IJNSA 03
ADAPTIVE POST-QUANTUM ZERO TRUST FRAMEWORK FOR CLOUD INFRASTRUCTURE: A
POLICY-BASED CRYPTO-AGILITY MODEL AND BENCHMARK-DRIVEN PERFORMANCE EVALUATION
Ali Rasool Bakhsh
Nour Internet Company for Telecommunications and Information Technology, Riyadh,
Saudi Arabia
ABSTRACT
The emergence of quantum computing poses a significant threat to the cryptographic foundations that secure modern cloud infrastructures. Existing deployments of Zero Trust Architecture (ZTA) are largely built on classical cryptographic techniques such as the RSA algorithm and elliptic curve cryptography, which are vulnerable to future quantum attacks. Moreover, current studies offer limited guidance on how PQC can be integrated into cloud-native Zero Trust environments while guaranteeing operational efficiency and addressing adaptive security needs. The present study introduces an Adaptive Post Quantum Zero Trust (Adaptive PQC-ZT) Framework by combining the NIST recommended post quantum cryptographic algorithms with a policy based Crypto-Agility Engine for algorithm dynamic selection based upon Security Sensitivity, Algorithm Characteristics, and Latency. The framework was evaluated using a publicly available PQC benchmark dataset containing 37,004 key encapsulation mechanism (KEM) records and 71,456 digital signature records. The analysis examined latency, communication overhead, security levels, and workload suitability for ML-KEM and ML-DSA algorithm families across representative cloud deployment scenarios. The results demonstrate that ML-KEM algorithms provide quantum-resistant key establishment with sub-millisecond latency, while ML-DSA algorithms significantly outperform SPHINCS+ variants in execution efficiency and communication overhead. The proposed Crypto-Agility Engine helps match cryptographic configuration with the needs of different workloads. This allows web applications to run with low latency, while also giving stronger protection to high-security systems such as financial databases. The proposed framework contributes a unified cloud-native security model that blends Zero Trust principles, post-quantum cryptography, benchmark-driven evaluation, and adaptive crypto-agility. This shows practical migration to quantum-safe cloud infrastructures can be done with manageable performance hits. Organizations get a solid path to boost their long-term defense against future quantum threats.
KEYWORDS
Post-Quantum Cryptography, Zero Trust Architecture, Cloud Security, Crypto-Agility, ML-KEM, ML-DSA, Quantum-Safe Networking, Cloud Infrastructure Security, Benchmark Analysis, Quantum-Resilient Computing
1. INTRODUCTION
The rapid evolution of quantum computinghas raised a fundamental threat to cryptographic security underpinning today’s cloud computing infrastructures. Modern public-key cryptographic systems such as Rivest–Shamir–Adleman (RSA) and Elliptic Curve Cryptography (ECC) are based on so-called intractable problems, namely computational problems that are believed to be too difficult for classical computers. However, Shor’s algorithm showed that an efficient quantum computer could break the integer factorization and discrete log problems in polynomial time, which would render many commonly used asymmetric cryptographic systems insecure (Shor, 1997). Simultaneously Grover’s algorithm is a quadratic speedup for brute-force attacks on symmetric cryptographic primitives, decreasing the effective security parameter of the traditional encryption methods (Grover, 1996). While such large-scale fault-tolerant quantum computers that can crack the existing cryptographic systems are not yet practical, it is no longer just a possibility. Adversaries can already capture and store encrypted communications today with the intention of decrypting them in the future when quantum capabilities become available. This strategy, commonly known as Harvest Now, Decrypt Later (HNDL), poses a significant risk to sensitive information requiring long-term confidentiality, including financial records, healthcare data, government communications, and intellectual property (Campagna et al., 2015; Mosca, 2018).
The cloud environment in particular is very vulnerable to these new risks, as it heavily depends on classical cryptographic techniques for security, user and service authentication, and trust enforcement on distributed infrastructure. Cryptographic algorithms are used in transport layer security (TLS) and certificate-based authentication, mutual TLS (mTLS), identity federation
protocols, application programming interfaces (APIs), and service mesh architectures, all of which may be vulnerable in a post-quantum era (Sikeridis et al., 2020). Any compromise of these mechanisms would not only impact external communication, but could also impact internal trust relationships across cloud infrastructures, such as east-west traffic between microservices, orchestration platforms, and control-plane components. As a result, cloud operators are tasked with ensuring operational efficiency while at the same time investing in getting ready for quantum-resistant security architectures.
In addition to cryptographic issues, cloud infrastructures have a particular set of security problems that make it difficult to implement effective protection measures. Multi-tenancy involves sharing resources, including physical resources, between multiple organizations, which can lead to isolation failures, side-channel attacks, privilege escalation incidents (Saxena & Rekha, 2023). Network boundaries and communication paths are continually changing, whether in the form of dynamic resource allocation, elastic scaling, or containerized workloads, and static trust assumptions are becoming less effective with these shifts (Creane & Gupta, 2022). In addition, with the rise of cloud-native apps providing massive amounts of east-west traffic between internal services, there are a ton of opportunities for lateral movement if one workload is compromised (Noormohammadpour & Raghavendra, 2018). Traditional perimeter-based security models that rely on the idea that after an external threat is filtered off the internal network can be trusted are therefore no longer adequate in today’s cloud environment where workloads, users, devices, and services interact across highly distributed infrastructures.
To address these challenges, Zero Trust Architecture (ZTA) has emerged as a dominant security paradigm for modern enterprise and cloud environments. Formalized in NIST Special Publication 800-207, Zero Trust is founded on the principle of “never trust, always verify,” eliminating implicit trust based on network location or ownership (Rose et al., 2020). Instead, every access request is continuously evaluated according to contextual factors such as user identity, device posture, workload characteristics, and behavioral indicators. Core concepts of Zero Trust are continuous authentication and authorization, least-privilege access control, micro-segmentation and assuming that breaches may already exist within the environment (Kindervag, 2010). These ideas have also been demonstrated in practice, for example, BeyondCorp by Google, which aims to move the security enforcement away from network boundaries and towards identity-centric policy controls (Ward & Beyer, 2014). Although Zero Trust is used in practice, the actual deployments are reliant on traditional cryptographic techniques such as RSA, ECC, ECDHE and traditional certificate infrastructures. As a result, existing Zero Trust deployments remain vulnerable to future quantum-enabled attacks even though their architectural principles remain valid.
Given these risks, substantial research has been put into developing and standardizing postquantum cryptography (PQC). The National Institute of Standards and Technology (NIST) has adopted ML-KEM for key encapsulation, ML-DSA for digital signatures, and SLH-DSA as a stateless hash-based signature scheme (NIST, 2024a, 2024b, 2024c), respectively, through an extensive multi-year evaluation process. The algorithms are developed to be resistant to both classical and quantum attacks, and are suitable for implementation in existing communication systems. The industry uptake has also been accelerating via Open Quantum Safe (liboqs), hybrid TLS implementations and large-scale testing by cloud providers and network operators such as Cloudflare. These advancements show that post-quantum migration is possible but also reveal some difficulties with respect to computational overhead, interoperability, deployment complexity, and selecting algorithms for various workload environments. Furthermore, the shift from classical cryptographic infrastructures to quantum-resistant cryptographic systems demands crypto-agility, that is, the capability to easily switch, upgrade, and support several cryptographic algorithms as standards shift and security needs vary (Barker et al., 2021). Crypto-agility is gaining momentum as an essential demand for organizations ready to transition to post-quantum security, especially in cloud settings with various workloads and requirements.
Recent studies have explored various aspects of integrating PQC into cloud and network security architectures. Research on PQC-enabled TLS has demonstrated the operational feasibility of quantum-resistant key exchange and authentication mechanisms (Paquin et al., 2020). Other studies have proposed Zero Trust extensions for edge computing environments and federated trust frameworks for distributed systems (Autry et al., 2024; Hussain et al., 2024). However, several important limitations remain. First, most existing approaches evaluate PQC algorithms in isolation rather than integrating them into comprehensive Zero Trust architectures for cloud infrastructures. Second, current studies rarely consider workload-aware algorithm selection despite the significant performance differences among PQC schemes. Third, limited research has examined crypto-agility mechanisms capable of dynamically selecting cryptographic algorithms according to operational requirements, risk levels, and latency constraints. Finally, benchmarkdriven evaluations that connect PQC performance characteristics with practical cloud deployment scenarios remain relatively scarce.
These limitations reveal a significant research gap at the intersection of post-quantum cryptography, Zero Trust networking, and cloud infrastructure security. Existing frameworks generally provide static cryptographic configurations, lack workload-sensitive adaptation mechanisms, and offer limited guidance for organizations transitioning from classical cryptography toward quantum-resistant environments. Consequently, there is a need for a cloudnative framework that combines Zero Trust principles with post-quantum cryptographic protection while enabling practical and policy-driven crypto-agility.
To address these challenges, this study proposes an Adaptive Post-Quantum Zero Trust Framework for Cloud Infrastructure that incorporates a policy-based Crypto-Agility Engine capable of selecting appropriate cryptographic configurations according to workload characteristics, security requirements, and operational constraints. The framework integrates Zero Trust principles with NIST-standardized post-quantum algorithms while maintaining flexibility for hybrid migration scenarios.
The primary contributions of this paper are summarized as follows:
- Adaptive Post-Quantum Zero Trust Framework: A cloud-oriented Zero Trust architecture incorporating a policy-driven Crypto-Agility Engine that supports dynamic selection of post-quantum cryptographic mechanisms.
- Workload-Aware Crypto-Agility Model: A structured decision model that aligns workload characteristics, security sensitivity, and latency requirements with suitable PQC algorithm configurations.
