The quantum internet is evolving from isolated point-to-point quantum key distribution links toward a globally interconnected, multi-layer protocol stack supporting entanglement distribution, quantum teleportation, and distributed quantum computing. As this architecture matures, each protocol layer-physical, link, network, transport, and application exposes negotiable security parameters: QKD protocol type, entanglement fidelity thresholds, purification rounds, error-correction schemes, and authentication methods. Yet no standardized mechanism exists to negotiate these parameters securely across layers or to prevent adversarial downgrade. The classical internet spent two decades rediscovering this lesson through attacks such as POODLE, FREAK, Logjam, KNOB, and Dragonblood; the quantum internet is now repeating the same architectural oversight. This study introduces QShield , a cross-layer security negotiation framework that binds every layer’s capability commitment into a unified transcript hash, ensuring that any single-layer downgrade invalidates the session-wide security context. We formalize a quantum security downgrade hierarchy spanning six levels from device-independent QKD to classical cryptography and identify twelve concrete downgrade attack vectors mapped from classical analogs. Evaluation across all twelve attack types shows that QShield with cross-layer transcript binding achieves 100% deterministic detection across the twelve modeled downgrade vectors evaluated under emulation, whereas independent per-layer checks detect only 40–60% of coordinated multi-layer attacks. Hybrid mode preserves near-classical session bootstrap latency (48-55 ms versus 25-30 ms baseline), while the signaling overhead remains within practical bounds (3.5-5 KB versus 0.8-1.2 KB for classical).
The quantum internet is evolving from isolated point-to-point quantum key distribution links toward a globally interconnected, multi-layer protocol stack supporting entanglement distribution, quantum teleportation, and distributed quantum computing. As this architecture matures, each protocol layer-physical, link, network, transport, and application exposes negotiable security parameters: QKD protocol type, entanglement fidelity thresholds, purification rounds, error-correction schemes, and authentication methods. Yet no standardized mechanism exists to negotiate these parameters securely across layers or to prevent adversarial downgrade. The classical internet spent two decades rediscovering this lesson through attacks such as POODLE, FREAK, Logjam, KNOB, and Dragonblood; the quantum internet is now repeating the same architectural oversight. This study introduces QShield , a cross-layer security negotiation framework that binds every layer’s capability commitment into a unified transcript hash, ensuring that any single-layer downgrade invalidates the session-wide security context. We formalize a quantum security downgrade hierarchy spanning six levels from device-independent QKD to classical cryptography and identify twelve concrete downgrade attack vectors mapped from classical analogs. Evaluation across all twelve attack types shows that QShield with cross-layer transcript binding achieves 100% deterministic detection across the twelve modeled downgrade vectors evaluated under emulation, whereas independent per-layer checks detect only 40–60% of coordinated multi-layer attacks. Hybrid mode preserves near-classical session bootstrap latency (48-55 ms versus 25-30 ms baseline), while the signaling overhead remains within practical bounds (3.5-5 KB versus 0.8-1.2 KB for classical).
The development of quantum computers will provide modern cryptographic systems with a practical computing infrastructure, yet the number-theoretic assumptions these systems are built on poses an acute security risk at this juncture, especially when Shor and Grover’s algorithms are considered. In this article, we present QRC-Stack (Quantum Resilient Cryptographic Stack): A modular architecture for post quantum about cyber resilient communication in current and next generation infrastructures of the internet. QRC-Stack combines lattice-based and hash-based schemes with transport layers and key management to guarantee data integrity, confidentiality, and authenticity within classical networks as well as software-defined networks. The architecture of QRC-Stack is enhanced by incorporating hybrid key exchange models that integrate classical (e.g., ECDH) and post-quantum (PQ) cryptography; Kyber and Dilithium from NIST PQC finalists to sustain legacy interoperability while advancing resilience to future threats in quantum networked environments The newly proposed QRC-Stack model includes three interrelated parts that together improve the security and flexibility of cryptographic communication within a quantum-threat context. Starting with the key management layer for quantum-aware systems (QKML), it incorporates a session key distribution system that the quantum cryptography foe cannot breach. Furthermore, the Adaptive Cipher Suite Negotiation (ACSN) injects a more node centric, risk-adaptive model in whereby selection of a cryptographic suite from a pool of available options is done dynamically where the suit best optimizes contextual threat. In addition, Q-Protect Transport Module enables seamless alignment with pre-existing transport protocols such as TLS/IPSec and QUIC or SD-WAN tunnels with limited overhead footprint. Emulation testing on SDN testbeds and active WAN environments showed that QRC-Stack sustained enterprise-class encryption throughput while adding latency overhead less than eight percent. Moreover, this hybrid architecture gives forward secrecy and stronger resistance to quantum-enhanced man-in-the-mid solar attacks with faster key refresh rates. QRC-Stack also outperformed classical TLS 1.3 alongside other variants of Transition Post Quantum Cryptography’, claiming steadfast post-compromised security while surpassing baseline models in adaptability, resilience, and versatility making it ideal for next-generation network backbone design. This information reconfirms QRC-Stack's supurb strength as an extensible multi layered blanced framework solution for communication systems in layers form situated in scenarios involving surveillance from powerful post-quantum adversaries. It helps to control the move toward safely moving quantum national, enterprise, and IoT networks from cryptographic systems built for surveillance heavy environments with minimal changes to current infrastructure.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The emergence of large-scale quantum computers poses a significant threat to current cryptographic protocols, particularly Transport Layer Security (TLS), which relies on RSA and elliptic curve cryptography vulnerable to Shor's algorithm. This paper presents a hybrid framework for quantum-resistant TLS handshakes that integrates post-quantum cryptography (PQC), quantum key distribution (QKD) and classical cryptography to provide comprehensive protection against both classical and quantum attacks. The approach employs three QKD protocols; BB84, E91, and Measurement-Device-Independent QKD (MDI-QKD) alongside NIST-standardized PQC algorithms as well as alternative candidates such as HQC and BIKE. A key innovation is the QKD key management module, which addresses performance bottlenecks through periodic key generation and secure reuse within predefined retention periods, significantly reducing QKD overhead in TLS handshakes. The experimental implementation using the quantum network simulator evaluated 144 distinct cryptographic protocol combinations. Results demonstrate that ML-KEM combined with ML-DSA provides optimal PQC performance, while QKD protocol selection is distance-dependent: BB84 for short-range and MDI-QKD for long-distance communication. The framework includes various attack mitigation mechanisms and ensure security as long as at least one cryptographic method remains uncompromised. Consistent with current global quantum network usage, the proposed TLS approach is designed primarily for MAN and WAN environments rather than the Internet, providing a balanced solution that combines theoretical security guarantees with computational efficiency.
The existence of quantum computing presents an existential threat to the traditional cryptographic algorithms, and there is a need to create communication mechanisms that are fundamentally secure. In this regard, the concept of Quantum Key Distribution (QKD) provides information-theoretic security, which is founded on quantum mechanics. Nevertheless, conventional QKD protocols have serious shortcomings such as lack of distance in communication, vulnerability to side-channel attacks, and inability to support the large-scale heterogeneous network. We suggest that HQNet-QKD a Hybrid Quantum Key Distribution framework can help solve these issues by offering a more secure, scalable and future-proof key exchange framework in hybrid classical-quantum networks. To support multi-layered security, the proposed architecture is a network ensuring the smoothness of decoy-state BB84, Measurement-Device-Independent QKD (MDI-QKD), entanglement/twin-field-based QKD with verifiable Secret Sharing (VSS) and Post-Quantum Cryptography (PQC). It provides a complete methodology such as system architecture, mathematical modeling, and end-to-end key synthesis. When used over a distance of 300 km, simulation and testing have shown that HQNet-QKD can achieve up to2.7×higher secret key rate (SKR) than conventional methods, secret communication at 700 km and resilience to both quantum and classical attacks more than 96%. In addition, the framework guarantees forward secrecy, detector-side immunity, contextbound key derivation, and composability and thus resistant to current and future adversaries. It has a low-computational overhead modular design, making it trivial to deploy in a real world, in applications like quantum-secured 5G backbones, cloud data centers, critical infrastructure, and satellite-based communication systems. The findings make HQNet-QKD a new generation solution to quantum-safe secure communication and the first step towards the implementation of the quantum internet.
The advent of large-scale quantum computing poses critical threats to classical public-key cryptography, raising urgent concerns for mission-critical infrastructures such as power systems. Existing authentication mechanisms—whether based on physical unclonable functions (PUFs), quantum key distribution (QKD), or post-quantum cryptography (PQC)—each offer unique advantages but also face limitations when deployed in isolation. This paper presents a multi-level quantum-resistant authentication methodology that systematically integrates PUF-based device identity, QKD-derived symmetric keys, and PQC-based primitives. To unify these heterogeneous sources, we design a structured session key fusion mechanism that incorporates entropy preprocessing, cross-layer validation tokens, forward-linked context binding, and dual key derivation functions (KDFs). The resulting session key is inseparably derived from all layers, eliminating single points of failure and enhancing defense against both classical and quantum adversaries. Compared with prior single-layer or loosely coupled approaches, the proposed design achieves defense-in-depth, practical scalability across edge and backbone infrastructures, and alignment with emerging cryptographic standards, providing a secure pathway for next-generation power communication systems.
Quantum communication is emerging as a foundation for next-generation networks, offering unprecedented capabilities in security, entanglement-based connectivity, and distributed computation. However, the classical Open Systems Interconnection (OSI) model, designed for deterministic, error-tolerant systems, is incompatible with quantum phenomena such as decoherence, probabilistic entanglement, and the no-cloning theorem. This paper surveys and redefines the OSI model for quantum networking in the context of 7G systems. We propose a Quantum-Converged OSI stack by extending the classical seven-layer model with two additional layers: (i) Layer 0, the Quantum Substrate, responsible for entanglement management, coherence preservation, and teleportation; and (ii) Layer 8, the Cognitive Intent Plane, which enables AI- and QML-driven orchestration. The survey synthesizes over 150 research works published between 2018 and 2025, classifying them by OSI layer, enabling technologies (e.g., Quantum Key Distribution, Quantum Error Correction, and Post-Quantum Cryptography), and application domains such as satellite quantum links, quantum IoT, and federated edge systems. We further provide a taxonomy of cross-layer enablers and discuss simulation tools, including NetSquid, QuNetSim, and QuISP. Finally, an evaluation framework with quantum-native metrics, such as entropy throughput, coherence latency, and entanglement fidelity, is introduced, along with open challenges for programmable stacks, digital twins, and AI-defined quantum agents. The specific and novel contribution of this work is a Quantum-Converged OSI stack that extends the classical seven-layer model with two additional layers: Layer 0, the Quantum Substrate, responsible for entanglement management, coherence preservation, and teleportation; and Layer 8, the Cognitive Intent Plane, which enables AI- and QML-driven orchestration. Unlike prior technology-centric surveys, the proposed framework classifies over 150 research works by OSI layer, maps enabling technologies (QKD, QEC, PQC) and application domains (satellite quantum links, quantum IoT, federated edge systems) to their functional layers, and introduces a quantum-native evaluation framework based on entropy throughput, coherence latency, and entanglement fidelity. This layer-resolved synthesis, together with the formal definition of cross-layer quantum-native metrics, constitutes the principal novelty distinguishing this survey from existing quantum-networking reviews.