Post-Quantum Cryptography for IoT-Enabled Chemical Process Plants: A Security Architecture for Safety-Critical Industrial Control Systems
Ruchit Rathi
This item contains a research article proposing a post-quantum cryptography (PQC) security architecture for IoT-enabled chemical process plants, where sensor connectivity and cloud analytics introduce safety-critical cyber-physical risks. The paper first surveys PQC and quantum-threat literature for SCADA/OT and industrial IoT systems, then applies Mosca’s Theorem to argue that long-lived chemical infrastructures are already in the “harvest now, decrypt later” risk window.A structured threat model is built using STRIDE and MITRE ATT&CK for ICS, distinguishing safety-critical consequences (e.g., false sensor readings and malicious actuator commands) from conventional confidentiality breaches. Based on this model, the paper proposes an ESP32-based three-tier architecture (field sensors, edge microcontrollers, and cloud analytics) that integrates NIST-standardized lattice-based algorithms: CRYSTALS-Kyber (ML-KEM) for session key establishment, CRYSTALS-Dilithium (ML-DSA) for data/command authentication, and SPHINCS+ or Dilithium for firmware-signing on resource-constrained devices.The design is explicitly mapped to IEC 62443 Foundational Requirements (FR1 Identification & Authentication, FR3 System Integrity, FR4 Data Confidentiality) and accompanied by a feasibility analysis that uses microcontroller-level benchmarks of Kyber and Dilithium on ESP32-class hardware, highlighting computation, memory, and communication trade-offs versus classical RSA/ECC. The paper also outlines a hardware-free validation methodology using liboqs (Open Quantum Safe) with TLS 1.3, device emulation, and Linux network emulation to measure protocol overhead under realistic industrial network conditions.Finally, it discusses migration challenges for brownfield plants, the evolving standards and regulatory landscape (NIST IR 8547, IEC 62443, CISA/NSA guidance), and future work on empirical benchmarking and multi-plant threat-model generalization, aiming to provide a roadmap for designing quantum-safe IoT architectures in safety-critical chemical production.
•Jul 20, 2026•0 citations