Quantum resilience in critical infrastructures: cryptographic agility versus legacy hardware obsolescence
DOI:
https://doi.org/10.24054/rcta.v2i48.4366Keywords:
critical infrastructures, cyber-physical resilience, cyber-physical systems, cybersecurity, industrial control systems, ontologies, operational technology, post-quantum cryptography, quantum eraAbstract
Context: Quantum computing represents an emerging and increasingly relevant threat to the security of Cyber-Physical Systems (CPS) in critical infrastructure (CI), potentially compromising current cryptographic methods and exposing essential services to significant physical risks. Objective: This study analyzes the impact of the quantum threat on CPS and CI to identify semantic and technical requirements that underpin ontological assessment models and operational resilience strategies. Method: A systematic literature review (SLR) was conducted for the period 2020–2026 following the PRISMA and Kitchenham protocols. Through a parameterized search in high-impact databases, 39 primary studies were selected and analyzed. Results: A relevant systemic incompatibility was identified: a significant proportion of the analyzed studies report that legacy hardware (PLCs and RTUs) presents critical limitations in supporting the computational load of the new Post-Quantum Cryptography (PQC) standards. This limitation tends to generate operational latencies that could compromise the system's theoretical resilience against retrospective decryption and spoofing attacks. Conclusions: The evidence reviewed suggests that the effectiveness of defense frameworks could be compromised without a structural upgrade of Operational Technology (OT), as the mismatch between obsolete hardware and quantum mathematical rigor was identified as one of the weakest links in the infrastructure. The findings indicate that the operational resilience of CI would be strengthened through migration toward cryptographic agility and the adoption of ontological models that enable automated reasoning for real-time threat detection.
Downloads
References
R. Yan, Y. Wang, J. Dai, Y. Xu, and A. Q. Liu, “Quantum-Key-Distribution-Based Microgrid Control for Cybersecurity Enhancement,” IEEE Trans. Ind. Appl., vol. 58, no. 3, pp. 3076–3086, 2022, doi: 10.1109/TIA.2022.3159314.
A. Alabdulatif, “FedCognis: An Adaptive Federated Learning Framework for Secure Anomaly Detection in Industrial IoT-Enabled Cognitive Cities,” Saudi Arabia, Sep. 2025. doi: https://doi.org/10.32604/cmc.2025.066898.
A. Babar, T. Halabi, and M. Zulkernine, “Autonomous and Adaptive Cyber Incident Detection and Response in Industrial Cyber-Physical Systems using Hierarchical Reinforcement Learning,” ACM Transactions on Cyber-Physical Systems, Jan. 2025, doi: 10.1145/3765622.
Y. Baseri, V. Chouhan, A. Ghorbani, and A. Chow, “Evaluation framework for quantum security risk assessment: A comprehensive strategy for quantum-safe transition,” Comput. Secur., vol. 150, Mar. 2025, doi: 10.1016/j.cose.2024.104272.
R. Iqbal, M. Afzaal, and G. Rathee, “Hybrid and adaptive framework for secure and scalable authentication in healthcare IoT,” Array, vol. 28, Dec. 2025, doi: 10.1016/j.array.2025.100527.
A. K. Kar, W. He, F. C. Payton, V. Grover, A. S. Al-Busaidi, and Y. K. Dwivedi, “How could quantum computing shape information systems research – An editorial perspective and future research directions,” Feb. 01, 2025, Elsevier Ltd. doi: 10.1016/j.ijinfomgt.2024.102776.
A. H. El-Kady, S. Halim, M. M. El-Halwagi, and F. Khan, “Analysis of safety and security challenges and opportunities related to cyber-physical systems,” Process Safety and Environmental Protection, vol. 173, pp. 384–413, May 2023, doi: 10.1016/j.psep.2023.03.012.
M. Bandaru, S. E. Mathe, and C. Wattanapanich, “Evaluation of hardware and software implementations for NIST finalist and fourth-round post-quantum cryptography KEMs,” Dec. 01, 2024, Elsevier Ltd. doi: 10.1016/j.compeleceng.2024.109826.
M. Lezzi, P. Montefusco, M. Lazoi, and A. Corallo, “AI-based cybersecurity for a sustainable digital industry: Systematic literature review and future research directions,” Nov. 01, 2025, Elsevier B.V. doi: 10.1016/j.jii.2025.100980.
D. Lakshmi, N. Nagpal, S. Chandrasekaran, and J. H. D., “A quantum-based approach for offensive security against cyber attacks in electrical infrastructure,” Appl. Soft Comput., vol. 136, Mar. 2023, doi: 10.1016/j.asoc.2023.110071.
D. Verchyk and J. Sepúlveda, “A practical study of post-quantum enhanced identity-based encryption,” Microprocess. Microsyst., vol. 99, Jun. 2023, doi: 10.1016/j.micpro.2023.104828.
M. T. Naz, W. Elmedany, and M. Ali, “Securing SCADA systems in smart grids with IoT integration: A Self-Defensive Post-Quantum Blockchain Architecture,” Internet of Things (The Netherlands), vol. 28, Dec. 2024, doi: 10.1016/j.iot.2024.101381.
C. Mangla, S. Rani, N. M. Faseeh Qureshi, and A. Singh, “Mitigating 5G security challenges for next-gen industry using quantum computing,” Journal of King Saud University - Computer and Information Sciences, vol. 35, no. 6, Jun. 2023, doi: 10.1016/j.jksuci.2022.07.009.
S. K. Singh et al., “Quantum-Resistant Cryptographic Primitives Using Modular Hash Learning Algorithms for Enhanced SCADA System Security,” Computers, Materials and Continua, vol. 84, no. 2, pp. 3927–3941, 2025, doi: 10.32604/cmc.2025.059643.
R. Pal, R. X. Sequeira, X. Yin, S. Zeijlemaker, and V. Kotala, “How Should Enterprises Quantify and Analyze (Multi-Party) APT Cyber-Risk Exposure in their Industrial IoT Network?,” ACM Trans. Manag. Inf. Syst., Oct. 2023, doi: 10.1145/3605949.
C. Ma, A. Shankar, S. Kumari, and C. M. Chen, “A lightweight BRLWE-based post-quantum cryptosystem with side-channel resilience for IoT security,” Internet of Things (The Netherlands), vol. 28, Dec. 2024, doi: 10.1016/j.iot.2024.101391.
I. H. Sarker, H. Janicke, M. A. Ferrag, and A. Abuadbba, “Multi-aspect rule-based AI: Methods, taxonomy, challenges and directions towards automation, intelligence and transparent cybersecurity modeling for critical infrastructures,” Apr. 01, 2024, Elsevier B.V. doi: 10.1016/j.iot.2024.101110.
Z. Turk, B. García de Soto, B. R. K. Mantha, A. Maciel, and A. Georgescu, “A systemic framework for addressing cybersecurity in construction,” Autom. Constr., vol. 133, Jan. 2022, doi: 10.1016/j.autcon.2021.103988.
D. Allison, K. McLaughlin, and P. Smith, “Goosewolf: An Embedded Intrusion Detection System for Advanced Programmable Logic Controllers,” Digital Threats: Research and Practice, vol. 4, no. 4, Oct. 2023, doi: 10.1145/3617692.
C. I. Okafor, L. A. C. Ahakonye, J. M. Lee, and D.-S. Kim, “PureQuantum: Towards A Scalable Blockchain Channel Security in IoT Networks,” Blockchain: Research and Applications, p. 100372, Aug. 2025, doi: 10.1016/j.bcra.2025.100372.
B. Kitchenham and P. Brereton, “A systematic review of systematic review process research in software engineering,” Inf. Softw. Technol., vol. 55, no. 12, pp. 2049–2075, Dec. 2013, doi: 10.1016/j.infsof.2013.07.010.
M. J. Page et al., “The PRISMA 2020 statement: An updated guideline for reporting systematic reviews,” Mar. 29, 2021, BMJ Publishing Group. doi: 10.1136/bmj.n71.
P. R. Babu, S. A. P. Kumar, A. G. Reddy, and A. K. Das, “Quantum secure authentication and key agreement protocols for IoT-enabled applications: A comprehensive survey and open challenges,” Nov. 01, 2024, Elsevier Ireland Ltd. doi: 10.1016/j.cosrev.2024.100676.
A. M. Aslam, A. Bhardwaj, and R. Chaudhary, “Quantum-resilient blockchain-enabled secure communication framework for connected autonomous vehicles using post-quantum cryptography,” Vehicular Communications, vol. 52, Apr. 2025, doi: 10.1016/j.vehcom.2025.100880.
S. Sadeghi, V. Chouhan, M. Aldarwbi, A. Ghorbani, A. Chow, and R. Burko, “Securing financial sector applications in the quantum era: a comprehensive evaluation of NIST’s recommended algorithms through use-case analysis,” Expert Syst. Appl., vol. 288, Sep. 2025, doi: 10.1016/j.eswa.2025.128243.
P. Singh, S. Sirpal, and O. Pal, “Cyber resilience in e-governance: A review of strategies, challenges, and directions,” Sep. 01, 2025, Elsevier B.V. doi: 10.1016/j.iot.2025.101702.
L. Liyanage, N. A. G. Arachchilage, and G. Russello, “SoK: Identifying Limitations and Bridging Gaps of Cybersecurity Capability Maturity Models (CCMMs),” arXiv preprint arXiv:2408.16140, 2024.
S. Mohanan and N. Parameswaran, “FINER criteria – What does it mean?,” Cosmoderma, vol. 2, p. 115, Nov. 2022, doi: 10.25259/csdm_123_2022.
J. Lamp, C. E. Rubio-Medrano, Z. Zhao, and G. J. Ahn, “ExSol: Collaboratively assessing cybersecurity risks for protecting energy delivery systems,” Digital Threats: Research and Practice, vol. 2, no. 3, Jun. 2021, doi: 10.1145/3428156.
S. Y. Moon, B. H. Jo, A. El Azzaoui, S. K. Singh, and J. H. Park, “Edge-Fog Enhanced Post-Quantum Network Security: Applications, Challenges and Solutions,” 2025, Tech Science Press. doi: 10.32604/cmc.2025.062966.
O. O. Tooki and O. M. Popoola, “A critical review on intelligent-based techniques for detection and mitigation of cyberthreats and cascaded failures in cyber-physical power systems,” Oct. 01, 2024, Elsevier Ltd. doi: 10.1016/j.ref.2024.100628.
I. Kong, M. Janssen, and N. Bharosa, “Realizing quantum-safe information sharing: Implementation and adoption challenges and policy recommendations for quantum-safe transitions,” Gov. Inf. Q., vol. 41, no. 1, Mar. 2024, doi: 10.1016/j.giq.2023.101884.
Monika and S. K. Sood, “A scientometric analysis of quantum driven innovations in intelligent transportation systems,” Dec. 01, 2024, Elsevier Ltd. doi: 10.1016/j.engappai.2024.109258.
R. Alguliyev, R. Aliguliyev, and L. Sukhostat, “An approach for assessing the functional vulnerabilities criticality of CPS components,” Cyber Security and Applications, vol. 3, Dec. 2025, doi: 10.1016/j.csa.2024.100058.
A. Wicaksana, “A survey on quantum-safe blockchain security infrastructure,” Aug. 01, 2025, Elsevier Ireland Ltd. doi: 10.1016/j.cosrev.2025.100752.
U. Song, G. Hur, S. Lee, and J. Park, “Unraveling the dynamics of the cyber threat landscape: Major shifts examined through the recent societal events,” Sustain. Cities Soc., vol. 103, Apr. 2024, doi: 10.1016/j.scs.2024.105265.
V. Vasani, K. Prateek, R. Amin, S. Maity, and A. D. Dwivedi, "Embracing the quantum frontier: Investigating quantum communication, cryptography, applications and future directions," J. Ind. Inf. Integr., vol. 39, 2024, doi: 10.1016/j.jii.2024.100594.
J. Ahmad, M. Rizwan, S. F. Ali, U. Inayat, H. A. Muqeet, M. Imran, and T. Awotwe, "Cybersecurity in smart microgrids using blockchain-federated learning and quantum-safe approaches: A comprehensive review," Appl. Energy, vol. 393, 2025, doi: 10.1016/j.apenergy.2025.126118.
A. A. Abd El-Latif, B. Abd-El-Atty, I. Mehmood, K. Muhammad, S. E. Venegas-Andraca, and J. Peng, "Quantum-Inspired Blockchain-Based Cybersecurity: Securing Smart Edge Utilities in IoT-Based Smart Cities," Inf. Process. Manage., vol. 58, no. 4, Jul. 2021, doi: 10.1016/j.ipm.2021.102549.
K. Jain and A. Singh, "IHKEM: A post-quantum ready hierarchical key establishment and management scheme for wireless sensor networks," Microprocess. Microsyst., vol. 118, Sep. 2025, doi: 10.1016/j.micpro.2025.105205.
M. M. Moslehi, "Exploring coverage and security challenges in wireless sensor networks: A survey," Comput. Netw., vol. 260, Feb. 2025, doi: 10.1016/j.comnet.2025.111096.
F. Trungadi, M. Fabiano, D. Aloisio, G. Brunaccini, F. Sergi, G. Merlino, and F. Longo, "Securing Modbus in legacy industrial control systems: A decentralized approach using proxies, Post-Quantum Cryptography and Self-Sovereign Identity," J. Inf. Secur. Appl., vol. 94, Nov. 2025, doi: 10.1016/j.jisa.2025.104199.
S. Soleimani, A. Afshar, and H. Atrianfar, "Critical component analysis of cyber-physical power systems in cascading failures using graph convolutional networks: An energy-based approach," Sustain. Energy Grids Netw., vol. 42, Jun. 2025, doi: 10.1016/j.segan.2025.101653.
National Institute of Standards and Technology (NIST), “Module-Lattice-Based Key-Encapsulation Mechanism Standard,” Federal Information Processing Standards (NIST FIPS), NIST FIPS 203, Gaithersburg, MD, USA, Aug. 2024, doi: 10.6028/NIST.FIPS.203.
National Institute of Standards and Technology (NIST), "Module-Lattice-Based Digital Signature Standard," Fed. Inf. Process. Stds. (NIST FIPS), NIST FIPS 204, Gaithersburg, MD, USA, Aug. 2024, doi: 10.6028/NIST.FIPS.204.
National Institute of Standards and Technology (NIST), "Stateless Hash-Based Digital Signature Standard," Fed. Inf. Process. Stds.(NIST FIPS), NIST FIPS 205, Gaithersburg, MD, USA, Aug. 2024, doi: 10.6028/NIST.FIPS.205.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Katerine Marceles Villalba, Siler Amador Donado, César Jesús Pardo Calvache
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
