Leveraging PQC and Blockchain for Secure and Verifiable SDN Controller Communication

In multi-domain Software Defined Networking (SDN) environments, inter-controller communication is essential for coordinated decision-making and consistent operation across administrative boundaries. These exchanges involve sensitive control-plane data requiring strong guarantees of authenticity and confidentiality. However, traditional cryptographic mechanisms such as RSA and ECC are increasingly vulnerable to quantum attacks, threatening the long-term security of SDN systems. Recent advances in Post-Quantum Cryptography (PQC) offer promising alternatives, with CRYSTALS-Dilithium and CRYSTALS-Kyber emerging as leading candidates for digital signatures and encryption, respectively. In parallel, permissioned blockchain technologies have gained traction as decentralized, tamper-proof ledgers for enforcing trust in SDN environments. Yet, the integration of PQC and blockchain for secure SDN communication remains largely unexplored. To address this gap, a novel system is proposed that combines PQC and blockchain to enable secure and verifiable communication between SDN controllers. Each controller uses a Dilithium-based signature keypair for authentication and a Kyber-based encryption keypair for confidentiality, with public keys stored on-chain to establish decentralized trust. SDN controller messages are encrypted using Kyber, signed with Dilithium, and recorded on the blockchain in an encrypted format. Key innovations of the design include the execution of Dilithium signature verification directly on-chain through smart contract logic, enabling decentralized and auditable validation, and a blockchain-based mechanism for securely distributing Kyber public keys, eliminating reliance on external key exchange infrastructure. The feasibility and performance of the proposed approach are evaluated, demonstrating its potential for implementation in SDN deployments facing quantum-era threats.