A Hybrid Zero-Trust and Post-Quantum Cryptography Framework for Fog-Enabled Smart Cities’ Public Transportation Safety and Security

Intelligent Transportation Systems (ITS) leverage fog computing to process high-frequency vehicular data locally, but securing these continuous data streams against future quantum computers remains a critical challenge. A systematic review using the Context–Intervention–Mechanism–Outcome (CIMO) framework shows that existing architectures address Zero-Trust principles, fog computing, and Post-Quantum Cryptography (PQC) independently, leaving a significant convergence gap. To bridge this gap, this paper proposes a Hybrid Post-Quantum Zero-Trust Architecture (HPQC-ZTA) for public transportation. It combines the NIST-standardized ML-KEM-768 (CRYSTALS-Kyber) and ML-DSA-65 (CRYSTALS-Dilithium) with classical X25519 and ECDSA-P256 in hybrid mode, and it verifies message signatures in parallel micro-batches at the fog layer. Fog nodes act as Zero-Trust Policy Enforcement Points: they compute a dynamic trust score from firmware integrity, location, and speed, issue five-minute Zero-Trust Access Tokens, and enforce pseudonym rotation every 10 min with random jitter to prevent tracking. The architecture was implemented as a working prototype and evaluated in a discrete-event simulation of a 5G transit hub with up to 5000 buses. Batch verification is 2.6 times faster than serial verification, and the design delivers every message with a 95th-percentile end-to-end latency of about 25 ms for up to 2000 buses per hub, four times the capacity of a naive PQC deployment. It also passed all executed Shor and Grover resilience tests, including forward secrecy against harvest-now-decrypt-later attacks, showing that quantum-resilient Zero-Trust security is practical for large-scale public transportation.