Industrial control systems would increasingly depend on remote operation, online monitoring, and potentially autonomous control. This creates new requirements for secure, low-latency communications, and introduces new operational constraints on secret key availability, communication autonomy, and resilience under normal and abnormal conditions. We present a time-dependent quantitative model for embedding quantum-secure communications in an industrial control system and demonstrate its implementation on Purdue’s fully-digital 10-kWth research reactor (PUR-1). Using a phase-encoding decoy-state-BB84 Quantum Key Distribution (QKD) system we propose and evaluate three communication autonomy metrics: dynamic key pool size, lead time, and post-failure uptime. We establish quantitative relationships linking physical-layer QKD performance metrics, such as secret key rate (SKR) and quantum bit-error-rate (QBER), to industrial control-level communication demands defined by sampling rate, data precision, and reporting frequency. We show that for the most demanding configuration, 20 Hz sampling at 120 km, QKD coupled with AES-256 encryption required a minimum of 24 min lead time, while distances below 95 km required less than 10 min, regardless of the number of signals. These results establish experimentally verified bounds for integrating quantum cybersecurity within real-time control architectures and provide a foundation for designing quantum-resilient communication frameworks for next-generation reactors and other safety-critical industrial systems.
Industrial control systems would increasingly depend on remote operation, online monitoring, and potentially autonomous control. This creates new requirements for secure, low-latency communications, and introduces new operational constraints on secret key availability, communication autonomy, and resilience under normal and abnormal conditions. We present a time-dependent quantitative model for embedding quantum-secure communications in an industrial control system and demonstrate its implementation on Purdue’s fully-digital 10-kWth research reactor (PUR-1). Using a phase-encoding decoy-state-BB84 Quantum Key Distribution (QKD) system we propose and evaluate three communication autonomy metrics: dynamic key pool size, lead time, and post-failure uptime. We establish quantitative relationships linking physical-layer QKD performance metrics, such as secret key rate (SKR) and quantum bit-error-rate (QBER), to industrial control-level communication demands defined by sampling rate, data precision, and reporting frequency. We show that for the most demanding configuration, 20 Hz sampling at 120 km, QKD coupled with AES-256 encryption required a minimum of 24 min lead time, while distances below 95 km required less than 10 min, regardless of the number of signals. These results establish experimentally verified bounds for integrating quantum cybersecurity within real-time control architectures and provide a foundation for designing quantum-resilient communication frameworks for next-generation reactors and other safety-critical industrial systems.
Quantum key distribution (QKD), a cryptographic method grounded in the laws of quantum mechanics rather than computational hardness, promises provably secure communications. Its integration into critical infrastructure offers a pathway to secure resilient operation of next-generation control systems, from power-intensive data centers to remotely operated microreactors located in energy-deprived remote communities. While QKD has been demonstrated in laboratory and network settings, its use in safety-critical control systems remains unexplored where requirements on latency, key availability, and operational stability pose unique challenges. Here, we introduce a QKD-secured data acquisition and control framework for embedding quantum cybersecurity directly into safety-critical cyber-physical systems and report the first end-to-end experimental demonstration in a nuclear reactor. The framework establishes the conditions necessary to achieve secure, low-latency, real-time operation in safety-critical environments. Using a phase-encoding decoy-state BB84 system deployed on Purdue's 10 kWth fully digital research reactor (PUR-1) we validate the model and achieve real-time encryption and decryption of 2,000 reactor signals. Experiments demonstrated a stable secret-key rate of 320 kbps with a quantum bit error rate of 3.8% at 54 km, and maximum optical-fiber distances of 82 km with One-Time Pad (OTP) encryption and 140 km with AES-256. We further evaluated compliance with latency and key availability conditions using three cryptographic schemes (OTP, AES-256, ASCON), finding that all variants supported real-time operation at typical data reporting rates. Our results establish a universal framework for quantum-cybersecurity in safety-critical systems, demonstrating that quantum communication technologies can enable secure, low-latency, real-time operation of nuclear reactors and other critical infrastructure.
Recent advancements in reactor designs could offer new revolutionary capabilities, including remote monitoring, increased flexibility, and reduced operation and maintenance costs. Embracing new digital technologies would allow for operational concepts such as semiautonomous or near-autonomous control, and two-way communications for real-time integration with the upcoming smart electric grid. However, such continuous data transmission from and toward a reactor site could potentially introduce new challenges and vulnerabilities, necessitating the prioritization of cybersecurity.Conventional information technology–based encryption schemes, which rely mostly on computational complexity, have been shown to be vulnerable to cyberattacks. With the advent of quantum computing, practically any asymmetric encryption could be potentially compromised. For example, it has been shown that a RSA-2048 bit key could be broken in 8 h.To address this challenge, we explore the feasibility of quantum key distribution (QKD) to secure communications. QKD is a physical layer security scheme relying on the laws of quantum mechanics instead of mathematical complexity. QKD promises not only unconditional security but also detection of potential intrusion, as it allows the communication parties to become aware of eavesdropping. To test the proposed hypothesis, a novel simulation tool (NuQKD) was developed to allow for real-time simulation of the BB84 QKD protocol between two remote terminals. A reference scenario is proposed, generic enough to cover various internal and external communication links to a reactor site. Using NuQKD, the internal and external data links were modeled, and receiver operating characteristic curves were calculated for various QKD configurations.A performance analysis was conducted, demonstrating that QKD can provide adequate secret key rates with low false alarms and has the potential of addressing the nuclear industry’s high standards of confidentiality for distance lengths up to 75 km of fiberoptics. Using a conservative estimation, QKD can provide up to 21.5 kbps of secret key rate for a distance of 1 km and 14.4 kbps at 10 km. The target secret key rates for the corresponding links were estimated at 16 kbps and 80 bps, respectively, based on the analysis of real data from a PUR-1 fully digital reactor. Consequently, QKD is shown to be compatible with existing and future point-to-point reactor communication architectures. These results motivate further study of quantum communications for nuclear reactors.
Quantum Key Distribution (QKD) provides physical-layer security based on quantum state disturbance rather than computational complexity. However, operational viability depends heavily on physical channel parameters, optical loss, finite-key statistical bounds, and network key-sharing constraints. This paper presents a multi-metric, quantitative evaluation of a three-intensity decoy-state BB84 QKD link and its application within a time-shared star network. Using a Monte Carlo sampling framework (n=60 replications per configuration), we evaluate link distance (0–200 km), attenuation (0.18-0.30 dB/km), detector efficiency (10-40%), dark count probability (10-8-10-5 per gate), eavesdropping intensity (0-50%), privacy-amplification block size (106-109 pulses), and simultaneous user pair load (1-20 pairs). Under baseline settings (0.20 dB/km, 25% detector efficiency, 500 MHz pulse rate, signal intensity μ=0.50, 1.5% misalignment, block size N=5×107), the secure key rate (SKR) drops from 12.83 Mbit/s at 0 km to 295.63 kbit/s at 80 km, reaching non-positive values at 200 km due to finite statistical penalties. Intercept-resend attacks degrade secrecy, suppressing output to zero at ∼20% interception intensity (QBER=6.51%). In the shared network, a target demand of 20 kbit/s per user pair experiences depletion when active pairs exceed 12, despite a positive aggregate link generation rate. The findings demonstrate that QKD viability requires joint evaluation of SKR, QBER, finite-key confidence, latency, and multi-user key supply dynamics.
This study proposes a lightweight industrial control protocol based on quantum key distribution (QKD) to enhance security and optimize performance in resource-constrained industrial control systems (ICS). Unlike traditional QKD schemes, primarily optimized for long-distance communication in ideal IT environments, this work introduces a resource-aware QKD architecture tailored explicitly for short-range industrial control networks with constrained computing/storage/bandwidth. The protocol constructs a multi-layered stack—integrating the physical layer, quantum key management layer, data link layer, network layer, and application layer—to enable secure quantum key generation, efficient distribution, and dynamic utilization, while avoiding excessive resource overhead on embedded ICS devices. Furthermore, three key optimization strategies are introduced: (1) resource optimization adopts AES-128 with FPGA acceleration, reducing encryption overhead from 15% to 20% CPU utilization to 3%–5% (validated in Sec. V A); (2) real-time assurance implements deficit-round-robin frame scheduling, guaranteeing <2.5 ms latency for safety-critical commands; and (3) stability enhancement utilizes dual-QKD-link redundancy with 5–8 s failover, improving MTBF from 3000 to 10 000+ h. The security real-time trade-off is quantified via coefficient B = Slevel/(Ddelay × δ) (detailed in Sec. V B), where Slevel ∈ [1,10] represents encryption strength, Ddelay is measured latency, and δ is CPU load. Experimental results show that the balance coefficient B improves from 2.1 ± 0.4 (Modbus) to 5.2 ± 0.6, confirming superior balance. This work provides a feasible technical pathway for securing critical infrastructure in the quantum era. Experiments demonstrate a 75% reduction in computational overhead and a real-time-security balance coefficient of 4.5–6.0, which is higher than that of Modbus and PROFINET.
Industrial control systems rely on long-lived cryptographic trust anchors to protect safety-critical operations, remote maintenance, and software supply chains. Quantum-capable adversaries create a time-shifted risk: encrypted traffic captured today may be decrypted later, while classical public-key signatures that authenticate devices, software updates, and forensic records may eventually become forgeable. This paper presents a secure-by-design post-quantum architecture for industrial control systems that couples cryptographic agility with the timing, availability, and safety constraints of operational technology. The architecture combines a post-quantum-ready trust fabric, hybrid and post-quantum transport profiles, gateway-anchored protection for legacy field protocols, and lifecycle governance aligned with industrial cybersecurity practice. A reproducible sizing study uses standardized artifact sizes from current post-quantum standards and representative industrial link rates to estimate bandwidth, latency, credential-storage, packetization, and maintenance-window effects. The evaluation also separates communication occupancy from control-loop timing, clarifies the certificate-chain sizing assumptions, discusses retransmission and packet-loss implications, and relates the analytical model to published embedded post-quantum benchmarking. The results show that post-quantum and hybrid handshakes are practical on Ethernet-based plant networks but become operationally expensive on low-rate telemetry links, which motivates gateway termination, session resumption, and deterministic rekeying. The resulting blueprint offers a practical migration path that reduces harvest-now-decrypt-later exposure while preserving deterministic control behavior and operational resilience.
This paper proposes a quantum key distribution (QKD) based hybrid communication system for enhancing security in tactical military networks. Modern military communication networks face complex threats including jamming, eavesdropping, and potential cryptanalysis by quantum computers, necessitating a new security framework that combines quantum and classical cryptography. This study implements the BB84 protocol using the PennyLane quantum computing framework and quantitatively evaluates the effects of interception probability and channel noise on both the estimated Quantum Bit Error Rate (QBER) and the resulting secure key length after privacy amplification. Experimental results confirm that the session abort rate increases sharply as QBER approaches/exceeds the 11% threshold, and the secure key budget degrades to near-zero in high-threat conditions, which directly limits application-layer encryption continuity. By applying the generated quantum keys to AES-256-GCM encryption, we validate end-to-end hybrid operation and report system-level metrics such as the number of usable 256-bit keys per session and the corresponding rekeying capacity under varying threat and noise conditions.