Cloud infrastructures moving toward post-quantum cryptography present both opportunities and risks since safe workload interoperability is made more difficult by disparate providers' uneven key management. In this study, a crypto-agile zero-trust access architecture for multi-cloud environments is presented, utilizing software-defined networking (SDN) to coordinate quantum key distribution (QKD) and post-quantum cryptography (PQC) for session security. The architecture incorporates a policy-driven controller that uses programmable data planes for micro-segmentation and continuous verification to dynamically choose ML-KEM or QKD-derived keys for each transaction. The system includes automated failover between PQC and QKD to guarantee resilience, preserving secure connectivity in the event of link failure or resource exhaustion. QKD-PQC failover under adversarial stress, flow-level path enforcement via P4, and TLS 1.3 handshakes with PQC are all demonstrated using a simulation prototype. The results demonstrate that SDN-based orchestration can maintain performance and uphold zero-trust principles, while also highlighting the viability of quantifying PQC overhead in real-time cloud scenarios. This establishes the framework as a workable route to multi-cloud security that is quantum robust.
Cloud infrastructures moving toward post-quantum cryptography present both opportunities and risks since safe workload interoperability is made more difficult by disparate providers' uneven key management. In this study, a crypto-agile zero-trust access architecture for multi-cloud environments is presented, utilizing software-defined networking (SDN) to coordinate quantum key distribution (QKD) and post-quantum cryptography (PQC) for session security. The architecture incorporates a policy-driven controller that uses programmable data planes for micro-segmentation and continuous verification to dynamically choose ML-KEM or QKD-derived keys for each transaction. The system includes automated failover between PQC and QKD to guarantee resilience, preserving secure connectivity in the event of link failure or resource exhaustion. QKD-PQC failover under adversarial stress, flow-level path enforcement via P4, and TLS 1.3 handshakes with PQC are all demonstrated using a simulation prototype. The results demonstrate that SDN-based orchestration can maintain performance and uphold zero-trust principles, while also highlighting the viability of quantifying PQC overhead in real-time cloud scenarios. This establishes the framework as a workable route to multi-cloud security that is quantum robust.
Quantum key distribution (QKD) offers unconditional security but existing QKD networks remain difficult to scale across heterogeneous infrastructures and administrative domains due to vendor-specific interfaces, trusted-node constraints, and limited interoperability. This work presents a flexible multi-domain and multi-site quantum-secure network architecture integrating vendor-agnostic QKD, SDN orchestration, and cloud-managed trust services. Communication is based on Zero Trust Network Access protocols featuring multi-level authentication mechanisms building upon post-quantum cryptography (PQC) signature and key encapsulation algorithms. The system is deployed on a real-world testbed with domains incorporating QKD nodes from 3 vendors, as well as domains without QKD infrastructure elements. Experimental results show that PQC and SDN overhead remain relatively low even on constrained devices, with the main bottleneck being QKD key retrieval and vendor-specific key streaming limitations. The proposed framework extends quantum-safe key transport beyond native QKD boundaries while preserving flexibility, interoperability, and compatibility with existing infrastructures.
The emergence of quantum computing is a serious threat to traditional cryptographic algorithms, making it critical to transition to post-quantum cryptography (PQC). This work proposes a holistic conceptual and analytical framework for deploying PQC in multi-cloud environments where the complexity of different infrastructure, workloads and key management schemes pose significant security and efficiency problems. The proposed framework for crypto-agility follows a layered approach, with a cryptographic abstraction layer, a policy-based orchestration engine, a centralized hardware security module (HSM) management plane, and an ongoing monitoring module to facilitate a smooth transition from classical to hybrid and fully quantum-resistant cryptographic systems. He researches identifies and critically analyzes major challenges in deploying PQC technologies in multi-cloud environments, such as inter-cloud interoperability, computational complexity, latency, key management, and regulatory and compliance considerations. The framework tackles these challenges by incorporating hybrid cryptographic protocols that blend classic cryptographic algorithms with NIST-approved PQC algorithms, namely ML-KEM (FIPS 203) and ML-DSA (FIPS 204), to maintain backward compatibility and increase security against quantum-powered adversaries. Moreover, the framework proposes dynamic policy-driven algorithm selection to implement context-sensitive cryptographic enforcement based on sensitivity labels, security threats, and regulatory considerations. An experimental framework is proposed to assess the efficiency and scalability of PQC algorithms deployed in a multi-cloud environment, including metrics such as CPU usage, memory usage, latency and throughput with different workloads. Although this research is conceptual, it draws on previous benchmarking to discuss the securityperformance trade-offs associated with PQC. The results highlight the need for centralized trust anchors, crypto-agility and hybrid deployment models to address risks from cryptographic diversity and ensure the sustainability of security operations. This study advances the research on quantum-safe cloud security by offering a systematic, scalable and policy-oriented framework for PQC deployment. It provides practical guidance for businesses, cloud architects, and security professionals on how to safeguard against quantum vulnerabilities and ensure efficient operations in distributed systems by implementing quantum-safe cryptographic infrastructures.
Conventional cryptographic algorithms that are widely used in Software-Defined Networking (SDN), cloud computing, and edge computing infrastructures are facing a serious challenge because of the fast development of quantum computing. The traditional public-key cryptography like RSA and Elliptic Curve Cryptography (ECC) is believed to be vulnerable to quantum attacks, which will require quantum-resistant security mechanisms to be adopted. The past few years have seen a focus on incorporating Post-Quantum Cryptography (PQC), Quantum Key Distribution (QKD), Artificial Intelligence (AI), blockchain, and Zero Trust Architecture (ZTA) into SDN, with the aim of creating secure, programmable, and intelligent communication infrastructures. The paper summarizes the recent progress in post-quantum secure SDN in cloud and edge computing. The study starts by examining how lattice-based cryptographic algorithms like CRYSTALS-Kyber and CRYSTALS-Dilithium can be integrated in SDN controllers and SDN programmable networks. Then, hybrid QKD-PQC architectures for quantum-safe communication are discussed, followed by intelligent SDN architectures based on AI-powered threat detection, blockchain-based trust management, and adaptive cryptographic orchestration. Moreover, the paper reviews recent advances, summarizes research challenges, and points towards scalable, autonomous, and quantum-resistant networking infrastructures for next-generation cloud, IoT, edge and 6G networks and ecosystem
The emergence of quantum computing poses a significant threat to the cryptographic foundations that secure modern cloud infrastructures. Existing deployments of Zero Trust Architecture (ZTA) are largely built on classical cryptographic techniques such as the RSA algorithm and elliptic curve cryptography, which are vulnerable to future quantum attacks. Moreover, current studies offer limited guidance on how PQC can be integrated into cloud-native Zero Trust environments while guaranteeing operational efficiency and addressing adaptive security needs. The present study introduces an Adaptive Post Quantum Zero Trust (Adaptive PQC-ZT) Framework by combining the NIST recommended post quantum cryptographic algorithms with a policy based Crypto-Agility Engine for algorithm dynamic selection based upon Security Sensitivity, Algorithm Characteristics, and Latency. The framework was evaluated using a publicly available PQC benchmark dataset containing 37,004 key encapsulation mechanism (KEM) records and 71,456 digital signature records. The analysis examined latency, communication overhead, security levels, and workload suitability for ML-KEM and ML-DSA algorithm families across representative cloud deployment scenarios. The results demonstrate that ML-KEM algorithms provide quantum-resistant key establishment with sub-millisecond latency, while ML-DSA algorithms significantly outperform SPHINCS+ variants in execution efficiency and communication overhead. The proposed Crypto-Agility Engine helps match cryptographic configuration with the needs of different workloads. This allows web applications to run with low latency, while also giving stronger protection to high-security systems such as financial databases. The proposed framework contributes a unified cloud-native security model that blends Zero Trust principles, post-quantum cryptography, benchmark-driven evaluation, and adaptive crypto-agility. This shows practical migration to quantum-safe cloud infrastructures can be done with manageable performance hits. Organizations get a solid path to boost their long-term defense against future quantum threats.
As quantum computing evolves from theoretical promise to emerging reality, the urgency to develop quantum-resilient data protection mechanisms becomes increasingly paramount-particularly within critical infrastructure systems dependent on multi-cloud architectures.This study explores the design and deployment of quantum-resilient encryption protocols tailored to secure sensitive data flows across heterogeneous and decentralized cloud environments supporting energy, transportation, defense, and healthcare infrastructures.Beginning from a broader analysis of cryptographic vulnerabilities posed by quantum adversaries-especially those exploiting Shor's and Grover's algorithms-the paper highlights the limitations of current asymmetric key systems and symmetric encryption practices in multi-cloud data orchestration.Building on this foundation, the research narrows in on post-quantum cryptographic (PQC) frameworks, including lattice-based, code-based, and multivariate polynomial schemes, evaluating their performance and adaptability for dynamic cloud-native systems.A key focus is placed on designing lightweight, interoperable encryption protocols that can seamlessly integrate with federated identity management, zero-trust security models, and real-time data streams without introducing prohibitive latency or computational burden.The study also presents an architectural model that allows for real-time key negotiation, distributed trust management, and algorithm agility, ensuring compliance with both current and forward-looking regulatory standards (e.g., NIST PQC guidelines).Simulation and benchmarking conducted across hybrid cloud environments demonstrate that carefully optimized quantum-resilient protocols can be implemented without compromising system availability or scalability.The results validate the feasibility of transitioning from conventional cryptography to quantum-safe models in mission-critical multi-cloud operations.The paper concludes by offering a strategic roadmap for organizations seeking to future-proof their cloud infrastructures against quantum-era threats.
The transition towards quantum-safe secure communications requires current network infrastructures to support the coexistence of multiple cryptographic technologies. In this context, crypto-agility becomes a key requirement, enabling the coordinated use of Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), and classical cryptographic mechanisms during a progressive migration process. This paper presents a general, standards-based architecture for crypto-agile IPsec service provisioning in Software-Defined Networking (SDN) environments. The proposal combines modular functional blocks that support the integration of QKD-, PQC-,and classical-derived key material under a common operational framework. The architecture builds on existing specifications, including RFC 9061 and ETSI GS QKD 004. Rather than focusing on implementation details or performance evaluation, this work describes the needs addressed by the architecture, its main components, and the operational workflows supporting secure tunnel establishment, rekeying, and attestation-related actions.