asoc. Site1 / 11ASOC deployment architecture patterns00:00ASOC Reference Architecture · Slide 1 of 2
ASOC Reference Architecture · Post-quantum extension
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · portfolio thesis
A vendor upgrade can make a component PQC capable. It does not prove that the organization’s real traffic paths are PQC protected.
PQC migration often gets reduced to a software replacement program: update libraries, firmware, HSMs, operating systems, and appliances.
The hard question remains: which communications negotiated safe cryptography, which paths fell back to classical algorithms, and who accepted the residual risk?
ASOC turns post-quantum migration into observed evidence, validated claims, and governed response.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · crypto baseline
PQC changes the public-key algorithms used for key establishment and signatures. Bulk encryption still relies on fast symmetric cryptography such as AES.
The practical question sits inside each handshake and each trust boundary: what algorithm was negotiated, what certificate authenticated the peer, and does that match policy for this path?
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · handshake mechanics
A connection can have strong key establishment and still authenticate the wrong party. PQC migration must cover both shared secrets and identity binding.
Two systems derive shared secret material that feeds symmetric session encryption.
Current: ECDHEPQC target: ML-KEM or hybrid KEMA certificate and signature bind the public key to an identity and prove private-key possession.
Current: RSA and ECDSAPQC target: ML-DSA or SLH-DSA where the ecosystem supports itSecure records negotiated key establishment, certificate chain, signature algorithm, endpoint identity, and source of observation. Assure replays whether that evidence supports the claim. SOAR acts only after policy and owner approval.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · vendor-upgrade gap
A server can support hybrid PQC while real clients still negotiate classical key exchange through old libraries, proxies, or fallback behavior.
Old clients, load balancers, TLS termination, protocol limits, unsupported downstream services, and misconfiguration can all cause a classical negotiation even when the upgraded component advertises PQC support.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · security-state model
Secure should model each state separately, then calculate the gap between required policy and observed behavior.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · quantum timing model
Secure should calculate quantum urgency per relationship: protect first where data shelf life plus migration time exceeds the credible quantum threat horizon.
How long the data or transaction must stay confidential after capture.
How long the owner needs to upgrade, test, approve, and deploy PQC controls.
Estimated time until cryptographically relevant quantum capability threatens the algorithm.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · crypto topology
Cryptographic security happens on communication relationships, so Secure must treat edges as first-class evidence objects.
Source identity, destination identity, protocol, TLS version, key establishment, signature algorithm, cipher, certificate, trust chain, first observed, last observed, evidence source, confidence, and policy status.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · market gap
Each vendor can correctly report its own PQC support while the end-to-end customer path remains partially vulnerable.
Version 12.4 supports ML-KEM. The claim can be true and still fail to prove the customer’s full application path.
Secure maps the path. Assure validates claims against evidence. SOAR routes approved remediation when a path violates policy.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · reusable primitive
Expected security state versus observed security state applies to TLS, certificates, segmentation, and legacy services.
Policy requires TLS 1.3. Secure observes TLS 1.2, TLS 1.0, and plaintext on real device paths.
Policy expects approved enterprise certificates. Secure finds expired, self-signed, or unexpected certificates on alternate ports.
Policy allows camera-to-NVR traffic. Observation shows extra routes to internet, PLC, or corporate database targets.
Policy allows SSH. Observation finds HTTPS, Telnet, SNMPv2c, or vendor maintenance services still reachable.
The same Secure, Assure, and SOAR primitives can track required state, observed state, evidence source, claim confidence, named owner, and governed response.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · legacy estate
ASOC should never claim a legacy device became quantum-safe if the device still talks classically inside a local segment.
Gateway-to-gateway communication can use a secure overlay when traffic crosses a defined trust boundary.
ASOC records that residual exposure, the compensating controls, and the named risk owner instead of overstating safety.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · enforcement architecture
The overlay should protect selected boundary crossings, not blindly tunnel every packet everywhere.
The legacy endpoint remains unchanged. The original packet gets encapsulated by the gateway. The receiving gateway decrypts and forwards the original traffic. ASOC records which segment stayed classical and which boundary received protection.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · platform architecture
Secure and Assure feed the control plane. SOAR governs the response and can task the data plane under approved scope.
Maps assets, crypto posture, reachability, attack paths, unsupported systems, and communication relationships.
Replays claims against evidence sources, attaches provenance and coverage, and marks stale or unsupported claims.
Opens cases, routes approvals, signs action scope, tasks relays or gateways, and verifies the result.
ASOC REFERENCE ARCHITECTURE · POST-QUANTUM SHEET · operating model
The roadmap should come from the gaps ASOC observes: unsupported devices, vulnerable paths, unvalidated claims, missing policy, and action workflows.
can turn every unresolved condition into a product roadmap item: raw packet retention, standardized gateway placement, PQC handshake evidence, certificate provenance, policy authoring, approval routing, local relay execution, and post-action verification.
Open deployment architecture