The digitalization of industrial operations under Industry 4.0 and beyond has increased reliance on wide-area connectivity across distributed industrial environments. While improving efficiency, this connectivity expands the external attack surface. Internet-wide scanning and reconnaissance tools (e.g., Shodan and Nmap) can identify exposed industrial assets and reveal device information that facilitates vulnerability-driven targeting. Consequently, robust network architectures are required to reduce device exposure and discoverability while providing secure, scalable, and resilient communication.

This thesis addresses these challenges through architectural design and optimization for secure and scalable Virtual Private LAN Service (VPLS). It first analyzes industrial device scanners and the security risks associated with active scanning, motivating the adoption of Host Identity Protocol (HIP)-based VPLS (HIPLS) for secure industrial communication. However, traditional HIPLS suffers from scalability limitations as encrypted tunnels, forwarding table entries, and control-plane overhead grow rapidly with the number of participating sites.

To overcome these limitations, this thesis develops a sequence of architectural and optimization solutions for secure VPLS. First, it replaces the full-mesh design with relay-based communication and formulates the Relay Placement Problem (RPP) to determine cost-efficient relay configurations while maintaining connectivity among all participating sites. For this NP-hard problem, a polynomial-time approximation algorithm with a provable performance guarantee is developed. The relay architecture is subsequently extended through Tunnel Relay Nodes (TRNs) and dynamic tunnel scheduling, for which a Lagrangian-relaxation-based algorithm efficiently obtains high-quality feasible solutions under connectivity and capacity constraints. The thesis also addresses the scalability of cryptographic key management by formulating the Key Distribution Center Placement (KDCP) problem and proposing an approximation framework with a provable solution-quality guarantee for distributed KDC deployment. Finally, the underlying trust model of secure VPLS is reconsidered through a Zero Trust architecture based on a multiparty extension of the HIP Base Exchange (HIP-MBEX), reducing customer dependence on trusted provider infrastructure. Evaluations using realistic and real-world network topologies demonstrate considerable reductions in tunnel count, forwarding state, and control-plane signaling, while maintaining bounded path stretch and low latency overhead in the evaluated scenarios.

The proposed algorithmic frameworks for relay and KDCP provide theoretical guarantees on solution quality, ensuring a provably cost-effective VPLS deployment. These contributions offer a dual advantage: they enable service providers to minimize Capital and Operational Expenditures (CAPEX/OPEX) through near-optimal resource utilization, while simultaneously providing customers with a secure, scalable solution for multi-site connectivity. Consequently, this thesis establishes a practical and robust foundation for next-generation industrial networks.