Post-quantum zero-trust backbone: Securing critical infrastructure communications against quantum and conventional cyber threats

Corresponding author: Winifred Chukwuebuka Ayogu Copyright © 2025 Author(s) retain the copyright of this article. This article is published under the terms of the Creative Commons Attribution Liscense 4.0. Post-quantum zero-trust backbone: Securing critical infrastructure communications against quantum and conventional cyber threats Winifred Chukwuebuka Ayogu * Department of Cybersecurity and Networks, Tagliatela College of Engineering, University of New Haven, United States of America. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 Publication history: Received on 13July 2025; revised on 07 September 2025; accepted on 09 September 2025 Article DOI: https://doi.org/10.30574/wjarr.2025.27.3.3178 Abstract The convergence of quantum computing capabilities and sophisticated cyberattacks poses unprecedented threats to critical infrastructure communications. Traditional cryptographic defenses and perimeter-based security models are increasingly inadequate against quantum-enabled adversaries and advanced persistent threats targeting operational technology (OT) environments. This paper presents a comprehensive framework for implementing post-quantum cryptography (PQC) within a zero-trust architecture to secure critical infrastructure communications across control centers, substations, hospitals, and ports. Our approach integrates NIST-endorsed quantum-resistant cryptographic suites with identity-first network segmentation, authenticated SCADA protocol encryption, and continuous verification mechanisms. The proposed framework addresses the unique challenges of legacy industrial systems while providing scalable security for hybrid OT/IT environments. Through systematic analysis of current vulnerabilities and implementation strategies, this research demonstrates how a post-quantum zero-trust backbone can prevent catastrophic cyberattacks while maintaining operational continuity in critical infrastructure sectors. Keywords: Post-Quantum Cryptography; Zero-Trust Architecture; Critical Infrastructure; SCADA Security; QuantumResistant Cryptography; Industrial Control Systems 1. Introduction Critical infrastructure systems form the backbone of modern society, encompassing power grids, water treatment facilities, transportation networks, and healthcare systems. The increasing digitization and interconnectedness of these systems have created unprecedented attack surfaces that malicious actors continuously exploit (Alcaraz and Lopez, 2021). The emergence of quantum computing capabilities further exacerbates these vulnerabilities, as quantum algorithms threaten to render current cryptographic protections obsolete within the next decade (Kostenko et al., 2024). Traditional security approaches based on perimeter defense and static trust relationships are fundamentally inadequate for protecting critical infrastructure in the quantum era. The concept of zero-trust architecture (ZTA) has emerged as a paradigm shift that assumes no implicit trust and requires continuous verification of all users, devices, and network traffic (Syed et al., 2022). When combined with post-quantum cryptographic algorithms, zero-trust principles provide a robust foundation for securing critical infrastructure communications against both current and future threats. The urgency of this transformation cannot be overstated. Recent cyberattacks on critical infrastructure, including the Colonial Pipeline incident and various attacks on power grids, demonstrate the catastrophic potential of successful World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 582 breaches (Yadav and Paul, 2021). As quantum computing capabilities advance, the window for implementing quantumresistant protections continues to narrow, necessitating immediate action to safeguard critical systems. This paper presents a comprehensive framework for implementing a post-quantum zero-trust backbone that addresses five critical areas: post-quantum cryptography rollout, zero-trust network segmentation, SCADA protocol encryption, identity governance, and incident response capabilities. Our approach recognizes the unique constraints of operational technology environments, including legacy system compatibility, real-time performance requirements, and high availability demands Adeshina. (2021). 2. Literature Review and Theoretical Foundation 2.1. Zero-Trust Architecture Evolution Zero-trust architecture represents a fundamental departure from traditional castle-and-moat security models. Syed et al. (2022) provide a comprehensive analysis of ZTA principles, emphasizing the core tenets of "never trust, always verify" and "assume breach." This paradigm is particularly relevant for critical infrastructure, where the convergence of IT and OT networks creates complex attack surfaces that traditional perimeter defenses cannot adequately protect. The application of zero-trust principles to industrial environments presents unique challenges. Abulafia et al. (2023) demonstrate how ZTA can be adapted for Industrial Internet of Things (IIoT) systems, highlighting the need for specialized approaches that accommodate the unique characteristics of operational technology. Similarly, Hossain et al. (2023) explore zero-trust implementations in healthcare IoT environments, providing insights into sector-specific security requirements. 2.2. Post-Quantum Cryptography Landscape The quantum threat to cryptographic systems is well-documented and increasingly urgent. Bălaș et al. (2024) provide a comprehensive review of post-quantum cryptography options for critical systems, emphasizing the need for careful algorithm selection based on performance and security requirements. The National Institute of Standards and Technology (NIST) has standardized several quantum-resistant algorithms, including CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures. Kiktenko et al. (2024) analyze the quantum future of cybersecurity, highlighting the timeline for quantum computer capabilities and the corresponding need for cryptographic migration. Their analysis suggests that organizations must begin post-quantum transitions immediately to ensure protection against both current and future quantum threats. Naeem et al. (2024) extend this analysis to blockchain technologies, demonstrating how post-quantum algorithms can be integrated into distributed systems. 2.3. Critical Infrastructure Security Challenges Critical infrastructure security faces unique challenges that distinguish it from traditional IT security. Das et al. (2021) analyze cybersecurity requirements for energy systems, emphasizing the critical importance of SCADA communication security and encryption. Their work highlights the tension between security requirements and operational constraints such as latency sensitivity and legacy system compatibility. Yadav and Paul (2021) provide a comprehensive review of SCADA system architecture and security challenges, identifying key vulnerabilities in industrial control systems. Their analysis reveals that many critical infrastructure systems rely on legacy protocols that lack built-in security features, necessitating external security overlays to protect communications. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 583 3. Post-Quantum Cryptography Rollout Strategy 3.1. Cryptographic Inventory and Risk Assessment The first phase of post-quantum migration requires a comprehensive inventory of existing cryptographic implementations across critical infrastructure systems. This process involves identifying all cryptographic components, assessing their quantum vulnerability, and prioritizing migration based on risk and criticality. Table 1 Cryptographic Inventory Classification Framework System Type Cryptographic Usage Quantum Vulnerability Migration Priority Timeline SCADA HMI RSA-2048, AES-256 High (RSA) / Low (AES) Critical 6-12 months Substation Controllers Legacy DES, 3DES Very High Critical 3-6 months Communication Gateways ECC P-256, SHA-256 High (ECC) / Low (SHA) High 12-18 months Historian Systems RSA-2048, AES-128 High (RSA) / Low (AES) Medium 18-24 months Engineering Workstations Mixed Algorithms Variable Medium 12-24 months The migration strategy must account for the diverse cryptographic landscape found in critical infrastructure environments. Blanco-Novoa et al. (2021) emphasize the importance of systematic assessment in Industry 4.0 environments, noting that many systems utilize outdated cryptographic algorithms that provide insufficient protection against conventional attacks, let alone quantum threats Adeshina and Ndukwe, (2024). 3.2. NIST-Endorsed Algorithm Selection The selection of appropriate post-quantum algorithms requires careful consideration of performance characteristics, security levels, and implementation constraints. The NIST post-quantum cryptography standardization process has identified several promising algorithm families: • Lattice-based algorithms: CRYSTALS-Kyber (key encapsulation) and CRYSTALS-Dilithium (digital signatures) offer strong security guarantees with reasonable performance characteristics suitable for most critical infrastructure applications. • Hash-based signatures: SPHINCS+ provides conservative security assumptions but with larger signature sizes that may be problematic for bandwidth-constrained industrial networks. • Code-based algorithms: Classic McElwee offers strong security but requires large key sizes that may be impractical for resource-constrained devices. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 584 Figure 1 Post-Quantum Algorithm Performance Comparison for Critical Infrastructure 3.3. Hybrid Cryptographic Approach During the transition period, a hybrid approach combining classical and post-quantum algorithms provides defense-indepth against both conventional and quantum threats. This strategy ensures that communications remain secure even if either the classical or post-quantum component is compromised. Panarello et al. (2024) explore hybrid cryptographic implementations for networked environments, demonstrating how organizations can maintain backward compatibility while gradually introducing quantum-resistant protections. The hybrid approach is particularly valuable for critical infrastructure, where system availability requirements often preclude rapid wholesale replacements. 4. Zero-Trust Network Segmentation 4.1. Micro-Segmentation Architecture Zero-trust segmentation fundamentally reimagines network architecture by eliminating implicit trust relationships and implementing granular access controls. Chen et al. (2023) demonstrate advanced micro-segmentation techniques for software-defined industrial networks, showing how east-west traffic can be controlled through continuous verification mechanisms. The implementation of micro-segmentation in critical infrastructure environments requires careful consideration of operational requirements. Li et al. (2024) present a VLAN-VxLAN mapping approach that enables fine-grained segmentation while maintaining the performance characteristics required for industrial applications. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 585 Table 2 Network Segmentation Zones for Critical Infrastructure Zone Description Security Level Access Controls Monitoring Safety Systems Emergency shutdown, safety interlocks Maximum Hardware-enforced isolation Real-time SIEM Process Control Primary production control systems High Multi-factor authentication Continuous monitoring Supervisory SCADA HMI, historian systems High Role-based access control Behavioral analytics Engineering Configuration, maintenance systems Medium Time-limited access Session recording Business Enterprise applications Medium Standard authentication Log aggregation DMZ External communications Low Proxy-based access Deep packet inspection 4.2. Continuous Verification Mechanisms Zero-trust architecture requires continuous verification of all network communications, moving beyond traditional authentication to ongoing behavioral analysis and risk assessment. Fotiou and Polyzos (2022) explore identity-centric networking approaches that enable continuous verification while maintaining performance requirements for critical infrastructure applications. Figure 2 Continuous Verification Framework Architecture The continuous verification process encompasses multiple dimensions • Device identity verification: Hardware-bound credentials ensure that only authorized devices can access network resources. • User behavior analysis: Machine learning algorithms detect anomalous behavior patterns that may indicate compromised accounts or insider threats. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 586 • Network traffic analysis: Deep packet inspection and flow analysis identify suspicious communication patterns. • Application-level monitoring: API calls and application behaviors are continuously monitored for signs of compromise. 4.3. East-West Traffic Control Traditional security models focus primarily on north-south traffic crossing network perimeters, but the majority of data movement in modern networks occurs laterally (east-west) between systems. Chen et al. (2023) demonstrate how software-defined networking can be leveraged to implement granular controls on east-west traffic in industrial environments. The implementation of east-west traffic controls requires careful balance between security and operational requirements. Critical infrastructure systems often require low-latency communications for real-time control functions, necessitating high-performance security enforcement mechanisms that do not introduce unacceptable delays. 5. SCADA Protocol Encryption and Security 5.1. Legacy Protocol Vulnerabilities SCADA systems in critical infrastructure environments frequently rely on legacy protocols that were designed without security considerations. Abd-Elaal et al. (2022) analyze vulnerabilities in Modbus/TCP communications and demonstrate enhanced security protocols that protect against man-in-the-middle attacks. Their work highlights the fundamental security limitations of protocols designed for isolated networks that are now connected to broader IT infrastructure. Galanopoulos et al. (2021) address security challenges in DNP3 and Modbus communications through authenticated encryption gateways. Their approach demonstrates how legacy protocols can be secured without requiring wholesale replacement of existing infrastructure, a critical consideration for organizations with significant investments in legacy systems. Table 3 SCADA Protocol Security Assessment Protocol Usage Frequency Security Features Vulnerability Rating Encryption Support DNP3 45% Basic authentication Medium Limited (Secure Authentication) Modbus/TCP 35% None High None (requires tunneling) IEC 61850 15% TLS support Low-Medium Yes (TLS/SSL) EtherNet/IP 3% Basic Medium-High Limited Proprietary 2% Variable Variable Variable 5.2. Authenticated Encryption Tunnels The implementation of secure tunnels for SCADA communications provides a practical approach to protecting legacy protocols without requiring extensive system modifications. Dragomir et al. (2022) explore TLS/DTLS tunneling approaches for industrial communications, demonstrating how modern encryption can be layered over existing protocols to provide authentication, confidentiality, and integrity protection. Lopes et al. (2024) present in-line rate encrypted links specifically designed for resource-aware SCADA communications. Their approach addresses the unique performance requirements of industrial control systems while providing strong cryptographic protection that can be upgraded to post-quantum algorithms as they become available. The key considerations for implementing authenticated encryption tunnels include: • Latency constraints: Industrial control systems often require deterministic response times, necessitating encryption implementations that minimize processing delays. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 587 • Bandwidth limitations: Many industrial networks operate over constrained bandwidth connections, requiring efficient encryption approaches that minimize overhead. • Legacy system compatibility: Encryption solutions must operate transparently with existing SCADA software and hardware to avoid costly system replacements. • Key management: Automated key distribution and rotation mechanisms are essential for maintaining security across large-scale industrial deployments. Figure 3 SCADA Protocol Encryption Architecture 5.3. Performance Optimization for Real-Time Systems The implementation of encryption in real-time industrial control systems requires careful optimization to maintain required performance characteristics. Hardware acceleration of cryptographic operations can significantly reduce processing overhead, while carefully selected algorithms can minimize computational requirements without compromising security. The migration to post-quantum cryptographic algorithms introduces additional performance considerations. While algorithms like CRYSTALS-Kyber and CRYSTALS-Dilithium offer reasonable performance for most applications, their computational requirements exceed those of classical algorithms. Hardware acceleration and algorithm-specific optimizations will be crucial for maintaining real-time performance in post-quantum implementations. 6. Identity Governance and Access Management 6.1. Hardware-Bound Credentials The foundation of robust identity governance in critical infrastructure environments rests on hardware-bound credentials that provide strong device authentication. Saylam et al. (2023) explore FIDO2/Webathons implementations for industrial IoT environments, demonstrating how modern authentication standards can be adapted for operational technology applications. Nadir et al. (2022) present TPM-anchored device identity solutions specifically designed for OT networks. Their approach leverages Trusted Platform Module (TPM) capabilities to create unforgeable device identities that form the basis for zero-trust verification. This hardware-bound approach is particularly important in critical infrastructure environments where device compromise could have catastrophic consequences. The implementation of hardware-bound credentials addresses several critical security challenges: World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 588 • Device spoofing prevention: Cryptographic device identities anchored in hardware cannot be easily replicated or transferred to unauthorized devices. • Supply chain security: Hardware-bound credentials enable verification of device authenticity and integrity throughout the supply chain. • Credential theft resistance: Private keys stored in secure hardware elements cannot be extracted through software-based attacks. • Scalable device management: Automated enrollment and management processes reduce the operational burden of maintaining device credentials across large industrial deployments. 6.2. Multi-Factor Authentication Implementation The implementation of multi-factor authentication (MFA) in critical infrastructure environments requires careful consideration of operational constraints and emergency access requirements. Zarca et al. (2022) explore continuous authentication mechanisms for 5G-enabled critical infrastructures, demonstrating how adaptive authentication can balance security requirements with operational needs. Table 4 MFA Implementation Framework for Critical Infrastructure User Role Primary Factor Secondary Factor Emergency Access Session Duration Control Room Operator Hardware token Biometric Supervisor override 8 hours Field Technician Mobile app SMS/Voice Emergency PIN 4 hours Maintenance Engineer Smart card Push notification Time-limited token 2 hours Emergency Responder Biometric Location verification Incident commander 1 hour System Administrator Hardware token Biometric + approval Security team override 30 minutes The MFA implementation must account for the unique operational requirements of critical infrastructure • Emergency access procedures: During emergencies, standard authentication procedures may be impractical, requiring carefully designed emergency access mechanisms that maintain security while enabling rapid response. • Shared workstation considerations: Many industrial environments utilize shared workstations, requiring session management approaches that protect against unauthorized access while supporting operational workflows. • Offline operation capabilities: Critical infrastructure systems must continue operating during network outages, necessitating authentication mechanisms that can function without continuous connectivity to central systems. 6.3. Automated Entitlement Reviews Automated entitlement review processes are essential for maintaining appropriate access controls across large critical infrastructure deployments. These systems continuously monitor user access patterns, identify excessive privileges, and enforce least-privilege principles through automated policy enforcement. The implementation of automated entitlement reviews involves several key components • Role-based access control (RBAC): Standardized roles and permissions simplify access management and enable automated review processes. • Behavioral analytics: Machine learning algorithms analyze user behavior patterns to identify anomalous access attempts or privilege escalation indicators. • Temporal access controls: Time-limited access grants ensure that elevated privileges are automatically revoked when no longer needed. • Approval workflows: Automated approval processes route access requests to appropriate authorities while maintaining audit trails for compliance purposes. World Journal of Advanced Research and Reviews, 2025, 27(03), 581–595 589 Figure 4 Identity Governance Architecture 7. Incident Response and Automated Containment 7.1. Playbook Development and Tabletop Exercises Effective incident response in critical infrastructure environments requires comprehensive playbooks that address the unique challenges of operational technology systems. Shafiq et al. (2023) present detailed frameworks for incident response in industrial control systems, emphasizing the importance of regular tabletop exercises and automated containment mechanisms. The development of incident response playbooks must account for the critical nature of infrastructure systems and the potential for cascading failures. Unlike traditional IT environments where systems can be taken offline for investigation, critical infrastructure often requires continued operation even during active incidents. Table 5 Incident Response Playbook Framework Incident Type Detection Method Initial Response Containment Strategy Recovery Timeline Malware Infection Behavioral analytics Isolate affected systems Network segmentation 2-6 hours Credential Compromise Authentication anomalies Disable accounts Forced reauthentication 1-2 hours Protocol Manipulation Traffic analysis Communication blocking Protocol filtering 30 minutes - 2 hours Physical Intrusion Access control alerts Security response Area isolation 1-4 hours Supply Chain Attack Integrity monitoring System quarantine Vendor verification 6-24 hours