Secure QR Code Attendance over RPL-Based Low-Power IoT Networks: Security Analysis and Scalability Evaluation in Contiki-NG/Cooja

QR code attendance offers a low-cost way to digitise presence records, but a visible code by itself does not show that an attendance transaction is fresh, belongs to an authorised participant, or has been delivered reliably over a constrained network. This paper examines a post-scan QR attendance transaction in a Routing Protocol for Low-Power and Lossy Networks (RPL)-based Internet of Things environment using Contiki-NG/Cooja. Unlike attendance studies that mainly strengthen QR freshness or identity checks and RPL studies that mainly examine routing behaviour, the present work evaluates network delivery, application acceptance, and exact replay rejection along the same transaction path. The baseline combines token validation, attendance-rule checking, and server-side duplicate state with IEEE 802.15.4, IPv6 over Low-Power Wireless Personal Area Networks (6LoWPAN), RPL Lite, Carrier-Sense Multiple Access (CSMA), and the User Datagram Protocol (UDP). The security claim is deliberately limited to the evidence available from the recorded experiments: exact replayed attendance transactions are evaluated, whereas confidentiality, cryptographic origin authentication, routing-control protection, and physical compromise are not claimed as implemented defences. Three recorded network sizes (5, 20, and 50 motes) are analysed using packet delivery ratio (PDR), packet loss, average end-to-end delay, attendance success rate (ASR), and replay rejection. At 50 motes, PDR is 91.7%, average delay is 37 ms, and ASR is 89.4%. All 38 recorded exact replay attempts are rejected; the corresponding two-sided exact 95% binomial confidence interval is 90.75–100%, so the observed result is not presented as universal replay immunity. The PDR–ASR gap remains small across the recorded scenarios, but the available aggregate logs do not permit the gap to be assigned uniquely to application rejection, queueing, retransmission, or radio effects. The study therefore provides a bounded application-security and scalability result, identifies the limits of the present evidence, and defines the additional repeated-run, multi-hop, energy, cryptographic, and hardware measurements required for deployment-oriented validation.