As quantum computing technology continues to advance towards a cryptographically relevant scale, cybersecurity for critical infrastructure such as electrical power systems must prepare for an existential threat. A crucial step to mitigating the potential damage a quantum computer-aided attack may cause is identifying quantum-vulnerable algorithms that are currently used in the standards for the security of power system control centres and communication networks. The IEC 62351 is a series of standards for protecting data in power automation systems and includes several quantum-vulnerable cryptographic primitives. Parts 7, 8, and 9 of the IEC 62351 are dedicated to network and system management, role-based access control, and key management. In this work, we conduct a comprehensive vulnerability assessment of the cryptographic algorithms selected in these parts of IEC 62351.
As quantum computing technology continues to advance towards a cryptographically relevant scale, cybersecurity for critical infrastructure such as electrical power systems must prepare for an existential threat. A crucial step to mitigating the potential damage a quantum computer-aided attack may cause is identifying quantum-vulnerable algorithms that are currently used in the standards for the security of power system control centres and communication networks. The IEC 62351 is a series of standards for protecting data in power automation systems and includes several quantum-vulnerable cryptographic primitives. Parts 7, 8, and 9 of the IEC 62351 are dedicated to network and system management, role-based access control, and key management. In this work, we conduct a comprehensive vulnerability assessment of the cryptographic algorithms selected in these parts of IEC 62351.
Quantum computing, power systems, and communication represent three distinct fields that converge to address the complexities involved in the quantum cybersecurity of power systems. Quantum computers present a serious threat to cybersecurity by potentially affecting traditional encryption methods, which could compromise sensitive data and disrupt the integrity of secure communications. As communication and data transformation serve as the backbone of modern power grid monitoring, control, and protection systems, the growing awareness of cyber-vulnerabilities in power grids has made cybersecurity a pressing concern. The IEC 62351 standard family has been developed to provide security recommendations for various power system communication protocols and is emerging as a leading cybersecurity standard for power systems. However, the vulnerabilities of these standards to quantum threats have yet to be fully explored. This article conducts a comprehensive analysis of security threats and vulnerabilities in modern power systems against quantum attacks. It systematically reviews the security considerations outlined in IEC 62351 for safeguarding various aspects, such as IEC 61850 messages, key management, XML file security, and TCP/IP profiles. The analysis reveals that almost all encryption algorithms mandated and recommended by IEC 62351 are vulnerable to quantum attacks such as Grover's and Shor's algorithms.
The rise of large-scale quantum computing poses a significant threat to traditional cryptographic security measures. Quantum attacks, particularly targeting the mathematical foundations of current asymmetric cryptographic algorithms, render them ineffective. Even standard symmetric key cryptography is susceptible, albeit to a lesser extent, with potential security enhancements through longer keys or extended hash function outputs. Consequently, the cryptographic solutions currently employed to safeguard data will be inadequately secure and vulnerable to emerging quantum technology threats. In response to this impending quantum menace, organizations must chart a course towards quantum-safe environments, demanding robust business continuity plans and meticulous risk management throughout the migration process. This study provides an in-depth exploration of the challenges associated with migrating from a non-quantum-safe cryptographic state to one resilient against quantum threats. We introduce a comprehensive security risk assessment framework that scrutinizes vulnerabilities across algorithmic, certificate, and protocol layers, covering the entire migration journey, including pre-migration, through-migration, and post-migration stages. Our methodology links identified vulnerabilities to the well-established STRIDE threat model, establishing precise criteria for evaluating their potential impact and likelihood throughout the migration process. Moving beyond theoretical analysis, we address vulnerabilities practically, especially within critical components like cryptographic algorithms, public key infrastructures, and network protocols. Our study not only identifies potential attacks and vulnerabilities at each layer and migration stage but also suggests possible countermeasures and alternatives to enhance system resilience, empowering organizations to construct a secure infrastructure for the quantum era. Through these efforts, we establish the foundation for enduring security in networked systems amid the challenges of the quantum era.
The rapid advancement of quantum computing poses a significant threat to many current security algorithms used for secure communication, digital authentication, and information encryption. A sufficiently powerful quantum computer could potentially exploit vulnerabilities in these algorithms, rendering data in transit insecure. This threat is expected to materialize within the next 20 years. Immediate transition to quantum-resilient cryptographic schemes is crucial, primarily to mitigate store-now-decrypt-later attacks and to ensure the security of products with decade-long operational lives. This transition requires a systematic approach to identifying and upgrading vulnerable cryptographic implementations. This work developed a quantum assessment tool for organizations, providing tailored recommendations for transitioning their security protocols into a post-quantum world. The work included a systematic evaluation of the proposed solution using qualitative feedback from network administrators and cybersecurity experts. This feedback was used to refine the accuracy and usability of the assessment process. The results demonstrate its effectiveness and usefulness in helping organizations prepare for quantum computing threats. The assessment tool is publicly available at (https://quantum-watch.soton.ac.uk).
Abstract The use of quantum technologies in the modern world poses significant challenges to the security of critical information infrastructure, which underpins key sectors such as healthcare, energy, transportation, and communications. Cryptographic algorithms like RSA and ECC, long considered reliable, have lost their resilience in the face of quantum computing capabilities, making the search for modern solutions to ensure data protection a top priority. The main risks posed by quantum computers include the potential compromise of encryption algorithms, disruption of data integrity, and destabilization of critical system operations. The methodological foundation of this study is based on the analysis of 318 sources from international databases such as Scopus and Web of Science. From this body of literature, 24 publications most relevant to the topic were selected. A comparative method was employed to analyze classical and quantum threats. The aim of the study is to examine the impact of quantum attacks on the security of critical information infrastructure (CII) at the current level and propose pathways for transitioning to quantum-resilient solutions. The results emphasize the necessity of implementing innovative cryptographic approaches, such as lattice-based and code-based algorithms, as well as combined (hybrid) technologies. Successful protection of the infrastructure requires a systematic approach, including a comprehensive audit of existing systems, training of specialists, and the removal of technical and regulatory barriers. The developed step-by-step plan minimizes risks and establishes a foundation for the secure implementation of new standards.
Information technology is vital in handling critical infrastructures, such as power grids, water supplies, healthcare, transportation networks, and infrastructures in space. Quantum computing has potential to revolutionise critical infrastructures by enabling faster optimisation, simulation, and data analysis for complex systems. The adoption of quantum technologies demands the reconsideration of cybersecurity protocols to mitigate quantum-era threats. Along with the technological progress in quantum computing, there is a risk of cyberattacks leading to research questions, asking: what new quantum computing algorithms are being designed to secure critical infrastructures; how they compare to conventional methods; how quantum computing algorithms are being designed to enhance the reliability of critical infrastructures; and what quantum computing methods are emerging for ensuring the stability and accuracy of computations critical to infrastructure management? This work focuses on answering these research questions by presenting a scoping review conducted by considering 420 research articles. The scoping review shows the possibilities that can be achieved by implementing various algorithms and methods for cybersecurity. The study encircles many categories, such as optimisation, security, networking, algorithms, protocols, communication, power systems, and space science, and shows that quantum computing can enhance their protection. This study discusses techniques for the cybersecurity of critical infrastructures in quantum computing and presents results on infrastructure analysis. We targeted various research phrases regarding the research questions mentioned about algorithms and methods for cybersecurity of critical infrastructure in quantum computing. This work calls for the reader to consider the various ways to protect critical infrastructures from different threats, including cyberattacks.
The emergence of quantum computing poses a formidable security challenge to network protocols traditionally safeguarded by classical cryptographic algorithms . This paper provides an exhaustive analysis of vulnerabilities introduced by quantum computing in a diverse array of widely utilized security protocols across the layers of the TCP/IP model, including TLS , IPsec , SSH, PGP, and more. Our investigation focuses on precisely identifying vulnerabilities susceptible to exploitation by quantum adversaries at various migration stages for each protocol while also assessing the associated risks and consequences for secure communication. We delve deep into the impact of quantum computing on each protocol, emphasizing potential threats posed by quantum attacks and scrutinizing the effectiveness of post-quantum cryptographic solutions. Through carefully evaluating vulnerabilities and risks that network protocols face in the post-quantum era, this study provides invaluable insights to guide the development of appropriate countermeasures. Our findings contribute to a broader comprehension of quantum computing’s influence on network security and offer practical guidance for protocol designers, implementers, and policymakers in addressing the challenges stemming from the advancement of quantum computing. This comprehensive study is a crucial step towards fortifying the security of networked environments in the quantum age.