PQ-OTSec: a post-quantum secure key exchange framework for Operational Technology protocols
Year: 2026
Type: conference-paper
Abstract: Security mechanisms for Operational Technology (OT) protocols like Modbus/TCP Security, DNP3-SAv6 and Profinet Security protect the underlying protocols that govern how industrial automation systems communicate. However, these solutions are dependent on classical cryptography and lack the agility to withstand the emerging threat posed by quantum computing, which breaks or weakens classical cryptography. Furthermore, the increasing sophistication of classical cyberattacks on industrial control systems, as evidenced by the recent Polish power grid incident of December 2025, shows the growing capabilities of adversaries. When considered alongside the anticipated capabilities of quantum computing, this necessitates the development of robust and future-resilient security mechanisms for OT nvironments. In this paper, we present PQOTSec, a protocol-agnostic, post-quantum (PQ) secure overlay that enables mutual authentication and secure key exchange without modifying the existing protocol structure. Our framework employs NIST-standardised ML-DSA for authentication and ML-KEM for key establishment and achieves confidentiality, integrity, availability, and authenticity in PQ settings. We assess the security of our framework using the AVISPA tool and demonstrate its applicability by overlaying it onto Modbus/TCP. In our experiment, the framework shows better performance than Modbus/TCP Security, making it suitable for deployment in OT environments. We finally use PQ-OTSec to mitigate the vulnerabilities exploited in the Polish power grid attack, as well as protect against future quantum threats
Institution: University of Greenwich
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7212412992