SmartPQ-Shield for Policy-Bounded Safe-Action Bandits in Adaptive Post-Quantum TLS

Statut : article accepté le 30 septembre 2026 à l’atelier WIAA’26 d’IEEE/WIC WI-IAT 2026. Version finale déposée ; actes IEEE à paraître.

Résumé

Adaptive post-quantum TLS must select cryptographic groups under changing network, endpoint and workload conditions without letting performance adaptation weaken the required security posture. SmartPQ-Shield separates policy authority from performance optimization: a trusted local policy defines the safe action set of each session, a contextual bandit only ranks the permitted configurations, and a deterministic pre-execution shield dispatches a compliant choice or safely aborts. Across 1.224 million simulated sessions, all shielded modes execute zero sub-floor configurations, whereas unshielded learners violate the floor in more than 98% of sessions; 900 OpenSSL/OQS handshakes confirm that all supported actions are executable.