Crypto-Agile Zero-Trust Access for Multi-Cloud via SDN, with PQC-QKD Key Orchestration

Cloud infrastructures moving toward post-quantum cryptography present both opportunities and risks since safe workload interoperability is made more difficult by disparate providers' uneven key management. In this study, a crypto-agile zero-trust access architecture for multi-cloud environments is presented, utilizing software-defined networking (SDN) to coordinate quantum key distribution (QKD) and post-quantum cryptography (PQC) for session security. The architecture incorporates a policy-driven controller that uses programmable data planes for micro-segmentation and continuous verification to dynamically choose ML-KEM or QKD-derived keys for each transaction. The system includes automated failover between PQC and QKD to guarantee resilience, preserving secure connectivity in the event of link failure or resource exhaustion. QKD-PQC failover under adversarial stress, flow-level path enforcement via P4, and TLS 1.3 handshakes with PQC are all demonstrated using a simulation prototype. The results demonstrate that SDN-based orchestration can maintain performance and uphold zero-trust principles, while also highlighting the viability of quantifying PQC overhead in real-time cloud scenarios. This establishes the framework as a workable route to multi-cloud security that is quantum robust.