edge, which meets the operational requirements of IoT deployments in large-scale smart city environments.

3.2 Role of Enhanced TEA in TinyML-enabled IoT systems

In emerging smart city deployments, Tiny Machine Learning (TinyML) is increasingly adopted at the edge to enable on-device inference for tasks such as anomaly detection, event classification, and predictive monitoring.

In such systems, the primary security requirement is not the protection of raw sensor streams alone, but the secure transmission of inference outcomes that directly influence control decisions and automated responses. Enhanced TEA is positioned in this work as a lightweight cryptographic layer that secures TinyML inference outputs before transmission over constrained communication channels. It provides confidentiality protection for inference data during transmission. While Enhanced TEA does not modify the internal operation of the TinyML inference model, its integration within the inference-to-transmission pipeline is design-driven rather than independent. TinyML-enabled systems generate compact, structured inference metadata (e.g., class labels, anomaly flags, confidence scores), which differ significantly from traditional raw sensor data streams in both size and transmission patterns.

This shift introduces unique security and system constraints, including ultra-low payload sizes (typically 1-32 bytes), high-frequency or event-driven transmission, and strict latency requirements for real-time decision-making. The proposed encryption framework is therefore specifically aligned with these TinyML-driven characteristics. The lightweight ARX-based structure helps reduce computational overhead during encryption. In addition, the use of application-layer encryption enables efficient protection of inference outputs. This approach avoids additional buffering requirements and does not require modifications to existing communication protocols.

As a result, the interaction between TinyML and the encryption design is not superficial but driven by the need to secure inference-centric communication under tight resource and latency constraints.

The application layer uses Enhanced TEA to enable light-weight IoT nodes to deliver trustworthy inference results through the MQTT and CoAP protocols without needing extensive security systems. Recent studies of TinyML security found that resource-constrained intelligent edge devices face three new security threats which include inference data exposure and model extraction and side-channel leakage. The research demonstrates that there exists a need for security solutions which enable confidential protection of inference metadata while maintaining strict requirements for latency and energy consumption Ray (2022).

3.3 Implementation of Enhanced TEA

The Enhanced TEA algorithm shown in Figure 2 and summarized in Algorithm 1 is implemented in a modular structure, consisting of:

• Key Generation Module: Generates a 128-bit key using a random seed or user input.
• Key Scheduling Module: Computes SHA-256 hash of plaintext and modifies TEA subkeys using a hash-based XOR transformation.
• Encryption Module: Encrypts plaintext data using a 64-bit block cipher with Feistel structure and 64 rounds.
• Decryption Module: Recovers the original plaintext by mirroring the encryption logic.

In accordance with classical TEA terminology, one cycle consists of two Feistel rounds; therefore, n = 32 cycles corresponds to 64 effective Feistel rounds.

The computational overhead of SHA-256 for dynamic key diversification needs to be considered when applied to TinyML communication patterns. The proposed framework deals with compact inference metadata of size 1 to 32 bytes that need to transmit data at low rates. The cost of hash computation is amortized over the small payloads and hence the system execution time is not affected.

From a design perspective, SHA-256 is selected due to its well established security properties. It is also widely available in software libraries, and predictable performance across embedded platforms. This ensures reliable key diversification without introducing additional design complexity or security uncertainty.

However, this design choice represents a trade-off between enhanced security and computational cost. The additional SHA-256-based dynamic key diversification introduces modest computational overhead compared with the classical TEA variants. The system-level evaluation on the Raspberry Pi 4 demonstrates that this overhead remains acceptable, with CPU utilization below 13% and minimal impact on end-to-end latency, as reported in Section 7. Furthermore, the algorithm-level benchmarking presented in Section 7.5 confirms that the proposed framework remains computationally feasible on representative resource-constrained embedded platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico and Vicharak Shrike Lite. For extremely resource-constrained 8-bit and 16-bit microcontroller environments, lightweight alternatives to SHA-256, such as BLAKE2s, PHOTON, or truncated cryptographic hash functions, may reduce the computational overhead associated with dynamic key diversification.

3.3.1 Key scheduling formalization:

Let the SHA-256 hash of the plaintext block P be denoted by H(P). The 256-bit hash is split into four 32-bit subkeys and combined with the original TEA key as shown in Equations 1 and 2:

SKi=H(P)[32i:32(i+1)-1], ∀i∈{0,1,2,3}(1)

Ki′=Ki⊕SKi(2)

Here:

• H(P): SHA-256 hash of the 64-bit plaintext block P.
• SK_*i*: The i-th 32-bit subkey derived from the hash.
• K_*i*: The original 128-bit TEA key split into four 32-bit words.
• Ki′: The final round keys after mixing the original keys with hash-based subkeys via XOR.

3.3.2 TEA round function:

Each encryption round performs the following transformation defined in Equations 3 and 4:

V0(i)=V0(i-1)+((V1(i-1)≪4)+K0′)⊕(V1(i-1)+i·Δ)

⊕ ((V1(i-1)≫5)+K1′)(3)

V1(i)=V1(i-1)+((V0(i)≪4)+K2′)⊕(V0(i)+i·Δ)

⊕ ((V0(i)≫5)+K3′)(4)

Where:

• V0(i), V1(i): Left and right 32-bit halves of the data block after round i.
• K0′ to K3′: Round subkeys as derived from the key scheduling process.
• ≪, ≫: Bitwise left and right shift operations, respectively.
• ⊕: Bitwise XOR operation.
• Δ: A constant value (0x9E3779B9), derived from the golden ratio, used to ensure key schedule diffusion.
• i: Current round number, ranging from 1 to n (typically n = 32).

Algorithm 1 Enhanced Tiny Encryption Algorithm (Enhanced TEA)

4 Threat model and security assumptions

The threat model follows NIST lightweight cryptography evaluation guidelines for constrained IoT environments. The Enhanced TEA scheme is designed to protect lightweight TinyML inference metadata transmitted between sensing nodes, edge devices, and backend processing entities over insecure communication channels.

4.1 Adversary model

The adversary model follows standard lightweight cryptographic evaluation assumptions and is characterized as follows:

• Passive adversary (eavesdropper): The adversary can observe and record ciphertext transmitted over public or private communication links, including wireless and wired IoT networks
• Active adversary: The adversary may perform message injection, replay, modification, or reordering attacks on transmitted ciphertexts, consistent with a Dolev-Yao-style network attacker operating without full control over cryptographic primitives
• Bounded computational capability: The adversary is assumed to have polynomial-time computational resources consistent with practical attackers targeting low-power IoT deployments, but is not capable of breaking standard cryptographic hash functions or exhaustively searching sufficiently large key spaces
• Non-invasive physical access: The adversary may gain limited or temporary access to an edge device but is not assumed to perform invasive physical attacks such as microprobing, laser fault injection, or high-resolution side-channel analysis

4.2 Security assumptions

The following assumptions align with NIST lightweight cryptography evaluation practices:

• Symmetric secret keys are generated, stored, and managed securely on the edge device and are not exposed through software compromise
• Hash functions used for key derivation (e.g., SHA-256) are assumed to provide preimage, second-preimage, and collision resistance
• Communication links between IoT devices, edge nodes, and backend services are assumed to be insecure by default and susceptible to interception and manipulation
• Attacks targeting network availability, such as denial-of-service (DoS), are considered outside the scope of this work

4.3 Security goals

Under the defined threat model and assumptions, the Enhanced TEA scheme is designed to achieve the following security goals:

• Data confidentiality: Ensure that TinyML inference outputs and associated metadata remain confidential against passive and active adversaries
• Empirical diffusion and ciphertext distribution: Provide strong plaintext sensitivity and near-uniform ciphertext distribution, evaluated through avalanche-effect and entropy measurements. These objectives are statistical evaluation criteria and do not constitute claims of formal resistance to differential, linear, or related-key cryptanalysis.
• Lightweight efficiency: Balance security strength with reduced computational complexity, memory footprint, and energy consumption for resource-constrained IoT devices

Advanced physical attacks, including invasive hardware reverse engineering and sophisticated side-channel analysis, are outside the scope of the present study.

4.4 Formal security evaluation and cryptanalytic boundaries

The avalanche effect and ciphertext entropy reported in this work evaluate diffusion and statistical output characteristics, respectively. These metrics do not constitute proofs of resistance against differential, linear, or related-key cryptanalysis. Therefore, to establish the precise security boundary of the proposed construction, this section provides a structural analysis of the plaintext-dependent key diversification mechanism.

Let T_*k*(P) denote TEA encryption of a 64-bit plaintext block P under a 128-bit effective key k. The proposed Enhanced TEA construction can be written as

EK(P)=TK⊕S(P)(P),(5)

where K is the 128-bit master key and S(P) denotes the 128 bits extracted from the SHA-256 digest of P and used for subkey diversification. Equation 5 provides a compact representation of the construction for the following cryptanalytic analysis.

4.4.1 Notation

Throughout this section, K = (K₀, K₁, K₂, K₃) denotes the secret 128-bit master key and S(P) the 128-bit diversifier extracted from SHA-256(P). We write the effective key—the 128-bit value actually supplied to the underlying TEA instance—as a function of the master key and the plaintext block:

Keff(K,P):=K⊕S(P),(6)

so that

EK(P)=TKeff(K,P)(P)(7)

The four 32-bit words of K_eff(K, P) are exactly the round subkeys Ki′=Ki⊕SKi defined in Section 3.3; that is, Ki′ denotes the i-th 32-bit word of the effective key, whereas K_eff(K, P) denotes the full 128-bit effective key.

A second, related master key is written K^* = K⊕Δ, where Δ is a fixed 128-bit XOR difference; its effective key is Keff(K*,P)=(K⊕Δ)⊕S(P). Thus K and K^* are master keys, while K_eff(·, ·) denotes the full effective key and Ki′ its individual 32-bit words.

4.4.2 Related-key difference preservation

A principal objective of formal cryptanalytic analysis is to determine whether the proposed key transformation removes structural key relations known for classical TEA. Consider two master keys related by a fixed XOR difference Δ:

K*=K⊕Δ.(8)

For a fixed plaintext P, the effective key generated from K^* is

K′(K*,P)=(K⊕Δ)⊕S(P)(9)

=(K⊕S(P))⊕Δ(10)

=K′(K,P)⊕Δ.(11)

Proposition 1 (Preservation of XOR-related key differences). For every plaintext P and every master-key difference Δ, the plaintext-dependent XOR diversification preserves the same XOR difference between the corresponding effective keys.

Proof. The result follows directly from the associativity and commutativity of XOR, as shown in Equation 11. The term S(P) is identical for both related master keys when the plaintext is fixed and therefore cancels from the effective-key difference as shown in Equation 12:

K′(K⊕Δ,P)⊕K′(K,P)=Δ.(12)

This result establishes an important limitation of the proposed diversification mechanism. Although S(P) changes the effective key used for different plaintext blocks, XOR masking does not remove an existing XOR relationship between related master keys. Therefore, plaintext-dependent SHA-256 masking alone must not be interpreted as providing formal related-key resistance.

In particular, cryptanalytic arguments based solely on the claim that dynamic subkeys “break” related-key relationships are not valid for the present construction. A related-key attack whose key relation is expressed through a preserved XOR difference must be evaluated against the underlying TEA structure. Accordingly, the present work does not claim resistance to the published related-key weaknesses of TEA.

4.4.3 Effective key space under plaintext-dependent diversification

Classical TEA possesses a well-known equivalent-key property: for every key K = (K₀, K₁, K₂, K₃), simultaneously complementing the most significant bits of the pair (K₀, K₁), of the pair (K₂, K₃), or of both, yields an identical encryption function Kelsey et al. (1997). Each key therefore belongs to an equivalence class of size four, reducing the effective key space of TEA from 2¹²⁸ to 2¹²⁶.

Let δ∈{0, δ₀₁, δ₂₃, δ₀₁⊕δ₂₃} denote the set of equivalent-key differences, where δ₀₁ complements the most significant bits of K₀ and K₁ and δ₂₃ complements the most significant bits of K₂ and K₃. Since each δ is a fixed XOR difference, Proposition 1 applies directly:

K′(K⊕δ,P)=K′(K,P)⊕δ, ∀P.(13)

Proposition 2 (Inheritance of equivalent keys). For every plaintext block P, master keys K and K⊕δ with δ in the TEA equivalent-key set induce effective keys that are themselves TEA-equivalent. Consequently, Enhanced TEA inherits the equivalence classes of TEA, and its effective key space is 2¹²⁶.

Proof. By Proposition 1 (Equation 13), the effective keys K′(K, P) and K′(K⊕δ, P) differ by exactly δ for every P. Since δ lies in the TEA equivalent-key difference set, the two effective keys define identical TEA encryption functions for every plaintext block, and hence identical Enhanced TEA encryption functions.

This result formally establishes that the plaintext-dependent diversification neither enlarges nor reduces the effective key space relative to classical TEA. The 2¹²⁶ effective key space remains far beyond exhaustive search for the bounded adversary defined in Section 4.1. At the same time, this analysis makes explicit that the diversification mechanism should not be credited with removing any structural key property of the underlying cipher.

4.4.4 Differential cryptanalysis boundary

Classical differential cryptanalysis studies the probability given in Equation 14

PrP[TK(P)⊕TK(P⊕ΔP)=ΔC],(14)

for selected plaintext and ciphertext differences Δ_*P* and Δ_*C* under a fixed encryption key K. For Enhanced TEA, the corresponding pair is

EK(P)=TK⊕S(P)(P)(15)

and

EK(P⊕ΔP)=TK⊕S(P⊕ΔP)(P⊕ΔP).(16)

Hence, from Equations 15 and 16 the two members of a plaintext differential pair generally induce the effective-key difference

ΔKeff=S(P)⊕S(P⊕ΔP).(17)

Under the assumption that S(·) behaves as a pseudo-random function over 128-bit outputs (Section 4.2), the induced effective-key difference ΔK_eff = S(P)⊕S(P⊕ΔP) is, for any fixed nonzero ΔP, computationally indistinguishable from a uniformly distributed 128-bit value that varies independently across plaintext pairs.

Classical differential cryptanalysis of TEA constructs high-probability characteristics under a fixed key; in the proposed construction, each chosen-plaintext pair induces a distinct effective-key difference ΔK_eff = S(P)⊕S(P⊕ΔP) that varies from pair to pair. A differential characteristic optimized for one effective-key difference therefore does not, in general, hold across the pairs collected by the attacker, which disrupts the accumulation of statistical evidence that standard differential attacks require. This argument depends on the per-block variation of the effective key rather than on the secrecy of S(P): in the transmitted-diversifier deployment of Section 9.4, S(P) is public and the adversary can compute each ΔK_eff, so the disruption rests on the adversary's inability to hold ΔK_eff fixed or steer it to a chosen value—which would require a diversifier collision (≈2¹²⁸ work)—and not on any secrecy of the effective-key difference. Consistent with Proposition 1, XOR relations between related master keys are preserved, so no formal differential or related-key resistance beyond that of classical TEA is claimed.

We emphasize the precise status of this argument: it is a heuristic consequence of the pseudo-randomness assumption on SHA-256, not a proven upper bound on the maximum expected differential probability of the modified construction. Deriving such a bound would require an automated trail search, for example using SAT/SMT- or MILP-based analysis, over the joint plaintext/effective-key differential space; such quantitative trail analysis is outside the scope of the present study. The avalanche measurements in Table 2 are consistent with, but do not prove, the diffusion behavior suggested by this argument.

This algebraic observation shows that a single-key plaintext differential in the proposed construction is represented internally by a joint plaintext and effective-key differential. However, Equation 17 does not, by itself, establish a lower differential probability or resistance to differential cryptanalysis. Deriving such a claim requires quantitative bounds on the maximum expected differential probability or an exhaustive/automated trail search over the complete modified construction.

The avalanche-effect value of 54.69% reported in Table 2 demonstrates strong empirical bit diffusion under the evaluated plaintext perturbations. However, this result must not be interpreted as a bound on differential characteristic probability. Accordingly, the avalanche-effect measurement is reported only as empirical diffusion evidence and does not constitute a formal claim of resistance to differential cryptanalysis.

4.4.5 Linear cryptanalysis boundary

For a conventional block cipher, linear cryptanalysis considers approximations of the form given in Equation 18, with probability as expressed in Equation 19

α·P⊕β·C=γ·K(18)

Pr[α·P⊕β·C=γ·K]=12+ϵ,(19)

where:

• α, β, γ: fixed n-bit linear masks selecting subsets of the plaintext P, ciphertext C, and key K bits, respectively;
• ·: the bitwise inner product (XOR of the selected bits) over F₂;
• ϵ: the linear bias, i.e. the deviation of the approximation probability from 12; a larger |ϵ| denotes a stronger (more exploitable) linear approximation.

Keff(P)=K⊕S(P).(20)

The presence of the plaintext-dependent term in Equation 20 changes the Boolean function analyzed by classical fixed-key linear cryptanalysis. Nevertheless, key variation alone does not prove that the maximum linear bias ϵ is reduced. Establishing such a result requires explicit computation of linear approximations or quantitative correlation bounds for the complete construction.

No such bound is derived in the present work. Therefore, the ciphertext entropy and avalanche measurements are not presented as evidence of formal resistance to linear cryptanalysis, and no claim of reduced maximum linear bias is made.

Analogously, under the pseudo-randomness assumption on S(·), the effective key K_eff(P) = K⊕S(P) changes from block to block, so the fixed Boolean relation of Equation (18) is evaluated under per-block key material rather than a single fixed key. This is expected to attenuate linear correlations accumulated over many plaintext–ciphertext pairs. When S(P) is transmitted in the clear (Section 9.4), this per-block key material is known to the adversary, so the attenuation rests on the variation of the effective key across blocks rather than on the secrecy of S(P); each individual block retains exactly the linear behavior of classical TEA under the known offset. As with the differential case, this observation is heuristic; no quantitative bound on the maximum linear bias is derived in this work.

4.4.6 Determinism and ciphertext equality leakage

The proposed construction is deterministic: for a fixed master key K, identical plaintext blocks always produce identical ciphertext blocks, since both the effective key K⊕S(P) and the block input P are repeated. One formal consequence is that Enhanced TEA cannot achieve indistinguishability under chosen-plaintext attack (IND-CPA), as is the case for any deterministic encryption scheme without per-message randomization; an adversary can trivially distinguish repeated plaintexts by observing repeated ciphertexts.

This property is particularly relevant to the target application, in which inference payloads are drawn from small alphabets (e.g., a 1-byte class label). A passive adversary observing traffic over time can partition ciphertexts into equality classes and, given auxiliary information about class frequencies, may infer the underlying inference outcomes without recovering the key. Deployments in which the distribution of inference outputs is itself sensitive should therefore incorporate per-message freshness. Two lightweight mitigations are compatible with the proposed framework:

• prepending a short random or counter-based nonce to the plaintext block prior to hashing and encryption, so that S(nonce∥P) diversifies the effective key even for repeated payloads, at the cost of transmitting the nonce;
• embedding a monotonically increasing sequence number within the payload, which simultaneously supports the replay-mitigation mechanisms described in Section 6.5.3.

Both mitigations preserve the ARX computational profile of the scheme. In the transmitted-diversifier deployment of Section 9.4, mitigation (1) is mandatory for low-entropy payloads, since the transmitted value S(P) otherwise enables direct dictionary recovery of the plaintext. Formal security analysis of the nonce-based variant under standard indistinguishability notions is outside the scope of the present construction.

4.4.7 Interpretation of the formal analysis

Table 4 summarizes the conclusions that can be established from the structural analysis. The purpose of the table is to separate formally derivable properties from empirical observations and security properties that remain unproven.

Table 4. Formal and empirical security boundaries of the proposed Enhanced TEA construction.

4.5 Limitations and future work

The formal structural analysis establishes that the proposed plaintext-dependent diversification mechanism preserves XOR-related master-key differences and the equivalent-key classes of classical TEA. In addition, the deterministic mode of operation leaks plaintext equality and therefore does not provide IND-CPA-style indistinguishability without per-message freshness. The present evaluation does not derive quantitative differential probability bounds or maximum linear-correlation bounds for the complete construction. Moreover, the framework provides confidentiality only and does not natively provide authentication or integrity protection.

Future work will focus on automated differential and linear trail analysis using SAT/SMT- or MILP-based methods, formal evaluation of nonce-based diversification under standard indistinguishability notions, high-precision transient power and side-channel characterization, evaluation on additional ultra-low-power microcontroller families, and integration with lightweight authentication mechanisms while preserving the low-latency characteristics of the proposed framework.

5 Experimental setup

The experimental evaluation was conducted on a Raspberry Pi 4 platform configured as an edge computing environment for TinyML inference, encryption, and MQTT-based communication. The platform was intentionally selected to enable complete system level integration, runtime profiling, and reproducible benchmarking under realistic edge deployment conditions. Although the Raspberry Pi provides greater computational capability than highly constrained microcontroller-class IoT devices such as ESP32, STM32, or ARM Cortex-M platforms, it serves as a practical proxy for evaluating communication overhead, computational feasibility, and system-level integration behavior in resource-constrained edge environments.

The reported results should not be treated as absolute performance standards which apply to ultra-low-power microcontroller systems. The results show how different computational methods and memory usage and CPU usage and communication performance of the new system operate under limited edge computing conditions. The relationship between performance characteristics and hardware platforms will show proportional changes because algorithmic complexity determines their primary impact.

The Enhanced TEA system uses a maximum of 15.7 KB RAM which stays within the NIST LWC Class 1 device memory requirements. The complete testing process requires both dedicated benchmarking and power profiling tests on microcontroller platforms which represent the target environment for IoT systems that operate under strict resource limits.

The measured memory footprint of Enhanced TEA (approximately 15.7 KB) falls within the nominal RAM constraints defined for NIST LWC Class 1 devices, indicating its suitability for deployment on resource-constrained embedded platforms. In addition to the complete system-level implementation on the Raspberry Pi 4, the proposed framework was benchmarked on representative microcontroller-class platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico and Vicharak Shrike Lite. The Raspberry Pi implementation executed the complete encryption and decryption workflow, including SHA-256-based key scheduling, round transformations, ciphertext generation, and successful plaintext recovery to verify functional correctness. The additional embedded-platform benchmarking further demonstrates that the proposed Enhanced TEA framework remains computationally feasible for representative TinyML-enabled IoT devices.

The implementation was developed using a software-based framework typical of IoT edge deployments. The system used standard monitoring tools to measure execution time and memory consumption and processor usage during the encryption and decryption processes.

All the experiments were conducted ten times independently to determine the consistency and repeatability of their results. All measurements reported are averages of these runs. As can be seen, the measured values of observed execution time and utilization of resources were not highly variant, as the relative standard deviation was less than 5% for all evaluated workload conditions, indicating stable runtime behavior and consistent system performance. No confidence interval or hypothesis based statistical testing was needed for this study, as the evaluation was based on system performance and the results showed consistent measurement patterns.

The experimental setup is designed to evaluate the proposed Enhanced TEA framework using the representative edge-centric deployment scenarios. The algorithm-level cryptographic benchmark on embedded platforms is presented in Section 7.5. Average operating current was experimentally measured for each embedded platform with calibrated digital multimeter under fixed supply voltage. The average operating power was then calculated as P = V×I, and the corresponding energy consumption was calculated using the measured execution time for each cryptographic algorithm. This approach makes it possible to compare the energy consumption of all lightweight cryptography algorithms in a fair and reproducible way under the same experimental conditions.

For each embedded platform, the evaluated cryptographic algorithms execute over relatively short durations while maintaining similar processor operating states and supply voltage. Hence the measured average operating current showed negligible variation among repeated executions and the average operating power was almost constant for a given platform. Hence, the differences in the reported energy consumption are mainly due to the differences in the execution time and not due to large changes in the average operating power.

5.1 Evaluation metrics

We evaluate the proposed Enhanced TEA framework using multiple performance, resource usage, and security metrics to showcase its suitability for TinyML-enabled IoT deployments under representative edge-computing conditions.

• Execution time: Time required to perform encryption and decryption operations.
• Runtime memory utilization: Peak RAM usage observed during cryptographic execution.
• CPU utilization: Processor workload incurred during cryptographic processing during the Raspberry Pi 4 system-level deployment.
• Average operating power: Average power consumed during cryptographic execution, calculated from experimentally measured current under a fixed supply voltage.
• Energy consumption: Energy consumed during encryption, computed using the measured average operating power and execution time.
• Security metrics: Avalanche effect, ciphertext entropy, completeness testing, and key sensitivity analysis.

To evaluate the repeatability of the experimental methodology, all system-level and embedded-platform experiments were independently repeated ten times under identical operating conditions. Table 5 reports the mean values and standard deviations for the Raspberry Pi 4 system-level measurements, while the embedded-platform benchmark tables present the average values obtained from the repeated experimental runs. The low variability observed across repeated measurements demonstrates stable runtime behavior and good experimental repeatability.

Table 5. Statistical summary of experimental measurements (n = 10).

Statistical summary (mean ± standard deviation, n = 10) of Raspberry Pi 4 end-to-end system-level measurements, capturing combined TinyML inference, Enhanced TEA encryption, and MQTT communication overhead across the evaluated payload configurations.

5.2 Experimental conditions

The experimental evaluation was performed under the following conditions:

• The full TinyML-enabled MQTT communication framework was deployed on a Raspberry Pi 4 to assess the end-to-end system performance including TinyML inference, cryptographic processing, MQTT communication, and resource usage.
• Independent additional algorithm-level benchmarking was performed on the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico, and Vicharak Shrike Lite to evaluate cryptographic performance on representative resource-constrained embedded platforms.
• The scalability and the computational behavior were tested with plaintext sizes from 64 bits to 524,288 bits.
• Each experiment was repeated ten times independently under the same operating conditions. The values reported are the average of the repeated measurements.
• The same methodology, compiler configuration, optimization settings, plaintext sizes, and measurement procedures were used in all benchmark results. Measurements were done separately for each embedded platform and no values were extrapolated or inferred from other platforms.
• The average operating current was measured experimentally for each embedded platform using a digital multimeter, with a fixed supply voltage. The methodology described in Section 5.4 was then used to calculate average operating power and energy consumption.

5.3 Selection of evaluation platforms

The experimental evaluation was conducted on multiple hardware platforms to evaluate the applicability at the system level and the efficiency at the algorithm level of the proposed framework on representative IoT devices with TinyML enabled.

The Raspberry Pi 4 was selected as the system level evaluation platform because it offers enough computation resources to support the complete TinyML-enabled MQTT communication framework including the TinyML inference, encryption, communications and system resource monitoring. The proposed architecture is validated end-to-end on realistic edge computing conditions in this platform.

Furthermore, we benchmarked the proposed cryptographic framework on four representative microcontroller platforms to assess its applicability on resource-constrained embedded devices. The ESP32-S3 DevKit is an example of current TinyML and edge AI deployments, providing embedded wireless connectivity and enough compute power for smart IoT applications. The Arduino Nano 33 BLE Rev2 is an example of ultra-low-power embedded systems with limited memory and processing resources that are used in battery-powered sensing applications. The Raspberry Pi Pico is a popular low cost embedded platform based on the RP2040 microcontroller and the Vicharak Shrike Lite is an example of emerging RISC-V based embedded systems for IoT applications.

These platforms cover several processor architectures, like Xtensa, ARM Cortex-M, RP2040 and RISC-V, which allow evaluating the proposed framework in representative embedded computing environments. Thus, for full system-level validation, the Raspberry Pi 4 was used, and the other platforms were used to benchmark the computational characteristics of the evaluated cryptography algorithms in resource-constrained deployment conditions.

5.4 Energy measurement methodology

The computational efficiency of the evaluated cryptography algorithms was estimated by execution time, memory usage during execution, average operating power and energy consumption. The execution time was measured experimentally by repeated execution of each cryptographic algorithm under the same experimental conditions on each evaluation platform. Runtime memory utilization was obtained using the platform specific profiling utilities.

The average operating current during the cryptographic execution was measured experimentally with a calibrated digital multimeter in series with the power supply of each embedded platform. In each algorithm, several executions were performed under the same operating conditions and the average current was calculated to reduce variability in measurements. The average operating power was calculated using Equation 21

Pavg=V×Iavg,(21)

where V is the measured supply voltage and I_avg is the experimentally measured average operating current, as each platform was operated from a fixed supply voltage throughout the experiments.

The assessed cryptography algorithms for each embedded platform execute for relatively short time periods with similar processor operating states and supply voltage. This resulted in the measured average operating current to have negligible variation over a number of executions, thus the average operating power for a given platform was almost constant. Thus, the reported energy consumption differences are mainly caused by the differences in execution time rather than the differences in average operating power. The consumed energy for encryption was then calculated using Equation 22:

E=Pavg×t,(22)

where t denotes the experimentally measured execution time. Since lightweight cryptographic algorithms execute at nearly constant processor utilization over relatively short execution intervals, the average operating power remained approximately constant for repeated executions on the same hardware platform. Consequently, the observed differences in energy consumption are primarily attributable to differences in execution time rather than variations in instantaneous power. Repeated measurements showed negligible variation in average operating power, supporting the use of the averaged values reported in this work.

5.5 Reproducibility and implementation details

The research summary below includes an overview of essential implementation components and experimental parameters which were used in this study. This research study develops its proposed system through Python programming language which runs on a Linux Operating System enabled Raspberry Pi 4 platform. The system uses MQTT protocol to establish communication through a local Mosquitto broker which operates with its standard configuration. The system uses TCP/IP for communication while QoS level 1 ensures that message delivery remains reliable.

The transmitted payload is a compact TinyML inference output, e.g., a class label, a confidence score, or an anomaly indicator. The size is usually in the range of 1-32 bytes. Before transmission, the payloads are encrypted using the Enhanced TEA framework. The encryption happens at the application layer and does not change the underlying structure of the MQTT protocol.

Each experiment was conducted for multiple independent runs (n = 10) with consistent payload sizes and communication intervals. During the evaluation process, performance measurements such as execution time, CPU utilization, memory consumption, and communication latency were collected. These measurements were obtained using system profiling tools that are available on the Raspberry Pi platform.

All implementation parameters, including key size (128-bit), number of rounds (64), and hash function (SHA-256), are fixed across experiments to ensure consistency. While the full implementation code and benchmarking scripts are not publicly released due to system-specific configurations, sufficient methodological and architectural details are provided to enable reproduction of the experimental setup.

6 Communication protocol integration

6.1 Application-layer payload encryption

Enhanced TEA functions at the application layer of standard IoT communication protocols. This study investigates secure MQTT payload transmission using Enhanced TEA encryption before sending them to cloud brokers. The proposed framework enables secure data transmission through its ability to protect data without requiring the processing resources needed for TLS/SSL systems. The system uses Enhanced TEA to protect CoAP payloads while maintaining efficient message transmission in resource-limited UDP environments.

6.2 Communication security integration perspective

The Enhanced TEA system functions as an application-based security solution which protects data through its encryption method while maintaining compatibility with existing lightweight IoT communication protocols and their complete transport security systems. The standard TLS/DTLS systems offer complete data protection through their end-to-end encryption and authentication methods but they create excessive operational demands because of their handshake procedures and their need to handle session states and validate certificates which make them unworkable for extremely limited TinyML edge devices.

Enhanced TEA enables payload-level encryption prior to transmission, allowing confidentiality protection while preserving the lightweight characteristics of communication protocols such as MQTT, CoAP, and MQTT-SN. By decoupling encryption from transport-layer session establishment, the scheme reduces protocol negotiation latency and minimizes memory requirements associated with TLS state management.

Payload-level encryption affects bandwidth efficiency and latency through different mechanisms when compared to transport-layer encryption. The experimental MQTT-based tests show that Enhanced TEA achieves a throughput reduction below 5% while increasing average latency by 10 to 18 milliseconds for payload sizes up to 10 KB. The overheads of the system operate within acceptable boundaries for delay-sensitive IoT applications which include environmental monitoring smart metering and edge-based anomaly detection.

The Enhanced TEA system enables communication through situations where persistent TLS sessions become unworkable because of temporary link drops or limited network reliability. The system uses lightweight payload encryption to protect data transmission through connectionless UDP-based systems that operate with CoAP on LPWAN and Zigbee networks. The proposed framework enables message authentication together with integrity verification and replay protection through its various authentication mechanisms which include MQTT authentication frameworks and OSCORE-based CoAP security and lightweight MAC tagging methods. The security system enables multiple deployment options because it uses different security levels to protect data which needs special handling of confidentiality under conditions of latency and resource limitations.

6.3 Justification for confidentiality-focused lightweight encryption

Modern cryptographic standards for constrained environments increasingly recommend the use of Authenticated Encryption with Associated Data (AEAD) schemes, which simultaneously provide confidentiality, integrity, and authentication within a unified cryptographic primitive. Lightweight AEAD algorithms such as Ascon-128 have been standardized for resource-constrained environments and provide strong provable security guarantees under well-defined adversarial models (Dobraunig et al., 2021).

The selection process for cryptographic mechanisms in real-world IoT systems needs to assess three factors which include the specific resource limitations of the application, the required time for data transmission, and the total system integration costs. The Enhanced TEA framework developed in this research specifically targets lightweight confidentiality protection which is designed for TinyML-based edge communication systems that transmit minimal inference metadata instead of complete sensor data streams.

SHA-256 is used in the proposed framework which introduces more computation overhead than lightweight hash alternatives. However, its effect is mitigated by the TinyML communication model where encryption is performed on small inference outputs rather than continuous high volume data streams. This leads to a low effective hashing frequency, and a limited cumulative cost.

SHA-256 was chosen as a conscious compromise between cryptographic strength, ease of implementation, and computational cost. This design choice is motivated by the low CPU utilization and acceptable latency overheads observed in the considered edge environment. Lightweight hash primitives or reduced-round variants could provide alternative design options with less computational overhead for highly constrained microcontroller-class devices.

The AEAD schemes introduce extra computational requirements and memory demands through their three main components which include authentication tag creation and associated data handling and internal system changes that use permutation methods. The overhead is suitable for platforms with moderate resource limits but it creates problems when used in ultra-constrained IoT nodes which have strict memory requirements and limited processing power and need to minimize energy use. The research into lightweight cryptographic protocols shows that security services which combine confidentiality with authentication create more latency and memory requirements than systems which protect confidentiality alone especially in real-time IoT communication networks (Khan et al., 2021).

In multiple real-world IoT communication systems, they protect their essential data through layered security systems which provide better security than using single cryptographic methods. Organizations can achieve security through flexible design which combines lightweight payload encryption with their existing authentication protocols, which include MQTT authentication and Object Security for Constrained RESTful Environments (OSCORE) authentication methods (Selander et al., 2019). The system architecture supports security service selection which matches specific application needs, while maintaining device operational efficiency.

The proposed Enhanced TEA scheme therefore positions itself as a confidentiality-focused lightweight encryption module designed to complement, rather than replace, standardized AEAD solutions. The proposed encryption mechanism provides deployment options that require mandatory integrity and authentication protection through its compatibility with lightweight message authentication codes and protocol-layer authentication mechanisms. The security architecture of this system supports flexible deployment across heterogeneous IoT networks which have distinct security needs and resource limitations.

Furthermore, TinyML-driven edge deployments frequently prioritize ultra-low latency and energy efficiency due to continuous local inference and event-driven communication requirements. In such environments, encrypting compact inference outputs using lightweight confidentiality mechanisms may provide sufficient protection while minimizing system overhead. The reduced computational complexity of ARX-based block cipher structures enables predictable performance scaling and lower energy consumption compared to permutation-based AEAD constructions under certain deployment conditions.

It is important to emphasize that the proposed confidentiality-focused design neither attempt to replace standardized AEAD mechanisms nor introduce a fundamentally new cryptographic algorithm in applications requiring strong provable security guarantees. The Enhanced TEA framework functions as a lightweight solution which organizations can use in real-world situations that need to protect confidential information while they require the ability to design their systems through multiple options and they need to minimize power use during their operational processes.

6.3.1 Comparison with AEAD-based lightweight cryptography

To further clarify the design choice of a confidentiality-focused lightweight encryption mechanism, Table 6 provides a comparison between the proposed Enhanced TEA scheme and representative AEAD-based lightweight cryptographic algorithms such as Ascon-128.

Table 6. Comparison between AEAD-based lightweight cryptography and Enhanced TEA.

From a system design perspective, the choice of Enhanced TEA is not intended to compete with or replace standardized AEAD algorithms such as Ascon-128. Instead, it reflects an application-driven optimization where confidentiality, ultra-low latency, and minimal resource consumption are prioritized over integrated authentication in specific TinyML edge communication scenarios. This targeted design choice enables efficient deployment in environments where full AEAD-based security may be computationally prohibitive or unnecessary.

6.4 Practitioner implementation guide: a deployment recipe for MQTT/CoAP

This section outlines deployment procedures for integrating Enhanced TEA into MQTT- and CoAP-based IoT systems.

6.4.1 Identify the encryption scope

Enhanced TEA is meant to protect TinyML inference metadata, not raw sensor data streams. Encrypted data often contains short inference results, such as classification labels, confidence scores, anomaly indicators, or aggregated summaries.

6.4.2 Perform edge-side encryption

The encryption happens immediately after the TinyML inference but before the message serialization. The enhanced TEA algorithm is executed locally with a pre-shared symmetric key securely stored on the edge node. This placement guarantees that the results of inference are secured before being sent on possibly unsecured communication channels.

6.4.3 MQTT integration

For MQTT-based deployments, the encrypted inference metadata should be embedded directly within the message payload before publishing. The following integration pattern is recommended:

• The topic hierarchy remains unchanged to preserve broker compatibility.
• The payload contains the ciphertext produced by Enhanced TEA.
• Quality of Service (QoS) levels are selected based on application requirements and remain independent of the encryption layer.

Decryption is performed at the subscriber or backend application after message reception. Prior studies indicate that application-layer encryption mitigates MQTT payload exposure risks while maintaining protocol compatibility (Panahi et al., 2021).

6.4.4 CoAP integration

For CoAP deployments:

• Encryption is applied before payload construction
• The message body carries the encrypted inference metadata while the CoAP headers and options remain unencrypted to support protocol interoperability.

The design enables seamless integration without requiring modifications to existing protocol structures.

6.4.5 Key management and rotation

Secure symmetric key distribution is performed during device onboarding with keys stored in protected device memory. The longest period of operation needs organizations to implement regular key changes which they can schedule through their current device management solutions or application-level systems. Enhanced TEA does not impose restrictions on key distribution strategies and can be integrated with standard IoT provisioning workflows.

6.4.6 Performance and energy considerations

Practitioners should evaluate encryption latency and energy consumption according to the real-time and energy constraints of their target applications. The experimental results presented in Sections 7.4 and 7.5 demonstrate that the proposed Enhanced TEA introduces additional computational overhead due to the SHA-256-based dynamic key diversification stage. However, the measured execution time, runtime memory utilization, average operating power, and energy consumption remain within the capabilities of representative TinyML-enabled embedded platforms.

For practical deployments, the measured average operating power remained approximately constant for repeated executions on each embedded platform, indicating that differences in energy consumption are primarily determined by execution time. Consequently, application developers should consider the trade-off between the enhanced security provided by dynamic key diversification and the modest increase in computational and energy overhead.

In resource-constrained IoT systems, communication energy often exceeds cryptographic computation energy. The proposed framework minimizes this overhead by encrypting compact TinyML inference results (e.g., a 1-byte class label) rather than continuous raw sensor data streams. This significantly reduces communication bandwidth, transmission energy, and overall system power consumption, making the framework well suited for battery-powered and energy-constrained smart city deployments.

6.4.7 Security layer integration

Enhanced TEA provides lightweight confidentiality and diffusion properties at the application layer. Authentication and integrity protection can be implemented through protocol-level or higher-layer mechanisms when required. The objective of the proposed scheme is not to replace standardized authenticated encryption algorithms such as Ascon-128 or other NIST LWC finalists, but rather to provide a communication-aware confidentiality module optimized for TinyML inference metadata under strict latency and resource constraints. Depending on deployment requirements, practitioners may combine the proposed scheme with protocol-level authentication or application-layer integrity checks.

6.5 Communication security deployment model

This subsection formalizes the operational placement and lifecycle management of Enhanced TEA within practical IoT communication systems. The objective is to clarify how the proposed confidentiality mechanism integrates into existing protocol stacks while preserving interoperability and system-level security guarantees.

6.5.1 Layered security positioning

The Enhanced TEA system functions at the application layer which protects TinyML inference metadata through encryption after local processing and before protocol serialization. The MQTT-based system uses ciphertext to replace plaintext in its message payloads while maintaining its original topic hierarchy and broker routing functions. The CoAP system protects its message body through encryption while allowing access to its protocol headers and options to enable interoperability and resource discovery.

The design allows for secure data protection without changing the functioning of transport layer systems. Enhanced TEA may coexist with TLS/DTLS when required to create a security system that operates at multiple levels. The transport layer security system establishes secure channels between parties while verifying their identities, and application layer encryption protects payload data from being accessed by intermediary nodes and broker systems and partially trusted gateways.

6.5.2 Key management and lifecycle

The deployment model requires symmetric keys which the system provides during the secure device onboarding process through its secure initialization procedures. The system stores keys in secure device memory while preventing their transmission as plaintext during operational activities. The system implements key rotation through two methods which include application-level control channels and existing device management frameworks.

The system creates dynamic key diversification through its local operation which processes each plaintext block without needing to transmit extra keys through its communication system. The system operates without introducing any handshake delay or session-state management requirements which are standard in TLS-based systems.

6.5.3 Integrity and replay considerations

Enhanced TEA is designed as a confidentiality-focused security mechanism within a layered IoT security architecture. Protection against message tampering, replay, and injection attacks is achieved through complementary mechanisms such as lightweight MAC tagging, protocol-level authentication (e.g., MQTT authentication), or CoAP security extensions (e.g., OSCORE), rather than being embedded directly within the encryption primitive. The system can achieve integrity protection and protection against replay attacks through additional security measures which include lightweight message authentication codes (MACs) and MQTT authentication frameworks and CoAP security extensions that include OSCORE. The system architects can use the modular design to pick which authentication methods and integrity protection solutions to implement according to their specific deployment requirements.

Replay mitigation may be achieved using application-level sequence numbers, timestamp validation, or broker-managed session identifiers without altering the encryption core.

6.5.4 Deployment scenarios

The proposed deployment model supports three representative scenarios:

• Ultra-constrained edge nodes, where TLS session establishment is computationally expensive or intermittently unreliable
• Gateway-assisted architectures, where payload confidentiality must be preserved across intermediate broker infrastructure
• Hybrid security environments, where transport-layer encryption is used for channel protection while Enhanced TEA provides end-to-end inference metadata confidentiality

By separating confidentiality from transport-layer negotiation, the model reduces protocol overhead while maintaining compatibility with standardized IoT communication frameworks. This approach enables flexible security layering suited to heterogeneous IoT deployments characterized by strict latency, memory, and energy constraints.

7 Performance analysis

All experimental evaluations reported in this section were conducted under identical operating conditions. Each experiment was repeated 10 times (n = 10), and the reported values correspond to the mean of the measurements. The standard deviation across repeated runs remained below 5%, indicating stable execution behavior and good experimental repeatability for all evaluated configurations. No evidence was observed to suggest that the measured performance differences between the evaluated algorithms resulted from transient system variability.

The deterministic nature of the cryptographic operations and the controlled experimental environment meant that formal statistical significance testing (e.g., p-values or confidence intervals) was not considered necessary to interpret the observed trends in system-level performance. The error bars are omitted because the difference between repeated measurements was sufficiently small so as not to influence the comparative conclusions of this study.

The repeated experimental measurements are consistent, confirming that the observed differences in execution time, runtime memory utilization, CPU utilization, power consumption, and energy consumption are stable and reproducible under identical operating conditions.

While logarithmic scaling may seem to suggest nonlinear growth, the true computational complexity is linear in the input size. The end-to-end communication performance including cryptographic processing, TinyML inference, MQTT communication, and system-level resource usage was evaluated using the Raspberry Pi 4 as the complete TinyML-enabled MQTT system integration platform. Additional benchmarking was conducted on representative embedded platforms, including ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico, and Vicharak Shrike Lite under identical experimental conditions to further show the applicability of the proposed framework to resource-constrained IoT environments. These experiments validated CPU Cycles Per Byte (CPB), runtime memory utilization, average operating power, and energy consumption, complementing the Raspberry Pi 4 system-level validation.The Raspberry Pi 4 evaluation and the embedded-platform benchmark characterize different aspects of computational performance. The former measures end-to-end execution within the complete TinyML-enabled MQTT communication framework, whereas the latter evaluates algorithm-level computational efficiency under identical implementation methodology, compiler configuration, plaintext sizes, and measurement procedures. Consequently, direct numerical comparison or relative ranking between these two evaluations is not appropriate. The classical TEA exhibits the lowest computational complexity because of its simple key scheduling mechanism; however, its comparatively lower avalanche effect and ciphertext entropy may limit its suitability for security-sensitive TinyML communication. The additional SHA-256-based dynamic key diversification introduces a fixed preprocessing overhead that is more noticeable for smaller payloads, while its relative impact decreases as the plaintext size increases. This additional computational cost is considered acceptable in view of the improved security characteristics achieved by the proposed framework.

The proposed Enhanced TEA framework was evaluated as part of the complete TinyML-enabled MQTT communication system deployed on the Raspberry Pi 4 platform. In addition, TEA, XTEA, XXTEA, Enhanced TEA, and Ascon-128 were implemented and benchmarked under identical experimental conditions on representative embedded platforms, as presented in Section 7.5. Accordingly, the reported execution time, runtime memory utilization, power consumption, and energy consumption represent direct experimental measurements for all evaluated algorithms.

The Raspberry Pi 4 serves as the complete TinyML-enabled MQTT system integration platform, whereas the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico, and Vicharak Shrike Lite are used for representative embedded-platform benchmarking of the evaluated cryptographic algorithms under identical experimental conditions.

7.1 Time analysis

The performance in terms of time is still an important factor to be considered when comparing lightweight encryption algorithms, especially in the case of very limited resources, like embedded systems or IoT devices. This part of the paper shows a detailed timing of the Enhanced TEA, TEA, XTEA, and XXTEA, where it is pointed out how the encryption and decryption times are affected by the size of the plaintext during execution. Figures 3 and 4 present timing results using logarithmic scaling on the vertical axis to improve visualization across varying plaintext sizes.

7.1.1 Encryption time analysis

The graph in Figure 3 shows how much time in seconds was needed for the encryption process for different plaintext sizes, with the recorded times being in a logarithmic scale. The following points are observed.

Enhanced TEA and Original TEA provide short encryption times for the small size of plaintexts and nearly the same performance till about 1 KB. However, as the plaintext size increases, the difference in encryption time between Enhanced TEA and Original TEA becomes really noticeable, with the former taking much more. Although logarithmic plots visually emphasize curvature, the execution time increases approximately linearly with input size due to fixed-round block-wise processing. While Enhanced TEA is slightly slower than XTEA due to the computational cost of SHA-256-based key scheduling, it provides an improved security-to-performance trade-off. On the other hand, XXTEA shows high encryption time but its fluctuations are less than that of XTEA and hence it is considered more stable. These trends imply that although Enhanced TEA possesses the stronger security features, its encryption efficiency is still lower than TEA but competitive with XTEA and better than XXTEA.

7.1.2 Decryption time analysis

The decryption time performance with the increasing plaintext sizes is demonstrated in Figure 4. The computational load distribution among the TEA family of algorithms in resource-scarce environments is revealed by the data. The following key observations were made: Decryption times are minimal for lower plaintext sizes, with Enhanced and Original TEA performing similarly up to 2 KB. Due to dynamic key scheduling and complexity, Enhanced TEA's decryption time grows more sharply than Original TEA's as plaintext size increases. Block cipher decryption rounds are computationally expensive, hence all four techniques increase decryption time approximately linearly with plaintext size. XTEA has the longest decryption times, with dramatic jumps beyond 15 KB, indicating ineffective processing of bigger data blocks. XXTEA decrypts faster than XTEA but more volatilely than TEA and Enhanced TEA. Real-time or latency-sensitive applications benefit from enhanced TEA's predictable and smooth decryption time curve. CPU use remains below 13% even with large input sizes, indicating good resource management. Enhanced TEA is slightly slower than TEA but more stable and faster than XTEA and XXTEA, which vary with plaintext size.

7.2 Memory analysis

The memory efficiency of cryptographic algorithms is a decisive factor for deployment in resource-constrained IoT environments. In this section, the memory footprint of Enhanced TEA is evaluated against the TEA family (TEA, XTEA, and XXTEA) to determine suitability for NIST LWC Class 1 devices, which are characterized by having less than 16 KB of RAM. Ascon-128 is not included in the plaintext-size memory profiles of Figures 5 and 6; its runtime memory is reported separately in the embedded-platform benchmark of Section 7.5 (Table 7).

Table 7. Runtime memory utilization under identical experimental conditions.

7.2.1 Algorithm-specific footprint vs. system RAM

The analysis shows that the specific memory requirements needed for cryptographic operations while executing the process does not depend on the total RAM capacity of the system. The experimental results show that the low computational complexity requires only bitwise shifts, additions, and XOR operations to operate so algorithmic memory requirements are largely independent of total system RAM, although runtime overhead may vary across platforms.

7.2.2 Encryption and decryption phase memory usage

As illustrated in Figures 5 and 6, Enhanced TEA maintains a peak memory footprint of 15.7 KB for a 64-byte payload.

• NIST LWC Class 1 Context: The measured peak runtime memory usage of approximately 15.7 KB falls below the nominal 16 KB RAM boundary associated with NIST LWC Class 1 devices. This observation is further supported by the additional benchmarking performed on representative embedded platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico, and Vicharak Shrike Lite, which demonstrates the practical feasibility of deploying the proposed Enhanced TEA on representative resource-constrained TinyML-enabled IoT platforms.
• Stability and predictability: Unlike XTEA and XXTEA, which exhibit erratic memory behavior and higher footprints (up to 16.5 KB), Enhanced TEA shows a stable and linear scaling trend.
• Dynamic key overhead: The dynamic key scheduling mechanism in Enhanced TEA adds only a negligible overhead (≈ 0.5 KB) compared to the original TEA, confirming that security enhancements do not violate the “Tiny” philosophy.
• Comparison with AEAD standards: While Ascon-128 provides authenticated encryption with associated data (AEAD), thereby offering confidentiality, integrity, and authenticity, these additional security services require greater computational complexity than confidentiality-oriented lightweight ciphers. The embedded-platform benchmark presented in Section 7.5 shows that Ascon-128 incurs higher runtime memory utilization and computational cost than the classical TEA family, although the measured memory requirements remain within the available SRAM resources of the evaluated representative embedded platforms. Consequently, the proposed Enhanced TEA is intended for deployment scenarios where lightweight confidentiality protection, low computational overhead, and efficient TinyML inference communication are the primary design objectives, rather than replacing modern AEAD standards.

7.2.3 Memory management for real-time IoT

The observed linear scaling with respect to input size ensures uniform system performance. This is vital for real-time IoT applications and resource-aware scheduling, as it prevents heap exhaustion or stack overflows that could occur on devices with limited memory management units. By maintaining a footprint below the 16 KB threshold regardless of the host's total RAM under the tested experimental conditions, Enhanced TEA demonstrates characteristics that suggest potential portability for large-scale smart city deployments.

7.3 CPU utilization analysis

The utilization of the CPU is a very important measure when it comes to evaluating the feasibility of cryptographic algorithms on low-power and embedded edge platforms. High CPU usage can cause the system to slow down, use more power, and become overheated, which is particularly true for devices that do not have active cooling and rely on passive cooling only. The computational efficiency of the TEA, Enhanced TEA, XTEA, and XXTEA algorithms will be assessed in this section with respect to different plaintext sizes. Ascon-128 is not included in the plaintext-size CPU profiles of Figures 7 and 8; its CPU utilization is reported in the Raspberry Pi 4 system-level summary (Table 8) and its per-byte computational cost in the embedded-platform benchmark of Section 7.5 (Table 9). While Ascon offers standardized AEAD security, its increased memory footprint and implementation complexity may limit its suitability for ultra-constrained TinyML edge deployments.

Table 8. Combined raspberry Pi 4 system-level performance and security metrics.

Execution time, decryption time, runtime memory utilization, and CPU utilization correspond to measurements obtained from the Raspberry Pi 4 system-level implementation of the complete TinyML-enabled MQTT framework. Avalanche effect and ciphertext entropy for Ascon-128 are adopted from standardized NIST Lightweight Cryptography reference implementations, whereas all remaining values are obtained through direct experimental measurements.

Table 9. CPU cycles per byte (CPB) for encryption across representative embedded platforms.

Reported values correspond to the largest evaluated plaintext size (524,288 bits), where the fixed initialization overhead becomes negligible and the CPU Cycles Per Byte stabilize, providing a representative steady-state measure of computational efficiency.

7.3.1 Encryption phase CPU utilization

The encryption process's CPU consumption graph is shown in Figure 7. When the plaintext is small (less than 10 KB), all four algorithms show very low CPU usage, almost the same, and that is typically under 10%. This indicates that they perform lightweight operations which are ideal for real-time constraints. The larger the plaintext size, the more Enhanced TEA gradually starts to load the CPU, finally reaching around 30-35% for the largest plaintext size (around 80 KB). It should be noted that the 12.6% utilization reported in Table 8 represents the mean CPU load for a standard 64-byte payload, whereas the 30–35% figure refers to the peak computational load under maximum data stress conditions. The reason for the increase is that the algorithm uses a dynamic key scheduling mechanism that adds iterative complexity to produce better cryptographic strength. On the contrary, Original TEA uses less CPU power throughout its operation, only about 15–20% at the highest plaintext sizes. This is an indication of its simpler static key structure. XTEA and XXTEA, however, have erratic CPU usage patterns, with large fluctuations of spikes and dips, especially between 25 KB and 50 KB, which means that their CPU behavior is less predictable. XTEA occasionally uses more CPU than Enhanced TEA, particularly in medium-sized plaintexts, which may be attributed to structural algorithmic differences, although detailed implementation-level profiling is outside the scope of this study. In spite of that, Enhanced TEA offers a stable and linear CPU scaling that is more predictable and manageable than XTEA/XXTEA and thus is the better option for consistent performance.

7.3.2 Decryption phase CPU utilization

The CPU usage during decryption is depicted in Figure 8. Enhanced TEA again took more time than Original TEA because of key regeneration and inverse transformations with dynamic parts. CPU usage is directly correlated with the volume of the plaintext, but it stays below 40%, thus proving efficiency and scalability even with the largest data sizes. The XTEA, on the other hand, is characterized by very frequent CPU usage peaks, at times reaching more than 45%, which indicates higher computational overhead under the evaluated implementation. If the latter is the case, then XXTEA is slightly better but still performs less consistently than Enhanced TEA. The CPU usage curve pattern of Enhanced TEA is smooth indicating relatively stable and predictable CPU utilization behavior, which is the quality needed for the use in multitasking embedded systems.

7.4 Energy consumption analysis

Energy efficiency is an important consideration for TinyML-enabled IoT deployments, where embedded devices often operate under limited power budgets and, in many applications, rely on battery-powered operation. To evaluate the energy efficiency of the proposed framework, energy consumption was determined using experimentally measured execution time together with experimentally measured average operating power following the methodology described in Section 5.4.

The proposed Enhanced TEA introduces an additional SHA-256-based dynamic key diversification stage prior to the encryption rounds. This preprocessing increases the total computational workload and therefore increases the total execution time compared with the classical TEA family. As a result, the measured energy consumption of Enhanced TEA is higher than that of TEA, XTEA, and XXTEA, while remaining within the operational capabilities of all evaluated embedded platforms.

The comparative benchmark presented in Section 7.5 further confirms the computational efficiency of the evaluated algorithms through hardware-independent CPU Cycles Per Byte (CPB), runtime memory utilization, and average operating power measured across representative embedded platforms. Although Ascon-128 provides authenticated encryption with integrated confidentiality and integrity protection, the proposed Enhanced TEA maintains practical energy requirements while providing improved diffusion characteristics through dynamic key diversification. These results demonstrate that the proposed framework remains suitable for representative TinyML-enabled IoT deployments where low computational overhead and practical energy efficiency are important design considerations.

7.5 Comparative benchmarking on representative embedded platforms

This section presents an algorithm-level benchmark across representative embedded platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico, and Vicharak Shrike Lite. The benchmark evaluates CPU Cycles Per Byte (CPB), runtime memory utilization, and average operating power under identical implementation methodology, compiler configuration, plaintext sizes, and measurement procedures. These results complement the Raspberry Pi 4 system-level evaluation presented in the preceding subsections by assessing the computational characteristics of the evaluated cryptographic algorithms on representative resource-constrained embedded platforms.

To provide a fair and consistent comparison of lightweight cryptographic algorithms, an additional experimental evaluation was conducted on four representative resource-constrained embedded platforms, namely the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, Raspberry Pi Pico, and Vicharak Shrike Lite. The benchmark includes TEA, XTEA, XXTEA, Enhanced TEA, and Ascon-128, all implemented using the same source code base, plaintext sizes, compiler optimization settings, implementation methodology, and measurement procedures on each platform. The evaluation measures CPU Cycles Per Byte (CPB), runtime memory utilization, and average operating power under identical experimental procedures, thereby enabling a controlled algorithm-level comparison across representative embedded devices. This benchmark complements the Raspberry Pi 4 system-level evaluation presented in the previous subsections, where the complete TinyML-enabled MQTT communication framework was deployed and analyzed, while the embedded-platform benchmark isolates and compares the cryptographic performance of the evaluated algorithms under resource-constrained deployment conditions.

Although the Raspberry Pi Pico and Vicharak Shrike Lite employ different processor architectures, both platforms execute the evaluated lightweight ARX-based cryptographic operations with comparable steady-state efficiency under the selected benchmark configuration. As the plaintext size increases, the fixed initialization overhead becomes negligible and the CPU Cycles Per Byte (CPB) converges to nearly identical values. The small differences observed in the raw execution-time measurements therefore become indistinguishable after CPB normalization and rounding to the reported precision, without affecting the comparative conclusions of this study.

Table 9 presents the measured CPU Cycles Per Byte (CPB) for encryption across the evaluated representative embedded platforms under identical experimental conditions. CPB provides a hardware-independent measure of computational efficiency by normalizing the processor cycles required to encrypt one byte of data. Compared with absolute execution time, CPB enables fair comparison across processors operating at different clock frequencies and architectures. As expected, the proposed Enhanced TEA incurs a higher CPB than the classical TEA variants because of the additional SHA-256-based dynamic key diversification stage. Nevertheless, the observed values confirm that the proposed framework remains computationally feasible on all evaluated TinyML-enabled embedded platforms. The comparison with Ascon-128 was performed under identical implementation methodology, compiler configuration, plaintext sizes, and measurement procedures, thereby providing a fair algorithm-level benchmark.

The measured CPB values exhibit comparable algorithm-level computational behavior across all evaluated embedded platforms. The classical TEA variants achieve the lowest computational cost owing to their simpler key scheduling mechanisms, whereas the proposed Enhanced TEA introduces additional computational effort through SHA-256-based dynamic key diversification. Despite this increase, the measured CPB values remain within the practical computational capabilities of the evaluated embedded platforms. Furthermore, the comparison with Ascon-128 demonstrates that the proposed framework provides a competitive confidentiality-oriented lightweight encryption solution while maintaining practical computational efficiency for TinyML-enabled IoT deployments.

Table 7 summarizes the runtime memory utilization observed during encryption. The additional memory required by the proposed Enhanced TEA originates from the temporary workspace associated with SHA-256 computation and dynamic key generation. Nevertheless, the observed memory footprint remains well within the available SRAM resources of all evaluated embedded platforms, demonstrating that the proposed framework remains suitable for deployment on representative TinyML-enabled IoT devices.

It is important to note that while the Raspberry Pi 4 system-level evaluation (Table 8) shows lower end-to-end latency for Enhanced TEA than for the evaluated Ascon-128 implementation, the algorithm-level per-byte benchmark on constrained MCUs (Tables 7, 9) shows the opposite trend: Enhanced TEA incurs higher CPU Cycles Per Byte and higher runtime memory than Ascon-128, owing to the fixed SHA-256-based key diversification stage executed per block. These are not contradictory results but reflect different measurement scopes—full-system execution on an application-class edge device vs. isolated per-byte cryptographic cost on microcontroller-class hardware. Enhanced TEA's advantage is therefore not lower absolute cryptographic cost than Ascon-128, but improved diffusion over classical TEA variants combined with a confidentiality-only design that remains within the SRAM and computational budgets of the evaluated constrained platforms.

Table 10 presents the experimentally measured average operating power of the evaluated lightweight cryptographic algorithms across the representative embedded platforms. The proposed Enhanced TEA maintains average operating power comparable to the other evaluated lightweight cryptographic schemes despite the additional SHA-256-based dynamic key diversification stage. The average operating power remained nearly constant within each embedded platform across the evaluated algorithms, consistent with the measurement methodology described in Section 5.4. This behavior is expected because all measurements were performed under a fixed supply voltage while the processors operated in similar execution states during cryptographic computation. Consequently, differences in the measured energy consumption are primarily attributable to variations in the measured execution duration rather than significant changes in average operating power. This methodology provides a realistic representation of the energy requirements of continuous cryptographic operation in practical TinyML-enabled IoT devices.

Table 10. Average measured power consumption during encryption.

Average operating power values correspond to the mean of repeated current measurements performed under identical operating conditions using a fixed supply voltage. Variations across repeated measurements were negligible.

Across all evaluated embedded platforms, the computational overhead exhibited consistent scaling behavior as the plaintext size increased. The additional computational cost introduced by the SHA-256-based dynamic key diversification represents a fixed preprocessing stage that is executed once prior to the encryption rounds, whereas the subsequent encryption stage scales proportionally with the amount of processed data. Consequently, the relative impact of the preprocessing stage decreases as the plaintext size increases, demonstrating that the proposed framework maintains stable computational behavior across different message sizes while remaining well suited for compact TinyML inference payloads and lightweight IoT communication.

Although the absolute CPU Cycles Per Byte (CPB) values vary across the evaluated embedded platforms because of differences in processor architecture and instruction execution characteristics, all cryptographic algorithms were evaluated under identical implementation methodology, compiler configuration, plaintext sizes, and measurement procedures. Consequently, the benchmark provides a consistent algorithm-level comparison of the evaluated lightweight cryptographic algorithms across representative embedded platforms.

Overall, the comparative benchmark demonstrates that the proposed Enhanced TEA can be successfully deployed and executed across all representative embedded platforms evaluated in this study, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, and Raspberry Pi Pico. Although the proposed Enhanced TEA incurs additional computational overhead owing to the SHA-256-based dynamic key diversification stage, the experimental results demonstrate that this overhead remains practical across all evaluated representative embedded platforms. More importantly, all evaluated cryptographic algorithms were benchmarked under identical experimental conditions, thereby providing a fair comparative evaluation that complements the Raspberry Pi 4 system-level validation presented earlier in this section.

8 Network-level communication evaluation

We examined the transmission effects of the Enhanced TEA algorithm through network-level testing using the MQTT protocol, which serves as a standardized messaging protocol for IoT environments. The aim is to study the impact of application-layer encryption on system performance through latency and throughput measurements in real-world wireless communication environments.

Figure 9 illustrates the experimental communication architecture, demonstrating how Enhanced TEA encryption is integrated at the application layer prior to MQTT message publication, thereby enabling evaluation of encryption-induced latency and throughput overhead across the complete edge-to-cloud communication pipeline. The experimental setup used a Raspberry Pi 4 as an edge device that sent encrypted data to a cloud-based MQTT broker through an IEEE 802.11n Wi-Fi connection.

The broker forwarded the received messages to a virtual cloud server for processing. The Paho MQTT Python client served as the testing tool. The system transmitted 1 KB and 5 KB and 10 KB Enhanced TEA-encrypted payloads and plaintext payloads at five-second intervals. Latency was measured using round-trip time (RTT) between message publication and acknowledgment, while throughput was determined by measuring the number of successfully processed messages per second. The throughput loss introduced by encryption is defined in Equation 23 as:

Loss%=(1-TencTplain)×100(23)

where T_enc and T_plain represent throughput with encrypted and plaintext payloads, respectively. Table 11 summarizes the network performance metrics. As shown in Table 11, network-level evaluation using MQTT shows a throughput loss of 4.2% for 10 KB payloads, with an average latency overhead ranging from 10 to 18 ms.

Table 11. Network performance comparison for plaintext and encrypted payloads using MQTT.

The research results show that Enhanced TEA increases latency by 10 to 18 milliseconds which remains within acceptable limits for real-time IoT applications. The message size testing showed less than 5% throughput reduction indicating that the algorithm operates reliably in low-bandwidth and high-latency network environments. The expected impact on latency and throughput will support QoS requirements for latency-sensitive applications which include smart metering and industrial control and environmental monitoring.

The present network-level evaluation focuses on single-client MQTT payload transmission under controlled IEEE 802.11n conditions in order to isolate encryption-induced communication overhead. Multi-client concurrency, variations in MQTT Quality of Service (QoS), broker-side resource behavior, and TLS-secured MQTT configurations are not included in the present experimental scope. The reported results therefore quantify the baseline latency and throughput impact attributable specifically to the proposed application-layer encryption mechanism rather than constituting a comprehensive protocol-stack performance study.

9 Security analysis

This section presents an empirical security evaluation of the proposed Enhanced TEA scheme through multiple statistical and cryptanalytic assessment methodologies. The analysis focuses on evaluating diffusion effectiveness, randomness characteristics, and empirical diffusion behavior under the evaluated differential perturbations, using standardized avalanche testing, entropy measurements, and comparative cryptographic performance analysis; consistent with Section 4.4, these measurements are presented as statistical evidence and not as claims of formal resistance to differential, linear, or related-key cryptanalysis. The objective of this evaluation is to quantify the practical security improvements introduced by the dynamic key scheduling mechanism while maintaining compatibility with resource-constrained IoT deployment environments. The presented evaluation emphasizes comparative empirical security improvements while acknowledging the scope of statistical validation rather than formal provable cryptographic security guarantees.

9.1 Differential cryptanalysis

Differential cryptanalysis is one strong method that can be used to evaluate the resilience of symmetric ciphers against chosen-plaintext attacks. It involves purposely altering certain bits in the paired input plaintexts then monitoring how the corresponding output ciphertexts differ, this all helps to determine the amount of diffusion and the strength of the cipher against attacks. A cipher that has very good diffusion will make it impossible for anyone to tell the nature of the input just by observing the output even if a very small change is made in the input, which is the key point of confidentiality.

To formally characterize this, given two plaintexts P and P′, the differential input is defined as ΔP = P⊕P′, and the corresponding ciphertexts C and C′ yield a difference:

ΔC=C⊕C′(24)

Equation 24 gives a basic assessment of diffusion. This formula gives a basic assessment of diffusion. A strong encryption scheme aims to ensure that ΔC looks like random noise and has no correlation with ΔP for every input pair, thus making it impossible for the attackers to develop any beneficial differential characteristics.

This research conducted a differential cryptanalysis comparison on four algorithms namely, TEA, Enhanced TEA, XTEA, and XXTEA. The algorithms were tested through different plaintexts having only one or a few bits changed, which were then encrypted with a constant key. The differences in the resulting ciphertexts were subject to statistical analysis in terms of bias, recurrence, and their overall distribution pattern.

The original Tiny Encryption Algorithm (TEA) shows simple diffusion for its Feistel structure. Yet, our inspection uncovered that some input differences created the same patterns of output differences, meaning there was non-uniform diffusion. On one hand, TEA is simple and fast but at the same time, it is well known that it is vulnerable to differential cryptanalysis, and our results support these conclusions especially for small block sizes and few rounds.

In the Enhanced TEA, Dynamic key scheduling and better mixing processes enhance diffusion. The differences in the ciphertext outputs were evenly distributed with no observable correlations or repetitive patterns under the evaluated experiments for the differences in the inputs. The complex subkey changes and added non-linearity contribute to improved statistical diffusion characteristics.

XTEA is a successor of TEA that improves key scheduling and employs variable rotations. It gives a moderate to significant increase in diffusion, and thereby it diminishes the output differences' predictability in comparison with TEA. Still, in some test cases marked with structured input differences, a slight clustering was detected, which means that the output difference distribution is still somewhat biased. Despite the fact that XTEA is better than TEA, its empirical resistance to differential characteristics is still not as good as that of Enhanced TEA.

XXTEA has in fact strengthened the TEA lineage by introducing features like block-based processing and variable input length. It exhibits superior diffusion compared to XTEA, particularly in cases of larger block sizes. The differences in the outputs of differential tests were, in most cases, well-distributed yet sometimes, particularly in small inputs, localized patterns surfaced. This might be the result of its block-dependent operations that can be rendered less effective when the block size is restricted. Anyway, XXTEA demonstrates strong empirical diffusion behavior overall but not continually as strong as Enhanced TEA.

9.2 Avalanche effect test

The avalanche effect functions as an essential standard which assesses the performance of a cryptographic system by measuring how a slight input change studies output results. A strong avalanche effect demonstrates effective diffusion because input bits from the system affect multiple output bits. This specific feature works as a barrier against cryptanalysis activities while it protects the secret relationships between inputs and outputs.

To quantitatively assess this, the avalanche effect A is calculated using Equation 25:

A=1n∑i=1n(Hamming(C,Ci)B)(25)

where C is the ciphertext of the original plaintext, C_*i* is the ciphertext after flipping the i-th input bit, B is the ciphertext block size in bits (64 in our case), and n is the number of experiments. Minor variations in avalanche percentage values observed across different experimental evaluations result from differences in plaintext sampling distributions and statistical test iterations. These variations are expected in empirical diffusion testing and do not impact the relative comparative security conclusions.

The avalanche effect was tested using an 8-byte (64-bit) plaintext block which underwent systematic bit flipping from position 0 to 63 to measure its impact. After each change, the resulting ciphertext was compared with the original, and the percentage of altered output bits was recorded. The overall avalanche performance of each algorithm is shown by the average result of these 64 tests.

Experimental results show that Enhanced TEA demonstrates a significantly better avalanche effect than its predecessors. The system shows strong diffusion because a single-bit input change causes 54.69% of the ciphertext bits to flip which creates an unpredictable connection indicating strong diffusion between input and output bits. The measured avalanche effect values for TEA, XTEA, XXTEA, and the proposed Enhanced TEA were 49.00%, 47.83%, 48.65%, and 54.69%, respectively. These results indicate that the proposed framework improves diffusion relative to the classical TEA variants under the adopted evaluation methodology. Enhanced TEA demonstrates higher measured avalanche characteristics due to its modified round structure and key scheduling process.

For a 64-bit block cipher, an avalanche effect close to 50% indicates that a single-bit modification in the plaintext propagates to a substantial proportion of the ciphertext bits, reflecting effective diffusion. The measured value of 54.69% demonstrates strong empirical diffusion behavior and increased output sensitivity compared with the classical TEA variants under the adopted evaluation methodology.

To ensure statistical reliability, avalanche measurements were conducted across multiple randomized plaintext-key pairs, and the reported average value represents the mean across repeated trials. The observed variance remained within acceptable limits, indicating consistent diffusion behavior across different input distributions.

9.3 Entropy analysis

Entropy serves as the principal metric for assessing the randomness and unpredictability of the ciphertext generated by a specific encryption method. A high entropy number, approaching the theoretical limit of 8 bits per byte, signifies enhanced resistance to cryptographic assaults, including frequency analysis and pattern recognition, hence bolstering the overall security of the cipher. The entropy H of the ciphertext is formally calculated using the Shannon entropy expression in Equation 26:

H=-∑i=1npilog2pi(26)

where p_*i* is the probability of the i-th byte value (out of n = 256) in the ciphertext distribution. This study conducted entropy analysis with ciphertext derived from a 64-byte plaintext block. Entropy was calculated in bits per byte for four algorithms: TEA, XTEA, XXTEA, and the proposed Enhanced TEA.

The results show that Enhanced TEA cipher produces text with much higher entropy when compared to other cipher methods. Enhanced TEA reached an entropy value of 7.6618 bits per byte, which means that the output was highly unpredictable and no structural patterns could be detected within the evaluated experimental dataset. On the other hand, TEA produced an entropy of 6.4380 bits per byte while XTEA and XXTEA generated 6.7921 and 6.9854 bits per byte, respectively.

The remarkable increase in entropy for Enhanced TEA can be attributed to its upgraded key scheduling and internal mechanisms, which are responsible for the higher non-linearity and diffusion. Moreover, the modifications reduce observable plaintext patterns and increase ciphertext randomness under the evaluated experimental conditions.

9.4 Security implications of plaintext-dependent key scheduling

The Enhanced TEA framework introduces a plaintext-dependent dynamic key scheduling mechanism in which internal round subkeys are derived using a cryptographic hash of the input plaintext block. While this approach enhances diffusion characteristics and improves input-dependent key variability, it is important to carefully evaluate the security implications associated with incorporating plaintext-derived material into the key scheduling process.

Unlike conventional symmetric encryption schemes that rely solely on static master keys, the proposed mechanism combines a securely generated 128-bit secret master key with subkeys derived through a one-way cryptographic hash function. Secure hash functions such as SHA-256 are widely assumed to provide strong preimage resistance, second-preimage resistance, and collision resistance under standard cryptographic assumptions (National Institute of Standards and Technology, 2015). Under these properties, the hash-derived subkeys do not reveal meaningful information about either the plaintext or the master key, since reconstructing either input from the hash output remains computationally infeasible.

The use of hash-based key diversification aligns with established cryptographic key derivation practices. Modern key derivation frameworks, such as HKDF, employ cryptographic hash functions to derive multiple pseudo-random subkeys from shared secret material while preserving overall key confidentiality (Krawczyk and Eronen, 2010). In a similar manner, the proposed scheme utilizes plaintext-dependent hashing to introduce dynamic internal key variation without replacing or weakening the master symmetric key. In cryptographic modeling frameworks, secure hash functions are often treated as pseudo-random mappings when used for key diversification and internal parameter randomization (Bellare and Rogaway, 1993).

The security properties discussed above emphasize practical deployment considerations rather than formal provable guarantees. While the plaintext-dependent key diversification improves empirical resistance to statistical and structural analysis, formal analysis under adaptive chosen-plaintext attacks remains an open research direction.

9.4.1 Key regeneration during decryption

During decryption, the receiver requires the diversification value S(P) prior to plaintext recovery. In the implemented system, the 128-bit diversification value is transmitted alongside the ciphertext as a header field of the MQTT payload. Because the effective round keys are Ki′=Ki⊕SKi and the master key components K_*i* remain secret, disclosure of S(P) does not reveal the effective keys; by the bijectivity of XOR, the conditional entropy of K′ given S(P) remains 128 bits. However, transmitting S(P) means the adversary knows the exact XOR offset applied to the master key for each block. The security of each block therefore reduces to that of classical TEA under a key offset known to the adversary, and the formal boundaries established in Sections 4.4.2–4.4.5 must be interpreted under this disclosure. The transmission of S(P) also increases per-block communication overhead by 16 bytes, which is accounted for in the payload sizes reported in Section 8.

A further consequence of transmitting S(P) must be stated explicitly. Because S(P) is a deterministic, unkeyed function of the plaintext, it acts as a plaintext fingerprint: for payloads drawn from a small alphabet (e.g., a 1-byte class label with at most 256 candidate values), a passive adversary can precompute the SHA-256 digest of every candidate payload and match it against the transmitted diversification value, thereby recovering the plaintext directly without attacking the cipher or the master key. This dictionary attack is strictly stronger than the equality-class leakage described in Section 4.4.6. Consequently, in the transmitted-diversifier mode of operation, the nonce-based variant of Section 4.4.6—transmitting S(nonce∥P) computed over a per-message random or counter-based nonce prepended to the plaintext—is required, not optional, whenever the payload space is small or its distribution is sensitive. With a fresh nonce, the transmitted value no longer identifies the payload, at the cost of additionally transmitting the nonce.

From an adversarial perspective, under known-plaintext or chosen-plaintext attack models, an attacker may compute the hash value H(P) for selected plaintext inputs. However, the effective round keys are computed as given in Equation 27

Ki′=Ki⊕SKi(27)

where SK_*i* are derived from H(P) and K_*i* represent the secret master key components. Although the hash output is known under chosen-plaintext conditions, the master key remains unknown. Since XOR is a bijective transformation over fixed-length bit strings, the mapping Ki′=Ki⊕SKi preserves the full 128-bit entropy of the master key and does not reduce brute-force search complexity. Consequently, knowledge of H(P) does not provide a feasible pathway to recover K.

Furthermore, the derived subkeys are ephemeral and internal to the encryption routine. The construction does not expose an oracle that allows adversaries to query encryptions under externally controlled related keys. Classical related-key attack models typically assume oracle access to encryptions under multiple correlated secret keys Kelsey et al. (1997). In the proposed design, the master key remains fixed and secret, while diversification occurs internally on a per-block basis without external key manipulation capability. This is, however, a deployment assumption about the adversary's access model rather than a structural property of the cipher: as formally established in Section 4.4.2 (Proposition 1), the plaintext-dependent diversification preserves XOR relations between related master keys and therefore does not remove the related-key structure of the underlying TEA. Accordingly, in deployments where correlated master keys could arise (for example, through flawed key provisioning or key-update procedures), the related-key characteristics of classical TEA apply unchanged, and no related-key resistance beyond that of classical TEA is claimed.

The plaintext-dependent diversification mechanism decreases pattern predictability in encryption scenarios involving repeated encryption of similar sensor outputs or TinyML inference metadata. In IoT deployments where data distributions may exhibit temporal or spatial correlation, static key schedules can lead to observable ciphertext regularities (Wheeler and Needham, 1995). The proposed scheme mitigates such risks by ensuring that each plaintext block generates a unique internal key transformation, thereby strengthening diffusion behavior across repeated encryption sessions.

It is nevertheless important to acknowledge analytical boundaries. While the hash function prevents direct plaintext leakage and empirical evaluations demonstrate improved avalanche behavior and entropy characteristics, the present work does not provide formal reduction-based security proofs under advanced adversarial models such as adaptive chosen-ciphertext or extended related-key frameworks. The security guarantees are therefore interpreted within the scope of empirical cryptanalytic evaluation and standard cryptographic hash assumptions rather than formal provable security models.

Overall, the plaintext-dependent key scheduling strategy in Enhanced TEA functions as a lightweight pseudo-random key diversification mechanism that strengthens empirical cryptographic behavior while maintaining computational efficiency suitable for resource-constrained IoT environments.

9.5 Formal security discussion and limitations

While empirical cryptanalytic evaluations demonstrate improved statistical security characteristics, it is essential to interpret these findings within formal cryptographic assurance boundaries.

The Enhanced TEA algorithm improves empirical diffusion characteristics through plaintext-dependent dynamic key scheduling; however, it is important to formally clarify the scope and boundaries of the security guarantees provided by the proposed scheme.

The SHA-256-based subkey generation mechanism increases non-linearity and reduces structural predictability associated with static round key schedules present in classical TEA variants. The computational complexity of recovering encryption keys remains bounded by the 128-bit symmetric key space, assuming ideal hash function behavior. Under the defined adversary model, the scheme demonstrates improved empirical robustness against known-plain text and chosen-plain text attacks through increased avalanche characteristics and entropy distribution.

Nevertheless, Enhanced TEA does not currently provide formal provable security guarantees equivalent to standardized authenticated encryption schemes. The plaintext-dependent key scheduling mechanism may introduce theoretical analytical surfaces that require deeper formal cryptanalysis under related-key and adaptive chosen-ciphertext attack models. Additionally, the scheme does not incorporate intrinsic message authentication or integrity verification.

The security evaluation presented in this work therefore emphasizes empirical cryptographic strength, statistical diffusion properties, and resistance to practical cryptanalytic attacks under resource-constrained deployment assumptions rather than formal cryptographic proofs. Accordingly, formal security reductions and extended adversarial models are beyond the analytical scope of the present study.

9.6 Side-channel security considerations

In addition to classical cryptanalytic attacks, practical IoT deployments must also consider side-channel attacks, which exploit information leaked through physical or microarchitectural characteristics such as execution time, power consumption, or memory access patterns. These attacks are particularly relevant for edge devices that operate in exposed or unattended environments, as commonly encountered in smart city infrastructures.

The Enhanced TEA algorithm employs a dynamic key scheduling mechanism that is based on plaintext-dependent hashing, thereby reducing the occurrence of static and repetitive keys during encryption rounds. This variability may increase the difficulty of performing certain types of side-channel analysis, like simple power analysis or correlation-based attacks, where attackers rely on the presence of stable intermediate values over many executions. Enhanced TEA, by varying the round subkeys, increases the uncertainty in the intermediate calculations, which in turn may reduce the effectiveness of statistical leakage exploitation.

The existing solution is reliant on software and functions at a high-level language level, which naturally limits its strength to very advanced side-channel attacks, such as differential power analysis and cache leaking. Even though the design of the algorithm lowers the probability of some types of leakage, it still requires protection measures at the level of hardware implementation, such as constant-time execution, controlled memory access patterns, and usage of hardware isolation, to completely guard against side-channel attacks.

It's worth mentioning that this work mainly targets improvement of cryptographic strength and lightweight performance for constrained IoT systems, instead of hardening side-channel resistance. In real-world scenarios, Enhanced TEA could be integrated with the usual preventive measures such as execution randomization, noise injection, or secure hardware enclaves to minimize the side-channel exposure even more.

A comprehensive assessment of physical attack resistance would require side-channel-specific implementations and dedicated power and timing analysis frameworks, which are outside the experimental scope of this study.

10 Trade-off analysis: security vs. latency

In resource-constrained IoT and edge computing environments, cryptographic mechanisms must balance security strength against execution latency and computational overhead. The combination of stronger diffusion and higher entropy security features makes the system more resistant to cryptanalytic attacks. However, these improvements lead to extra processing delays, which hinder real-time inference and decision-making processes at the edge.

Table 8 presents a consolidated summary of the Raspberry Pi 4 system-level performance and security characteristics of the evaluated lightweight cryptographic algorithms under equivalent payload conditions. The execution time, runtime memory utilization, and CPU utilization values correspond to the Raspberry Pi 4 implementation of the complete TinyML-enabled MQTT framework, whereas the avalanche effect and ciphertext entropy values reported for Ascon-128 are adopted from standardized NIST Lightweight Cryptography reference implementations and the remaining values are obtained from direct experimental measurements. The original TEA attains the lowest execution time and computational overhead owing to its static key structure, although it exhibits comparatively lower avalanche effect and ciphertext entropy. XTEA and XXTEA improve certain security characteristics but incur higher computational and memory requirements with corresponding increases in execution time. Ascon-128, a standardized AEAD scheme selected through the NIST Lightweight Cryptography process, provides combined confidentiality and authentication with strong provable security guarantees (Dobraunig et al., 2021). As expected, Ascon-128 demonstrates superior entropy characteristics (approaching the theoretical maximum of 8 bits per byte) and a higher avalanche effect due to its permutation-based sponge construction and authenticated encryption design.

Within the Raspberry Pi 4 implementation of the complete TinyML-enabled MQTT framework, the measured execution time of the proposed Enhanced TEA for a 64-byte payload was lower than that of the evaluated Ascon-128 implementation under the adopted software environment and experimental configuration. Enhanced TEA also exhibited lower CPU utilization than the evaluated Ascon-128 implementation under the same conditions. However, these results should be interpreted as implementation-level observations rather than intrinsic algorithmic performance comparisons, since the measured execution time is influenced by the software implementation, runtime environment, interpreter overhead, and platform-specific optimizations. The proposed Enhanced TEA incurs additional runtime memory overhead compared with the evaluated Ascon-128 implementation because of the SHA-256-based dynamic key diversification mechanism. This additional memory requirement represents a practical trade-off for the improved diffusion characteristics achieved by the proposed framework.

The Enhanced TEA system demonstrates improved energy efficiency owing to its reduced execution time and lower overall computational overhead compared with the other evaluated cryptographic schemes. The energy consumption analysis presented in Section 7.4 is based on experimentally measured average operating power together with the measured execution time of each cryptographic algorithm. The total energy consumed during encryption is computed using the measured operating power and execution time, providing a practical assessment of the energy requirements across the evaluated embedded platforms. These results indicate that the proposed Enhanced TEA framework is well suited for energy-constrained TinyML-enabled edge and IoT applications while providing improved security characteristics over the classical TEA variants.

Algorithmic complexity differences further explain these performance characteristics. Enhanced TEA relies on ARX (Addition-Rotation-XOR) operations, which are computationally lightweight and efficiently supported by general-purpose microcontroller instruction sets. In contrast, Ascon-128 employs permutation-based sponge constructions involving nonlinear substitution layers, linear diffusion layers, and multiple permutation rounds, which increase computational complexity and memory access requirements. While permutation-based AEAD designs provide stronger integrated security services, ARX-based constructions often demonstrate superior performance predictability and lower implementation overhead in ultra-constrained embedded environments.

It is important to emphasize that this comparison does not position Enhanced TEA as a replacement for standardized AEAD schemes in high-assurance security environments. Rather, the results demonstrate that confidentiality-focused lightweight encryption can provide improved diffusion characteristics over legacy TEA variants while offering substantially lower computational overhead than full AEAD implementations in certain resource-constrained IoT deployments.

To further illustrate the deployment-oriented trade-off between computational efficiency and integrated security strength, Figure 10 presents a conceptual visualization of TinyML deployment suitability across evaluated lightweight encryption algorithms.

As shown in Figure 10, Enhanced TEA occupies a balanced operational region providing improved security diffusion compared to classical TEA variants while maintaining practical computational efficiency within the adopted implementation environment than permutation-based AEAD constructions such as Ascon-128.

The experimental results presented from Sections 7.1 to Section 7.3 demonstrate that the Enhanced TEA scheme improves security characteristics through its two security features which include an increased avalanche effect and high entropy generation approaching the theoretical limit, while its encryption and decryption processes take only a slight additional time to complete. Cryptographic operations that safeguard small inference metadata instead of protecting extensive sensor data streams maintain their overhead within acceptable limits for TinyML inference workflows.

Within the adopted Raspberry Pi 4 software implementation, the proposed Enhanced TEA exhibited lower execution time and CPU utilization than the evaluated Ascon-128 implementation. This observation reflects the computational characteristics of the respective implementations under the adopted experimental configuration. Furthermore, the two schemes address different security objectives: Enhanced TEA provides confidentiality only, whereas Ascon-128 additionally provides integrity and authentication through authenticated encryption (AEAD). Consequently, the comparison should be interpreted as an engineering trade-off between computational efficiency and integrated security functionality rather than as evidence of algorithmic superiority.

The results demonstrate that the proposed scheme demonstrates an empirically effective security mechanism which maintains operational efficiency for edge-based TinyML systems. The observed trade-offs support the suitability of Enhanced TEA for scenarios requiring lightweight protection of inference-related data under strict performance constraints.

Figure 11 presents a five-axis radar comparison of TEA, XTEA, XXTEA, Ascon-128, and the proposed Enhanced TEA across normalized performance and security metrics, including speed, memory usage, CPU utilization, avalanche effect, and entropy, where higher values indicate better efficiency or stronger security. The classical TEA system provides high-speed performance with low resource requirements but its diffusion and entropy capabilities remain weak. The two systems XTEA and XXTEA deliver additional security features but they require moderate resource expenses. Ascon-128 demonstrates strong avalanche behavior and near-ideal entropy consistent with its standardized AEAD design, at the cost of increased computational and memory requirements. The proposed Enhanced TEA system maintains its security performance through improved empirical security characteristics than traditional TEA systems while its operational capabilities suit TinyML edge deployments through low latency and resource requirements. For clarity, the Speed metric shown in Figure 11 is defined as the inverse of encryption time and is normalized such that higher values indicate faster execution.

The proposed Enhanced TEA occupies a balanced design point by improving the empirical security characteristics of the classical TEA family while maintaining practical computational requirements, runtime memory utilization, CPU utilization, and energy consumption suitable for TinyML-enabled IoT edge devices. The comparative evaluation indicates that no individual lightweight cryptographic algorithm simultaneously achieves the best performance across all evaluated security and computational metrics. Classical TEA provides the lowest computational overhead and fastest execution, whereas Ascon-128 offers stronger integrated security through authenticated encryption at the expense of higher computational complexity and resource requirements. Although certain algorithms outperform Enhanced TEA with respect to individual metrics such as execution time, computational cost, or integrated security functionality, none simultaneously provides the same balance between enhanced confidentiality, computational efficiency, and deployment practicality for the targeted TinyML inference communication scenario. Consequently, the proposed framework should be interpreted as an engineering trade-off that prioritizes improved confidentiality together with practical deployment efficiency rather than absolute superiority across every evaluation metric.

The energy required to secure 1,000 MQTT message transmissions is illustrated in Figure 12. The reported energy values were computed using the experimentally measured average operating power and execution time, following the methodology described in Section 5.4. Encrypting raw sensor data requires considerably more energy because larger payloads increase the computational workload and require repeated encryption operations. In contrast, the proposed TinyML inference encryption approach secures only the compact inference outputs generated at the edge, thereby substantially reducing the total computational effort and communication overhead. Consequently, the cumulative energy consumption increases at a much lower rate than that of raw data encryption. The widening gap between the two curves demonstrates the energy efficiency benefits of encrypting compact TinyML inference results, making the proposed framework well suited for battery-powered and energy-constrained IoT deployments.

The security-latency trade-off can be quantified through two measures which assess the security performance of a system: its processing time and its energy consumption. The proposed Enhanced TEA scheme uses TEA as its foundation but adds 0.023 ms encryption delay to the system which increases avalanche effect by 5.69%. The enhancement delivers 0.004 ms (4 microseconds) additional processing time for every 1% increase in avalanche effect according to the formula in Equation 28. The additional energy consumption incurred by Enhanced TEA is approximately 0.3 mJ per encryption which results in an energy cost of about 0.053 mJ per 1% avalanche gain according to the calculation in Equation 29.

These quantified costs remain relatively small in the context of TinyML inference pipelines, where inference execution and communication dominate overall system latency and energy consumption.

ΔT%A=TEnhanced TEA-TBaselineAEnhanced TEA-ABaseline(28)

ΔE%A=EEnhanced TEA-EBaselineAEnhanced TEA-ABaseline(29)

where:

• T is the encryption latency (ms) for a 64-byte payload;
• E is the energy consumption per encryption operation (mJ);
• A denotes the avalanche effect (%);
• the subscripts Baseline and Enhanced TEA indicate the reference algorithm and the proposed scheme, respectively.

The experimental tests used a Raspberry Pi edge platform for their validation but the proposed system relies on its lightweight arithmetic and bitwise operations which it derives from the TEA framework. The software design needs additional testing through dedicated benchmarks on Cortex-M devices to verify its compatibility with low-power microcontroller systems.

10.1 Comparative analysis with AEAD standards

To evaluate the performance of Enhanced TEA against modern lightweight standards, Ascon-128–a standardized AEAD scheme selected by the NIST Lightweight Cryptography (LWC) process–was utilized as a reference point. It is critical to acknowledge that Ascon-128 provides integrated confidentiality, integrity, and authentication through a permutation-based sponge construction. In contrast, Enhanced TEA is designed as a confidentiality-focused block cipher optimized for ultra-constrained environments.

The performance gap observed between these two schemes is primarily driven by their differing security goals:

• Computational efficiency: enhanced TEA relies on ARX (Addition-Rotation-XOR) operations, which are natively supported by most general-purpose microcontroller instruction sets. Ascon-128 requires additional computational cycles for authentication tag generation and associated data processing.
• Resource constraints: the proposed Enhanced TEA requires additional runtime memory compared with the evaluated Ascon-128 implementation because of the SHA-256-based dynamic key diversification stage. Nevertheless, the measured peak runtime memory utilization of approximately 15.7 KB remains within the practical resource limits of representative TinyML-enabled edge platforms evaluated in this study.
• Modular security strategy: in many IoT architectures, integrity and authentication are provided by other layers of the protocol stack. In such scenarios, Enhanced TEA serves as a high-performance confidentiality module that minimizes latency-sensitive TinyML inference overhead.

11 System-level limitations and deployment scope

The proposed architectural design at the system level separates intelligence functions from security functions. The TinyML models perform local inference at the edge, meanwhile the Enhanced TEA encrypts the outputs before they are sent over via the communication channel. The system protects only the essential decision-making data because it does not need to encrypt complete raw sensor information, which results in lower power consumption and decreased network traffic. The solution operates within the technical limitations that large smart city implementations need because these systems require both efficient bandwidth usage and long-lasting device performance.

The proposed encryption framework provides an application-driven lightweight confidentiality solution that protects sensor-based IoT and TinyML edge environments. The research evaluates system performance through empirical testing while assessing its practical deployment capabilities instead of establishing cryptographic security through established theoretical security models which include IND-CPA and IND-CCA security definitions.

The dynamic key scheduling mechanism uses plaintext-dependent hashing to achieve better diffusion characteristics and improved randomization behavior. The design shows better protection against classical differential analysis and statistical attacks but introduces new theoretical analysis requirements that need further investigation. The proposed scheme therefore is not intended as a replacement for standardized authenticated encryption algorithms such as NIST Lightweight Cryptography finalists.

The proposed framework delivers confidentiality protection through its existing system which does not require authentication or integrity verification mechanisms. The upper-layer communication protocols together with secure session management mechanisms provide message integrity and replay protection in actual sensor deployments.

The study evaluates energy consumption using experimentally measured average operating power together with the measured execution time of each cryptographic algorithm. The average operating power was obtained through direct current measurements using a calibrated digital multimeter, while the corresponding energy consumption was computed using the measured execution time. Although the adopted methodology provides reliable average energy measurements for comparative evaluation, it does not capture fine-grained transient power characteristics during individual cryptographic operations. Such characterization requires high-precision instrumentation, including source measure units or high-speed power analyzers, and is outside the measurement scope of the present study.

The proposed framework delivers an operational encryption solution which maintains low resource requirements to protect sensor-generated inference metadata. The design choice exists to improve empirical diffusion which does not demonstrate formal cryptographic security through proven methods.

12 Threats to validity

While the experimental results demonstrate the effectiveness of Enhanced TEA, several factors may influence the generalization of these findings to all IoT environments:

• Platform heterogeneity: the complete TinyML-enabled MQTT framework was implemented and evaluated on a Raspberry Pi 4 to validate end-to-end system functionality, including cryptographic processing, TinyML inference, MQTT communication, and resource utilization. To complement this system-level evaluation, additional benchmarking was performed on representative embedded platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, and, Raspberry Pi Pico. Although these platforms represent a broad range of ARM Cortex-M, Xtensa, and RISC-V embedded architectures, they do not encompass all classes of ultra-low-power IoT devices. Consequently, the reported results should not be generalized to all ultra-low-power IoT architectures or application-specific deployment scenarios.
• Energy consumption measurement: the reported energy consumption is derived from experimentally measured average operating power and the measured execution time of each cryptographic algorithm. Average operating power was obtained through direct current measurements using a calibrated digital multimeter under continuous cryptographic execution. While this methodology provides reliable average energy measurements for comparative evaluation, it does not capture fine-grained transient power variations that may occur during individual cryptographic operations, such as the SHA-256-based key diversification stage. Consequently, the reported energy values characterize average operational energy and should not be interpreted as fine-grained transient power profiles of individual cryptographic stages.
• Network environment: the MQTT communication tests were performed under controlled IEEE 802.11n Wi-Fi conditions to isolate encryption-induced overhead. Real-world IoT deployments often utilize LPWAN, Zigbee, or cellular networks, which have distinct packet loss rates and latency profiles that could impact the reported throughput loss.
• Adversarial scope: the security analysis focused on empirical metrics such as avalanche effect and entropy. While these indicate strong diffusion and randomness, they do not constitute formal reduction-based cryptographic security proofs under advanced models, such as adaptive chosen-ciphertext or extended related-key frameworks.

13 Conclusion

This work presented a lightweight confidentiality-focused encryption framework designed for TinyML-enabled IoT edge communication environments. By introducing a plaintext-dependent dynamic key diversification mechanism within the TEA structure, the proposed Enhanced TEA improves empirical diffusion and ciphertext randomness while preserving the computational efficiency required for resource-constrained devices. Unlike conventional studies that focus solely on algorithmic optimization, this work integrates the encryption mechanism into a system-level TinyML-driven communication architecture, demonstrating its practical applicability in real-world edge scenarios. In addition, this work demonstrates meaningful security improvements in edge-based IoT systems can be achieved through application driven integration of lightweight cryptographic mechanisms, rather than solely through the development of new cryptographic primitives.

The experimental study conducted on an edge computing platform proves that the suggested method achieves a successful balance between security improvements and system performance. The results demonstrate enhanced avalanche properties and almost perfect entropy values while the system operates with minimal processing requirements and predictable execution duration and less than 5% throughput loss during MQTT-based transmission. The results show that lightweight application-layer confidentiality methods successfully enable secure inference-driven communication without requiring the processing costs of transport-layer or complete encrypted authentication methods. The experimental workflow is deterministic and does not rely on external datasets, further simplifying reproducibility.

The proposed framework functions as a confidentiality solution which fails to deliver data integrity and authentication security. The system needs to implement lightweight message authentication and protocol security frameworks to provide complete security protection in actual use. The existing evaluation tests edge-class systems which need additional testing on microcontroller devices to assess performance in extremely limited conditions.

While post-quantum cryptographic approaches such as lattice-based encryption (LWE) and partially homomorphic encryption (PHE) are increasingly feasible on modern edge platforms, they introduce significantly higher computational and memory overhead compared to lightweight symmetric encryption. The proposed framework targets latency-sensitive TinyML inference communication, where such overhead may not be practical. Therefore, symmetric lightweight encryption remains a suitable design choice for the considered application domain.

The proposed approach creates a solution which connects lightweight cryptographic design with the system deployment needs of modern TinyML IoT ecosystems. This work demonstrates that application-driven lightweight cryptographic design can effectively bridge the gap between theoretical security mechanisms and practical TinyML-enabled IoT deployments.

14 Limitations

While the proposed Enhanced TEA framework demonstrates promising performance and applicability for TinyML-enabled IoT communication, several limitations must be acknowledged.

First, the proposed scheme functions as an encryption system which protects confidential information but lacks built-in mechanisms to verify data integrity and user authentication. The system does not function as a complete substitute for authenticated encryption (AEAD) systems because it lacks essential components. The system requires pairing with lightweight message authentication codes (MACs) or security protocols like MQTT authentication or OSCORE to achieve complete end-to-end protection.

Second, the cryptographic design develops its cryptographic system because it needs to meet specific application requirements but it fails to provide any formal security proofs. The plaintext-dependent key diversification system improves its ability to spread and create random output but researchers have not yet tested it using established security frameworks or proof-based security methods. The research field needs to develop a complete theoretical framework which can defend against sophisticated cryptanalysis techniques.

Third, the complete experimental validation of the proposed framework was performed on a Raspberry Pi 4 edge platform to evaluate the end-to-end TinyML-enabled MQTT communication system, including cryptographic processing, TinyML inference, secure communication, and system-level resource utilization. To complement this system-level validation, additional algorithm-level benchmarking was conducted on representative embedded platforms, including the ESP32-S3 DevKit, Arduino Nano 33 BLE Rev2, and Raspberry Pi Pico. These results demonstrate the practical feasibility of the proposed Enhanced TEA across representative resource-constrained embedded architectures. Nevertheless, the evaluated platforms do not represent the full spectrum of commercially available ultra-low-power IoT devices. Therefore, the reported results should not be generalized to all commercial microcontroller families, TinyML workloads, or application-specific deployment scenarios.

Fourth, the current evaluation process assesses performance through execution time and memory usage and CPU utilization and communication overhead metrics and security indicators that include avalanche effect and entropy. The assessment has not yet tested system performance against advanced attack methods which include side-channel attacks that use power analysis and timing attacks and fault injection attacks.

Finally, the framework assumes secure key storage and management on edge devices. In real-world deployments, key provisioning, rotation, and protection mechanisms introduce additional complexity and potential vulnerabilities that are not explicitly addressed in this study.

Generative AI statement

The author(s) declared that Generative AI was not used in the creation of this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher's note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Ruben Ruiz-Gonzalez, University of Burgos, Spain

Reviewed by: Sergio Trilles Oliver, University of Jaume I, Spain

Eslam El-Mokadem, Higher Technological Institute, Egypt