Cyber-physical systems (CPS) are considered a crucial part for providing connectivity in industrial environments. However, the recent increase in connectivity has led to an extended attack vector. Therefore, it is important that CPS are secured against current and - due to their long life span - also against future threats, such as quantum computers. The security of present communication can be broken once a sufficiently powerful quantum computer is available. To protect against this attack vector, applications and protocols should start utilizing quantum-resistant primitives. One approach that maintains common security guarantees and protects against quantum computer attacks is to use hybrid constructions: a combination of classically secure and quantum-resistant schemes. In this work, we propose a hybrid key exchange mechanism for the industrial communication protocol Open Platform Communications Unified Architecture (OPC UA). We describe four distinct instantiations based on selected quantum-resistant key encapsulation mechanisms (KEMs), namely NewHope, NTRU, CRYSTALS-Kyber, and Saber. We implement our resulting quantum-resistant modifications of OPC UA on two different ARM based platforms and present detailed performance footprints. Finally, we show the feasibility of employing hybrid quantum-resistant key exchange within OPC UA preserving industrial communication against future threats.
Cyber-physical systems (CPS) are considered a crucial part for providing connectivity in industrial environments. However, the recent increase in connectivity has led to an extended attack vector. Therefore, it is important that CPS are secured against current and - due to their long life span - also against future threats, such as quantum computers. The security of present communication can be broken once a sufficiently powerful quantum computer is available. To protect against this attack vector, applications and protocols should start utilizing quantum-resistant primitives. One approach that maintains common security guarantees and protects against quantum computer attacks is to use hybrid constructions: a combination of classically secure and quantum-resistant schemes. In this work, we propose a hybrid key exchange mechanism for the industrial communication protocol Open Platform Communications Unified Architecture (OPC UA). We describe four distinct instantiations based on selected quantum-resistant key encapsulation mechanisms (KEMs), namely NewHope, NTRU, CRYSTALS-Kyber, and Saber. We implement our resulting quantum-resistant modifications of OPC UA on two different ARM based platforms and present detailed performance footprints. Finally, we show the feasibility of employing hybrid quantum-resistant key exchange within OPC UA preserving industrial communication against future threats.
The threat of a cryptographically relevant quantum computer contributes to an increasing interest in the field of post-quantum cryptography (PQC). Compared to existing research efforts regarding the integration of PQC into the Transport Layer Security (TLS) protocol, industrial communication protocols have so far been neglected. Since industrial cyber-physical systems (CPS) are typically deployed for decades, protection against such long-term threats is needed. In this work, we propose two novel solutions for the integration of post-quantum (PQ) primitives (digital signatures and key establishment) into the industrial protocol Open Platform Communications Unified Architecture (OPC UA): a hybrid solution combining conventional cryptography with PQC and a solution solely based on PQC. Both approaches provide mutual authentication between client and server and are realized with certificates fully compliant to the X.509 standard. We implement the two solutions and measure and evaluate their performance across three different security levels. All selected algorithms (Kyber, Dilithium, and Falcon) are candidates for standardization by the National Institute of Standards and Technology (NIST). We show that Falcon is a suitable option – especially – when using floating-point hardware provided by our ARM-based evaluation platform. Our proposed hybrid solution provides PQ security for early adopters but comes with additional performance and communication requirements. Our solution solely based on PQC shows superior performance across all evaluated security levels in terms of handshake duration compared to conventional OPC UA but comes at the cost of increased handshake sizes. In addition to our performance evaluation, we provide a proof of security in the symbolic model for our two PQC-based variants of OPC UA. For this proof, we use the cryptographic protocol verifier ProVerif and formally verify confidentiality and authentication properties of our quantum-resistant variants.
While the current progress in quantum computing opens new opportunities in a wide range of scientific fields, it poses a serious threat to today?s asymmetric cryptography. New quantum resistant primitives are already available but under active investigation. To avoid the risk of deploying immature schemes we combine them with well-established classical primitives to hybrid schemes, thus hedging our bets. Because quantum resistant primitives have higher resource requirements, the transition to them will affect resource constrained IoT devices in particular. We propose two modifications for the authenticated key establishment process of the industrial machine-to-machine communication protocol OPC UA to make it quantum resistant. Our first variant is based on Kyber for the establishment of shared secrets and uses either Falcon or Dilithium for digital signatures in combination with classical RSA. The second variant is solely based on Kyber in combination with classical RSA. We modify existing opensource software (open62541, mbedTLS) to integrate our two proposed variants and perform various performance measurements
Cyber-physical systems (CPS) are critical components in industrial control, automation, and real-time decision, making, where they must frequently rely on cooperative relaying to be able to communicate reliably and with low latency.Nevertheless, advancements in quantum computing capabilities pose a threat to the cryptographic measures traditionally used in these networks.This paper explores the possibility of combining post-quantum secure protocols with the cooperative relaying architectures of CPS environments.We have run simulations to measure the effectiveness of these security measures by monitoring various parameters such as the ability to resist eavesdropping, the efficiency of secure key distribution, throughput, latency, energy consumption, and channel capacity.Our findings indicate that post-quantum technology can be instrumental in fortifying communication security without compromising the efficacy of key management and spectral utilization.The suggested approach also shows excellent flexibility when subjected to realistic traffic scenarios, thereby allowing data transmission with minimal delay required by time, critical control applications.Although post-quantum schemes introduce moderate additional energy overhead, the improvement in long-term security resilience outweighs the cost.The findings confirm that quantum-resilient cooperative relaying provides robust protection for Industrial IoT, smart grid infrastructures, and autonomous control networks against future quantum-enabled attacks, making it a viable foundation for next-generation secure CPS communication.
Current improvements in quantum computing present a substantial challenge to classical cryptographic systems, which typically rely on problems that can be solved in polynomial time using quantum algorithms. Consequently, post-quantum cryptography (PQC) has emerged as a promising solution to emerging quantum-based cryptographic challenges. The greatest threat is public-key cryptosystems, which are primarily responsible for key exchanges. In PQC, key encapsulation mechanisms (KEMs) are crucial for securing key exchange protocols, particularly in Internet communication, virtual private networks (VPNs), and secure messaging applications. CRYSTALS-Kyber and NTRU are two well-known PQC KEMs offering robust security in the quantum world. However, even when quantum computers are functional, they are not easily accessible. IoT devices will not be able to utilize them directly, so there will still be a requirement to protect IoT devices from quantum attacks. Concerns such as limited computational power, energy efficiency, and memory constraints in devices such as those used in IoTs, embedded systems, and smart cards limit the use of these techniques in constrained environments. These concerns always arise there. To address this issue, this study conducts a broad comparative analysis of Kyber and NTRU, with special focus on their security, performance, and implementation efficiency in such environments (IOT/constrained environments). In addition, a case study was conducted by applying KEMs to a low-power embedded device to analyze their performance in real-world scenarios. These results offer an important comparison for cyber security engineers and cryptographers who are involved in integrating post-quantum cryptography into resource-constrained devices.
Cyber-physical systems (CPSs) based on the Internet of Things (IoT) form the backbone of modern smart infrastructures, including smart cities, healthcare monitoring, industrial automation, and intelligent transportation. However, connecting many resource-limited IoT devices makes them more vulnerable to cyber threats, particularly quantum attacks. This review comprehensively examines quantum-secure communication (QSC) frameworks for IoT-enabled CPS, focusing on Quantum Key Distribution (QKD), post-quantum cryptographic (PQC) algorithms, and hybrid quantum–classical security models suitable for constrained devices. A PRISMA-guided search of the Scopus and Google Scholar database was conducted in January 2026 using three keyword groups related to hybrid security, artificial intelligence, and cyber-physical systems. Based on the evaluation, 6008 publications have been identified between 2001 and 2026. The first-round screening was performed for 4948 articles, after excluding duplicates. During the screening stage, 348 articles were selected for abstract scrutiny, 115 records were excluded due to no direct focus on CPS/IoT applications, 52 studies were excluded because these papers relied on traditional security models, 25 studies were excluded due to insufficient relevance to the review objectives, and 15 additional non-English studies were removed. Following the screening stage, 141 studies were selected for full-text eligibility. Out of those, 86 studies were removed due to a lack of specific evaluation metrics or not being published in a peer-reviewed venue. Furthermore, the publications are classified as QKD-based secure CPS and QSC for industrial IoT, AI-Assisted Secure Communication for CPS Networks, and hybrid PQC-QKD models for CPS/IoT devices. This article investigates recent advancements in secure data transmission, verified protocols, and AI-driven anomaly detection customized to CPS/IoT environments. In addition, operational hurdles, interaction with open innovations, real-time deployment, and secure edge-cloud integration are highlighted. By analyzing recent developments and identifying research gaps, this review provides a structured roadmap for designing secure, scalable, and quantum-safe IoT-based CPS frameworks capable of withstanding next-generation cyber threats. This systematic review was performed and reported according to the PRISMA 2020 guidelines.
Security mechanisms for Operational Technology (OT) protocols like Modbus/TCP Security, DNP3-SAv6 and Profinet Security protect the underlying protocols that govern how industrial automation systems communicate. However, these solutions are dependent on classical cryptography and lack the agility to withstand the emerging threat posed by quantum computing, which breaks or weakens classical cryptography. Furthermore, the increasing sophistication of classical cyberattacks on industrial control systems, as evidenced by the recent Polish power grid incident of December 2025, shows the growing capabilities of adversaries. When considered alongside the anticipated capabilities of quantum computing, this necessitates the development of robust and future-resilient security mechanisms for OT nvironments. In this paper, we present PQOTSec, a protocol-agnostic, post-quantum (PQ) secure overlay that enables mutual authentication and secure key exchange without modifying the existing protocol structure. Our framework employs NIST-standardised ML-DSA for authentication and ML-KEM for key establishment and achieves confidentiality, integrity, availability, and authenticity in PQ settings. We assess the security of our framework using the AVISPA tool and demonstrate its applicability by overlaying it onto Modbus/TCP. In our experiment, the framework shows better performance than Modbus/TCP Security, making it suitable for deployment in OT environments. We finally use PQ-OTSec to mitigate the vulnerabilities exploited in the Polish power grid attack, as well as protect against future quantum threats