This study proposes a lightweight industrial control protocol based on quantum key distribution (QKD) to enhance security and optimize performance in resource-constrained industrial control systems (ICS). Unlike traditional QKD schemes, primarily optimized for long-distance communication in ideal IT environments, this work introduces a resource-aware QKD architecture tailored explicitly for short-range industrial control networks with constrained computing/storage/bandwidth. The protocol constructs a multi-layered stack—integrating the physical layer, quantum key management layer, data link layer, network layer, and application layer—to enable secure quantum key generation, efficient distribution, and dynamic utilization, while avoiding excessive resource overhead on embedded ICS devices. Furthermore, three key optimization strategies are introduced: (1) resource optimization adopts AES-128 with FPGA acceleration, reducing encryption overhead from 15% to 20% CPU utilization to 3%–5% (validated in Sec. V A); (2) real-time assurance implements deficit-round-robin frame scheduling, guaranteeing <2.5 ms latency for safety-critical commands; and (3) stability enhancement utilizes dual-QKD-link redundancy with 5–8 s failover, improving MTBF from 3000 to 10 000+ h. The security real-time trade-off is quantified via coefficient B = Slevel/(Ddelay × δ) (detailed in Sec. V B), where Slevel ∈ [1,10] represents encryption strength, Ddelay is measured latency, and δ is CPU load. Experimental results show that the balance coefficient B improves from 2.1 ± 0.4 (Modbus) to 5.2 ± 0.6, confirming superior balance. This work provides a feasible technical pathway for securing critical infrastructure in the quantum era. Experiments demonstrate a 75% reduction in computational overhead and a real-time-security balance coefficient of 4.5–6.0, which is higher than that of Modbus and PROFINET.
This study proposes a lightweight industrial control protocol based on quantum key distribution (QKD) to enhance security and optimize performance in resource-constrained industrial control systems (ICS). Unlike traditional QKD schemes, primarily optimized for long-distance communication in ideal IT environments, this work introduces a resource-aware QKD architecture tailored explicitly for short-range industrial control networks with constrained computing/storage/bandwidth. The protocol constructs a multi-layered stack—integrating the physical layer, quantum key management layer, data link layer, network layer, and application layer—to enable secure quantum key generation, efficient distribution, and dynamic utilization, while avoiding excessive resource overhead on embedded ICS devices. Furthermore, three key optimization strategies are introduced: (1) resource optimization adopts AES-128 with FPGA acceleration, reducing encryption overhead from 15% to 20% CPU utilization to 3%–5% (validated in Sec. V A); (2) real-time assurance implements deficit-round-robin frame scheduling, guaranteeing <2.5 ms latency for safety-critical commands; and (3) stability enhancement utilizes dual-QKD-link redundancy with 5–8 s failover, improving MTBF from 3000 to 10 000+ h. The security real-time trade-off is quantified via coefficient B = Slevel/(Ddelay × δ) (detailed in Sec. V B), where Slevel ∈ [1,10] represents encryption strength, Ddelay is measured latency, and δ is CPU load. Experimental results show that the balance coefficient B improves from 2.1 ± 0.4 (Modbus) to 5.2 ± 0.6, confirming superior balance. This work provides a feasible technical pathway for securing critical infrastructure in the quantum era. Experiments demonstrate a 75% reduction in computational overhead and a real-time-security balance coefficient of 4.5–6.0, which is higher than that of Modbus and PROFINET.
With the rapid advancement of quantum computing technology, IoT edge devices widely deployed in industrial settings are facing severe threats to their quantum-resistant security. This work focuses on the challenges of adapting Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) for resource-constrained environments. This work systematically identifies four critical obstacles: difficulties in physical integration due to device heterogeneity; constraints imposed by the limited computing power and storage resources of edge nodes on PQC algorithm execution; compatibility gaps between QKD/PQC and existing industrial protocols (such as Modbus and Profinet); and the engineering cost pressures associated with large-scale deployment. To address these issues, the paper proposes three synergistic lightweight countermeasures: (1) a tiered deployment architecture for quantum-safe security that accommodates device heterogeneity, enabling dynamic trade-offs between security strength and resource overhead; (2) middleware for quantum-classical hybrid network protocol coordination, ensuring seamless integration between QKD/PQC and industrial control protocols; and (3) a three-tier distributed key management mechanism (edge node, network proxy, and central system) that offloads computation- and storage-intensive tasks to high-resource nodes, thereby alleviating bottlenecks at the edge. Experimental validation within a smart manufacturing factory's sensor network demonstrates that the proposed scheme maintains post-quantum security capabilities (with QKD integration validated at the proof-of-concept level) while reducing per-node deployment costs by approximately 92.4% compared to pure QKD solutions and by about 32% compared to pure PQC solutions, all while facilitating seamless, non-disruptive upgrades. This study indicates that lightweight algorithm design, hardware-software co-optimization, and tiered architectural deployment constitute a viable pathway for advancing IoT edge security into the quantum-safe era.
The Industrial Internet of Things (IIoT) enables smart manufacturing through advanced sensing, monitoring, and control capabilities. However, securing these resource-constrained IIoT devices poses critical challenges due to limited memory and energy resources, while the emergence of quantum computing threatens existing security mechanisms. This study addresses the urgent need for practical quantum-resistant security solutions for deployment in resource-limited industrial environments. It presents QLight-IIoT, a quantum-resistant authentication and key agreement (AKA) scheme established solely on hash-based hardness assumption, demonstrating that lightweight quantum-resistant authentication is achievable without relying on computationally intensive primitives like lattices or codes. The proposed scheme is deployed and tested over Raspberry Pi 4 to demonstrate its practicality in real-world IIoT environments. Experimental validation shows that the scheme ensures mutual authentication with session key establishment with an average key generation time of 0.3200 seconds. The security of the proposed QLight-IIoT scheme is systematically evaluated using the Real-or-Random (ROR) model, the Scyther tool, and the Automated Validation of Internet Security Protocols and Applications (AVISPA) framework. Performance evaluation reveals significant efficiency improvements, achieving 9.29–77.36% reduction in communication cost and 4.41–95.37% reduction in Computational overhead relative to existing schemes. The scheme requires minimal storage of 632 bits per IIoT device, resulting in up to 64.84% reduction in total system storage cost. Comparative security analysis further validates the scheme’s security against various attack vectors. This work provides a practical pathway for industrial organizations to prepare IIoT infrastructure for quantum-resistant security challenges while maintaining compatibility with current resource-constrained hardware.
Post-quantum cryptography (PQC) is fast becoming a necessity for the Industrial Internet of Things (IIoT), where security requirements must align with strict latency and resource constraints. Traditional security protocols relying on static identities, centralized revocation, and bulky ciphertexts are ill-suited for dynamic and distributed IIoT systems. This paper introduces a quantum-resilient identity and key management architecture optimized for constrained industrial environments. We propose a lightweight entropy-seeded identity model that leverages biometric, device, and environmental randomness to generate spoof-resistant identities. A compressed key encapsulation delivery protocol based on CRYSTALS Kyber512 is developed using delta encoding, fragmentation, and ZLIB compression to minimize ciphertext overhead. Although a hybrid blockchain integration is conceptually discussed to outline revocation and trust enforcement, our implementation on constrained IIoT devices demonstrates over 48% ciphertext size reduction, 30% latency improvement compared to baseline Kyber, and real-time trust scoring based on behavioral analysis, showing strong potential for scalable, bandwidth-aware, and future-proof security deployment in post-quantum IIoT ecosystems.
Supervisory Control and Data Acquisition (SCADA) systems represent the cyber-physical infrastructure core of critical infrastructure, where any security violation can cause severe operational and physical repercussions. The integration of operational technology with Information Technology networks has introduced new vulnerabilities to cyber attacks, while the emergence of quantum computing poses a basic threat to classical cryptographic approaches currently in use within industrial control systems. This paper presents a novel Zero-Trust Post-Quantum Cryptographic (ZT-PQC) solution specifically tailored for resource-constrained SCADA systems. The solution combines lightweight symmetric encryption for field devices, hybrid and pure post-quantum cryptography for higher layers, and continuous Zero-Trust policy enforcement throughout the communication process. A layer-aware cryptographic offloading approach is utilized to strike a balance between quantum resilience and real-time operational requirements. The feasibility of the proposed solution is assessed using a validated synthetic SCADA dataset simulating practical communication patterns, attack models, and system constraints. Experimental results show that the solution provides quantum-resistant security with acceptable latency, minimal communication overhead, and compatibility with existing SCADA systems, thus being amenable to incremental deployment in critical infrastructure systems.
Quantum key distribution (QKD), a cryptographic method grounded in the laws of quantum mechanics rather than computational hardness, promises provably secure communications. Its integration into critical infrastructure offers a pathway to secure resilient operation of next-generation control systems, from power-intensive data centers to remotely operated microreactors located in energy-deprived remote communities. While QKD has been demonstrated in laboratory and network settings, its use in safety-critical control systems remains unexplored where requirements on latency, key availability, and operational stability pose unique challenges. Here, we introduce a QKD-secured data acquisition and control framework for embedding quantum cybersecurity directly into safety-critical cyber-physical systems and report the first end-to-end experimental demonstration in a nuclear reactor. The framework establishes the conditions necessary to achieve secure, low-latency, real-time operation in safety-critical environments. Using a phase-encoding decoy-state BB84 system deployed on Purdue's 10 kWth fully digital research reactor (PUR-1) we validate the model and achieve real-time encryption and decryption of 2,000 reactor signals. Experiments demonstrated a stable secret-key rate of 320 kbps with a quantum bit error rate of 3.8% at 54 km, and maximum optical-fiber distances of 82 km with One-Time Pad (OTP) encryption and 140 km with AES-256. We further evaluated compliance with latency and key availability conditions using three cryptographic schemes (OTP, AES-256, ASCON), finding that all variants supported real-time operation at typical data reporting rates. Our results establish a universal framework for quantum-cybersecurity in safety-critical systems, demonstrating that quantum communication technologies can enable secure, low-latency, real-time operation of nuclear reactors and other critical infrastructure.
Industrial control systems would increasingly depend on remote operation, online monitoring, and potentially autonomous control. This creates new requirements for secure, low-latency communications, and introduces new operational constraints on secret key availability, communication autonomy, and resilience under normal and abnormal conditions. We present a time-dependent quantitative model for embedding quantum-secure communications in an industrial control system and demonstrate its implementation on Purdue’s fully-digital 10-kWth research reactor (PUR-1). Using a phase-encoding decoy-state-BB84 Quantum Key Distribution (QKD) system we propose and evaluate three communication autonomy metrics: dynamic key pool size, lead time, and post-failure uptime. We establish quantitative relationships linking physical-layer QKD performance metrics, such as secret key rate (SKR) and quantum bit-error-rate (QBER), to industrial control-level communication demands defined by sampling rate, data precision, and reporting frequency. We show that for the most demanding configuration, 20 Hz sampling at 120 km, QKD coupled with AES-256 encryption required a minimum of 24 min lead time, while distances below 95 km required less than 10 min, regardless of the number of signals. These results establish experimentally verified bounds for integrating quantum cybersecurity within real-time control architectures and provide a foundation for designing quantum-resilient communication frameworks for next-generation reactors and other safety-critical industrial systems.