DIGITAL TWIN-DRIVEN POST-QUANTUM CRYPTOGRAPHIC MIGRATION FOR SMART GRID CRITICAL INFRASTRUCTURE: A SIMULATION-BASED PROOF-OF-CONCEPT FRAMEWORK

Abstract

The prospective arrival of a cryptanalytically relevant quantum computer (CRQC) threatens the asymmetric primitives that protect smart grid communications, protection signalling and identity assertions. Migration to the NIST-standardised post-quantum cryptography (PQC) suite — ML-KEM (FIPS 203) and ML-DSA (FIPS 204) — is unavoidable, but distribution substations cannot be taken offline, intelligent electronic devices (IEDs) operate under millisecond-class deadlines, and PQC key, ciphertext and signature sizes invalidate protocol assumptions embedded in IEC 61850 and DNP3 Secure Authentication. This paper proposes and evaluates TwinPQC, a digital-twin framework in which a cyber-physical replica of a distribution substation is used to simulate, validate and stage PQC adoption before any physical deployment. The environment integrates OpenDSS power simulation, ns-3 network emulation, QEMU-virtualised ARM-class IED firmware and a crypto-agility broker built on the Open Quantum Safe stack. Four cryptographic configurations are evaluated over 480 simulation runs on the IEEE 13-bus and 34-bus distribution feeders. Relative to the classical baseline, the hybrid X25519+ML-KEM-768 / ECDSA+ML-DSA-65 configuration increases MMS association latency by 52.0 ± 1.4 % and GOOSE publication latency from 0.80 ± 0.04 ms to 2.10 ± 0.12 ms, retaining 97.2 % IEC 61850 Type 1A compliance on Cortex-A53 IEDs. On the emulated 120 MHz Cortex-M4 profile, Type 1A compliance falls to 62.4%, and peak heap allocation reaches 148.2 ± 1.8 KB. A frame-level analysis shows that the dominant obstacle for GOOSE is not queueing delay, which contributes under 3 µs on a 1 Gbit/s station bus, but the fact that a 3,501-byte authentication object cannot be carried in a single IEC 61850-8-1 GOOSE frame. A comparison against published pqm4 Cortex-M4 cycle counts further shows that ML-DSA-44 signing alone requires approximately 32.9 ms at 120 MHz, so the emulated constrained-device results must be read as an optimistic bound rather than a timing measurement. The twin flags migration and adversarial faults on 88 to 98 % of injected episodes per scenario, against 0 to 45 % for isolated bench testing, using deterministic predicates that policy-conforming benign traffic cannot satisfy for three of the four scenarios. A five-stage migration playbook with explicit go/no-go criteria and a rollback path is derived from these results.