PQ-NEXT Core: The Pilot Edition-Motor Oil Hellas
Discover the PQ-NEXT Pilots
The PQ-NEXT solutions will be validated through large-scale pilots across the finance, critical infrastructure, telecommunications, and digital identity sectors, leveraging selected digital twin use cases. Throughout this blog series, we will take a closer look at each pilot, exploring its objectives, implementation, expected outcomes, and its role in advancing the transition to post-quantum security.
The Motor Oil Hellas Pilot
Pilot 3: Application of Quantum Resistant Crypto to Critical Infrastructure deployments
The Pilot
Pilot 3 “Application of Quantum-Resistant Cryptography to Critical Infrastructure deployments” is led by Motor Oil, with NCSR Demokritos, INDRA, Telefónica Innovación Digital and AFCEA as contributors. Its scope is to demonstrate how post-quantum cryptography can secure operational technology, smart metering and energy-network components in a representative refinery and energy critical-infrastructure environment. To do this safely, the pilot is built around a digital twin of Motor Oil’s testbed, a parallel, production-like environment in which hybrid PQC can be deployed, exercised and measured without any risk to live operations.
The Why
What is the problem the pilot will address, the sector motivation, and the quantum threat rationale?
Critical infrastructure depends on classical public-key cryptography (such as RSA and elliptic-curve) to protect VPNs, firmware updates, authentication and the exchange of sensitive operational data. A future cryptographically-relevant quantum computer would break these schemes, and because operational data and assets have very long lifetimes, the “harvest-now, decrypt-later” risk makes the threat effectively present today. For the energy sector the stakes are high: disruption to essential services has wide societal impact, and obligations such as NIS2 raise the bar for resilience. At the same time, operators cannot simply switch cryptography on live systems, because availability and safety must be preserved at all times. Pilot 3 addresses exactly this gap and it provides a safe, representative environment in which Motor Oil, as an industrial operator, can confront the quantum threat early and plan a controlled migration.
The How
The technical approach, deployment environment, tools, and expected outcomes
The technical approach is to reproduce Motor Oil’s critical-infrastructure network as a digital twin, replicating the real communication paths, routers, firewalls and field devices, including the PLC, the SCADA monitoring system, the Historian database, the pressure sensors and the smart-metering components. Within this environment we deploy hybrid post-quantum cryptography, combining CRYSTALS-Kyber for key establishment and CRYSTALS-Dilithium for digital signatures alongside classical algorithms. The deployment is implemented over StrongSwan (an IPsec-based VPN) using the liboqs library across the relevant application protocols, with the PQ-NEXT toolbox providing the cryptographic support to the OT components.
Three operational use cases are exercised: reading data from the field sensors, sending commands to the pump, and importing or exporting logs to and from the Historian. For each, we assess quality, latency, scalability and energy consumption against two headline KPIs, keeping the additional communication latency introduced by PQC below 50 ms for key exchanges and firmware updates, and supporting at least a 20% increase in the number of devices without performance degradation. The expected outcomes are validated, quantitative evidence that hybrid PQC can run in an OT environment with acceptable operational impact, together with reusable deployment profiles, a KPI methodology and lessons learned. These feed the project’s validation and simulation suite and its network-security enablers, and inform best practice for the wider critical-infrastructure sector.