The rapid progress of quantum computing is about to destabilise the foundation of classical cryptography. This is an unprecedented threat to industrial control systems (ICS) that settle for outdated communication protocols. Systems also have stolid performance. This paper describes the first comprehensive multi-layered quantum-safe security system designed to protect the entirety of industrial and cyber-physical systems from classical and quantum threats. The system designed marries hybrid cryptographic primitives: NIST-approved post-quantum algorithms Kyber and Dilithium with classical X25519 and Ed25519 for maintaining confidentiality, integrity, and authenticity. A session layer is stateful and implements authenticated encryption, forward secrecy, and anti-replay. An application layer has context-aware modules for anomaly detection and role-based access control. It also includes secure firmware validation. Experimental testing in accordance with a SCADA-PLC environment simulation proves that cryptographic latency of the system is below a millisecond and, therefore, it does not breach stringent industrial control loop targets. This also demonstrates industrial latency. Benchmarking proves that hybrid systems are computationally trivial relative to classical systems, thus, the suggested defence-in-depth design bridges the significant gap between practical post-quantum security and industrial application. This provides quantum peer-to-peer communication, concurrent trust in process integrity, trusted firmware, and process control to smart manufacturing systems.
The rapid progress of quantum computing is about to destabilise the foundation of classical cryptography. This is an unprecedented threat to industrial control systems (ICS) that settle for outdated communication protocols. Systems also have stolid performance. This paper describes the first comprehensive multi-layered quantum-safe security system designed to protect the entirety of industrial and cyber-physical systems from classical and quantum threats. The system designed marries hybrid cryptographic primitives: NIST-approved post-quantum algorithms Kyber and Dilithium with classical X25519 and Ed25519 for maintaining confidentiality, integrity, and authenticity. A session layer is stateful and implements authenticated encryption, forward secrecy, and anti-replay. An application layer has context-aware modules for anomaly detection and role-based access control. It also includes secure firmware validation. Experimental testing in accordance with a SCADA-PLC environment simulation proves that cryptographic latency of the system is below a millisecond and, therefore, it does not breach stringent industrial control loop targets. This also demonstrates industrial latency. Benchmarking proves that hybrid systems are computationally trivial relative to classical systems, thus, the suggested defence-in-depth design bridges the significant gap between practical post-quantum security and industrial application. This provides quantum peer-to-peer communication, concurrent trust in process integrity, trusted firmware, and process control to smart manufacturing systems.
This item contains a research article proposing a post-quantum cryptography (PQC) security architecture for IoT-enabled chemical process plants, where sensor connectivity and cloud analytics introduce safety-critical cyber-physical risks. The paper first surveys PQC and quantum-threat literature for SCADA/OT and industrial IoT systems, then applies Mosca’s Theorem to argue that long-lived chemical infrastructures are already in the “harvest now, decrypt later” risk window.A structured threat model is built using STRIDE and MITRE ATT&CK for ICS, distinguishing safety-critical consequences (e.g., false sensor readings and malicious actuator commands) from conventional confidentiality breaches. Based on this model, the paper proposes an ESP32-based three-tier architecture (field sensors, edge microcontrollers, and cloud analytics) that integrates NIST-standardized lattice-based algorithms: CRYSTALS-Kyber (ML-KEM) for session key establishment, CRYSTALS-Dilithium (ML-DSA) for data/command authentication, and SPHINCS+ or Dilithium for firmware-signing on resource-constrained devices.The design is explicitly mapped to IEC 62443 Foundational Requirements (FR1 Identification & Authentication, FR3 System Integrity, FR4 Data Confidentiality) and accompanied by a feasibility analysis that uses microcontroller-level benchmarks of Kyber and Dilithium on ESP32-class hardware, highlighting computation, memory, and communication trade-offs versus classical RSA/ECC. The paper also outlines a hardware-free validation methodology using liboqs (Open Quantum Safe) with TLS 1.3, device emulation, and Linux network emulation to measure protocol overhead under realistic industrial network conditions.Finally, it discusses migration challenges for brownfield plants, the evolving standards and regulatory landscape (NIST IR 8547, IEC 62443, CISA/NSA guidance), and future work on empirical benchmarking and multi-plant threat-model generalization, aiming to provide a roadmap for designing quantum-safe IoT architectures in safety-critical chemical production.
Quantum computing is rapidly approaching a stage where classical cryptographic systems, particularly RSA, ECC, and Diffie–Hellman, will no longer provide adequate security for critical infrastructure. The emergence of Shor’s and Grover’s algorithms introduces unprecedented vulnerability to national cyber-defense ecosystems, underpinning power grids, transportation, military communications, and banking systems. This paper presents a unified post-quantum cryptographic (PQC) security framework integrating lattice-based primitives, hybrid key-exchange mechanisms, and secure orchestration for resource-constrained operational-technology environments. The proposed architecture leverages NIST-recommended schemes, including CRYSTALS-Kyber, CRYSTALS-Dilithium, and SPHINCS+, to ensure long-term confidentiality, integrity, and interoperability across legacy and modern control environments. A defense-in-depth trust-fabric is introduced to protect critical data flows across edge controllers, automation PLCs, substations, cloud-SCADA gateways, and defense communication systems. Performance evaluation demonstrates a 39.4% reduction in key-exchange latency, 46% faster authentication cycles, and zero-downtime cryptographic transition capability. Our findings position this framework as a practical migration blueprint supporting national PQC readiness and cyber-resilience mandates.
As the advent of quantum computing threatens traditional cryptographic protocols, hybrid classical-quantum secure communication infrastructures have emerged as a critical frontier in cybersecurity. This paper explores the integration of post-quantum cryptographic algorithms—specifically CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures—into hybrid communication architectures designed to resist quantum-level attacks. Leveraging lattice-based cryptographic primitives, both algorithms have been selected for standardization by NIST due to their robust security and performance characteristics. This study evaluates their implementation in real-world communication stacks, assesses latency and throughput under hybrid channel configurations, and proposes a layered security architecture combining classical and quantum-resilient mechanisms. Furthermore, it examines key management, digital trust, and infrastructure scalability in a post-quantum context. Simulation results and hardware-based validations are used to determine practical deployment feasibility in critical sectors such as finance, defense, and healthcare. The findings offer a comprehensive framework for securing data in transitional computing eras, ensuring forward secrecy, and maintaining operational integrity against future adversarial quantum threats.
Supervisory Control and Data Acquisition (SCADA) systems represent the cyber-physical infrastructure core of critical infrastructure, where any security violation can cause severe operational and physical repercussions. The integration of operational technology with Information Technology networks has introduced new vulnerabilities to cyber attacks, while the emergence of quantum computing poses a basic threat to classical cryptographic approaches currently in use within industrial control systems. This paper presents a novel Zero-Trust Post-Quantum Cryptographic (ZT-PQC) solution specifically tailored for resource-constrained SCADA systems. The solution combines lightweight symmetric encryption for field devices, hybrid and pure post-quantum cryptography for higher layers, and continuous Zero-Trust policy enforcement throughout the communication process. A layer-aware cryptographic offloading approach is utilized to strike a balance between quantum resilience and real-time operational requirements. The feasibility of the proposed solution is assessed using a validated synthetic SCADA dataset simulating practical communication patterns, attack models, and system constraints. Experimental results show that the solution provides quantum-resistant security with acceptable latency, minimal communication overhead, and compatibility with existing SCADA systems, thus being amenable to incremental deployment in critical infrastructure systems.
The threat of a cryptographically relevant quantum computer contributes to an increasing interest in the field of post-quantum cryptography (PQC). Compared to existing research efforts regarding the integration of PQC into the Transport Layer Security (TLS) protocol, industrial communication protocols have so far been neglected. Since industrial cyber-physical systems (CPS) are typically deployed for decades, protection against such long-term threats is needed. In this work, we propose two novel solutions for the integration of post-quantum (PQ) primitives (digital signatures and key establishment) into the industrial protocol Open Platform Communications Unified Architecture (OPC UA): a hybrid solution combining conventional cryptography with PQC and a solution solely based on PQC. Both approaches provide mutual authentication between client and server and are realized with certificates fully compliant to the X.509 standard. We implement the two solutions and measure and evaluate their performance across three different security levels. All selected algorithms (Kyber, Dilithium, and Falcon) are candidates for standardization by the National Institute of Standards and Technology (NIST). We show that Falcon is a suitable option – especially – when using floating-point hardware provided by our ARM-based evaluation platform. Our proposed hybrid solution provides PQ security for early adopters but comes with additional performance and communication requirements. Our solution solely based on PQC shows superior performance across all evaluated security levels in terms of handshake duration compared to conventional OPC UA but comes at the cost of increased handshake sizes. In addition to our performance evaluation, we provide a proof of security in the symbolic model for our two PQC-based variants of OPC UA. For this proof, we use the cryptographic protocol verifier ProVerif and formally verify confidentiality and authentication properties of our quantum-resistant variants.
Future 6G-enabled smart hospital infrastructures will support latency-critical medical operations such as robotic surgery, autonomous monitoring, and real-time clinical decision systems, which require communication mechanisms that ensure both ultra-low latency and long-term cryptographic security. Existing security solutions either rely on classical cryptographic protocols that are vulnerable to quantum attacks or deploy isolated post-quantum primitives without providing a unified framework for secure real-time medical command transmission. This research presents a latency-aware, multi-layered post-quantum security architecture for 6G-enabled smart hospital environments. The proposed framework establishes an end-to-end secure command transmission pipeline that integrates hardware-rooted device authentication, post-quantum key establishment, hybrid payload protection, dynamic access enforcement, and tamper-evident auditing within a coherent system design. In contrast to existing approaches that focus on individual security mechanisms, the architecture introduces a structured integration of Kyber-based key encapsulation and Dilithium digital signatures with hybrid AES-based encryption and legacy-compatible key transport, while Physical Unclonable Function authentication provides hardware-bound device identity verification. Zero Trust access control, metadata-driven anomaly detection, and blockchain-style audit logging provide continuous verification and traceability, while threshold cryptography distributes cryptographic authority to eliminate single points of compromise. The proposed architecture is evaluated using a discrete-event simulation framework representing adversarial conditions in realistic 6G medical communication scenarios, including replay attacks, payload manipulation, and key corruption attempts. Experimental results demonstrate improved security and operational efficiency, achieving a 48% reduction in detection latency, a 68% reduction in false-positive anomaly detection rate, and a 39% improvement in end-to-end round-trip latency compared to conventional RSA-AES-based architectures. These results demonstrate that the proposed framework provides a practical and scalable approach for achieving post-quantum secure and low-latency command transmission in next-generation 6G smart hospital systems.