Skip to main content

Cybersecurity of Quantum Computing Algorithm Zoo

In analogy with the quantum algorithm zoo, we have developed a cybersecurity of quantum computing algorithm zoo.  Initially created by Sohrab Ganjian, Robert Broberg, and Robert Cunningham in 2022, we hope that this will grow to become a comprehensive catalog of quantum cybersecurity algorithms.

Policy and Regulatory Issues

Quantum technologies have the potential to revolutionize many aspects of society, including politics. For example, quantum computers could potentially be used to break encryption algorithms, which could have significant implications for national security and international relations. Additionally, quantum communication technologies could enable more secure communication channels for governments and political organizations, potentially increasing the level of privacy and confidentiality in political decision-making. Finally, quantum technologies could also enable more accurate polling and prediction of election outcomes, potentially influencing political campaigns and strategy. Overall, the development and deployment of quantum technologies is likely to have a significant impact on politics in the coming years. 

What follows is a literature review of emerging research in this field. 

  • Hoofnagle, C. J., & Garfinkel, S. L. (2022). Law and Policy for the Quantum Age. Cambridge University Press. Publisher Website (open access).  

International Politics 

The development and deployment of quantum computers could potentially disrupt the balance of power between nations, as some countries may be able to gain a strategic advantage by being the first to use these powerful machines for military and intelligence purposes. Additionally, the use of quantum technologies could also lead to the development of new international regulations and policies, as governments seek to address the potential risks and benefits of these technologies. 

Policies and Legal Structures 

Due to scientific challenges and difficulty of achieving quantum technologies, nations are encouraged to cooperate and adapt welcoming immigration policies. This can help to attract and retain top talent in this field.  

Law enforcement agencies and governments are advised to carefully examine past historical cases, specifically in light of the recent developments in machine learning and artificial intelligence to allow fair access to potential quantum technologies, while maintaining privacy. 

Quantum Computers and Associated Risk Management 

  • Grody, Allan D., Addressing Cyber-Risk in Financial Institutions and in the Financial System (February 21, 2020). Journal of Risk Management in Financial Institutions, Vol. 13 Issue 2, 2020, Available at SSRN: https://ssrn.com/abstract=3579541 

Grody describes the costs cyber risks pose to financial institutions and infrastructure across the world. The report states the U.S. Federal Reserve Bank of New York’s payment activity ranged from $2.8 trillion to $3.7 trillion per day with the 5 largest financial institutions responsible for over %50 daily volume. Grody describes cyber vulnerabilities and standards and regulatory bodies involved in monitoring the financial institutions and argues regulatory bodies need to study quantum computing and its possible threats beyond cryptoanalysis.  

Privacy 

Quantum technologies could also have serious implications on privacy. Quantum sensors could be used to detect prohibited substances and materials, at the price of scanning of entire neighbourhoods. Quantum illumination may be used to remove darkness as barrier for observation with cameras.  

Assured privacy is a critical component of a distributed and shared compute infrastructure used for information processing and dissemination. Privacy considerations developed as the digital compute infrastructure became an integral part of the larger societal life. A nascent research community exploring privacy for a quantum computing system is developing.   

Blind Quantum Computing 

  • Broadbent, J. Fitzsimons and E. Kashefi, "Universal Blind Quantum Computation," 2009 50th Annual IEEE Symposium on Foundations of Computer Science, Atlanta, GA, USA, 2009, pp. 517-526, doi: 10.1109/FOCS.2009.36.  

Blind quantum computing (BQC) is an emerging research field from quantum computing, where it allows users to perform computation on a remote quantum server without revealing the client’s input, output, or the specific computation being performed. While homomorphic encryption provides an analogous solution in the classical world provides information theoretic security-based properties of quantum phenomena.

Attacks and Mitigation

The introduction of the internet into society for widespread use in the early 1990’s allowed for a proliferation of new services and applications based upon digital computing that form an integral part of daily life. The computer platforms were initially developed assuming a trusted user base thus security concerns were not considered. As use spread and opportunities for exploitation arose a community of security research developed with the goal to secure these systems; security was an afterthought.  

As the development of quantum computing proceeds a nascent community of researchers is beginning to explore potential vulnerabilities in these new quantum computing systems. Much like the digital compute world these early quantum computers expose both software and hardware vulnerabilities. The ability to discover and mitigate these vulnerabilities before widespread deployment provides a unique opportunity to secure a computer platform in advance of deployment. Much like the digital compute community and iterative and advancing process of discovering vulnerabilities and proposing mitigations is now beginning. A survey of current literature from the academic and industrial research community exploring both hardware and software vulnerabilities follows. 

Cloud 

Given the difficulties of building and maintaining quantum computers, they will be accessible to the public by means of cloud services, where clients send their requests to a quantum server remotely. For this reason, quantum cloud systems could become a high-value target for adversaries and efforts to provide security for cloud-based systems become important as the field of quantum computing evolves.

Tampering with Allocation Algorithms of Quantum Computers 

Phalak, et al examine a threat model where allocation algorithms of quantum compute resources in a cloud environment are tampered. Quantum computers have different fidelities and costs associated with them. A scheduler allocates resources for a queue of programs depending upon the customer associated with the resources, the demand of the program and available resources at the time. The threat vector is tampering with the allocation algorithm. By building a quantum PUF the program can validate the machine it expects to be assigned. The authors propose a mechanism to build and validate the PUF. The validate their proposal on three different IBM Q machines. 

Untrustworthy 3rd Party Compilers  

The attack model assumes an untrustworthy compiler could reverse engineer a quantum circuit to extract sensitive information from the program. The proposed model to prevent this is to insert dummy SWAP gates. This not only obfuscates the program but introduces errors due to increased gate depth. Thus, an untrusted 3rd party copying the program not only does not gain insight into the design but if to run it would get errors. The author of the original program removes the dummy SWAPs from the compiled code before running. The authors validate the approach on IBM Qiskit simulator. 

Multi-programming Quantum Computing 

  • Ash Saki, Abdullah et al. "Qubit Sensing: A New Attack Model for Multi-programming Quantum Computing." arXiv e-prints (2021): arXiv-2104.  https://arxiv.org/pdf/2104.05899

Saki, et al, uses inherent error bias in result readout or measurement between qubit states 0 and 1. The bias is also correlated across qubits thus allowing one to infer the readout of a different qubits based on sampling of others. The paper presents a model where analysis of output states is done by an adversarial program. Once this information is gathered the adversary executes his program simultaneously with a victim program thus determining the victim's output. Their attack shows a 96% accuracy of victim readout by adversary. They propose countermeasure with minimal impact. 

Virus 

A computer virus is a potential security concern for the field of quantum computing. A virus is a type of malware that is designed to replicate itself. Since quantum computers are still in their early stages, it will become more important to develop robust security measures to protect against virus systems on quantum computers.

Fault Injection Attack using Crosstalk 

Desphande, et al explore the concept of a software virus threat to a quantum computer. They define this in the context of exercising crosstalk between two different programs running simultaneously on the same machine. An attacker initiates crosstalk to an unsuspecting program thus corrupting its operation. The authors explore ways to find the attacker by code examination and pattern repetition. Within the QASM language they propose extensions to IBM Qiskit framework to detect possible viruses. This is the antivirus approach the authors demonstrate efficacy on IBM Q. 

  • Ash-Saki et al, “Analysis of crosstalk in NISQ devices and security implications in multi-programming regime”, ISLPED, 2020.  

This article, two years before "Towards an Antivirus for Quantum Computers" at HOST 2022, lays the groundwork for using crosstalk as a virus. In this paper, Ash-Saki et al, experimentally extract crosstalk effects and model them to simulate and quantify its effect on qauntum circuits. 

Attacks and Mitigations on Hardware 

Physical or malicious software attacks on the hardware could potentially disrupt or damage the system. It is important for quantum computing to have robust security measures in place to protect against these types of attacks.  

Overview 

  • Ash-Saki et al “A Survey and Tutorial on Security and Resilience of Quantum Computing”, IEEE European Test Symposium (ETS), 2021. https://arxiv.org/pdf/2106.06081

Ash-Saki's paper provides an overview of IBM’s quantum compute environment and example applications. Attack vectors at both the control plane and the compute environment are discussed. Their assumptions regarding multi-tenant operation are based on a detailed understanding of the topology of the quantum computer and the scheduling mechanism for multi-tenant applications. A Counter measure for mis-applied hardware a QuPUF is introduced; an analogue to classical PUFs. Other counter measures are introduced for different attack vectors.

Untrusted Cloud-Based Quantum Hardware 

  • S. Upadhyay, “Robust and Secure Hybrid Quantum-Classical Computation on Untrusted Cloud-Based Quantum Hardware”, HASP, 2022.   https://arxiv.org/pdf/2209.11872.pdf   

Upadhyay, et al provide an attack model for hybrid classical/quantum cloud based compute services where malicious systems pose threats to input parameters or results generated that result in higher compute overhead or return suboptimal results. The authors use a Quantum Approximate Optimization Algorithm and Variational Quantum Eigensolver as examples and propose a mitigation strategy which allows users to identify tampered and untrusted hardware.  

Circuit Mapping Attacks on NISQ Computers 

In the NISQ environment the output of a program is very dependent upon the mapping of the quantum circuit, I.e., the computer program, to the physical hardware. Minimal errors are achieved with optimal mapping which is a function of gate fidelity for a given time. Backend changing to mapping of the program can exacerbate errors thus providing an attack vector. The authors propose a mechanism to insert test points to monitor errors. They experimentally validate their approach on IBM Q16 Melbourne.  

Attacks on Trapped-Ion Quantum Computers 

Trapped Ion quantum computers pose a unique attack vector when compared to superconducting based systems. A given trap is limited in size thus limiting the number of qubits. To scale to larger size computers traps are interconnected and the qubits (ions) are shuttled between traps. The shuttling exercise consumes relatively large amounts of power and impacts qubit fidelity; excessive shuttling results in increased errors. The authors propose an attack vector in a multi-tenant system where the adversary creates a program to invoke excessive shuttling thus degrading system performance. They simulate an attack and propose three countermeasures. 

Securing Reset Operations in NISQ Quantum Computers 

Mi, et al explore reset operations on IBM Q superconducting quantum computer. They show information leakage across reset and develop a threat model to extract information in a multi-tenant or multi-user environment. The authors develop mitigation strategies and present techniques to secure resets against information leakage. Those are tested and evaluated on the IBM Q machines.

Secure Quantum Communications

Quantum phenomena as used for communication began in the early 2000’s with prototype experiments demonstrating secure communication links using QKD for symmetric key generation. In early 2008 the concept of a quantum internet was introduced by Kimble for quantum information transport.  Since then, there has rapid progress on both algorithmic research into uses for quantum communication to experimental demonstration showing transport of quantum state across both free space and fiber optic cable.  

In this section, applications of quantum communications for securing and protecting information are discussed. In particular, quantum random number generation (QRNG), quantum key distribution (QKD) and quantum internet are introduced. The first two provide information-theoretic security, which is considered to be the holy grail of encryption. While the quantum internet is less mature than QRNG and QKD, it has the potential to deny adversaries the ability to spy on metadata.

Quantum Key Distribution 

Secret communication is possible by sharing a secret key away from the adversaries. Classically, sharing secret keys come with various challenges. In particular, a secret key can be intercepted by an adversary without the knowledge of the communicating parties. Using quantum communication, encryption keys can be exchanged to provide unconditional security. Any measurement on the secret key would leave a mark for communicating parties thanks to the laws of quantum mechanics [2].

Quantum Random Number Generator 

While classical computers are not capable of generating truly random numbers, by leveraging photonics and unpredictability, one can produce truly random numbers. Random number generation is useful for various reasons, but in particular it has applications in computer simulations and cryptography [2]. 

Quantum Internet 

The quantum internet is a quantum network that uses quantum mechanics to transmit information. Quantum teleportation could be made possible with the quantum internet. Additionally, Signal Intelligence (SIGINT) has enjoyed a thriving era thanks to the vast amount of information and metadata available on the internet. Therefore, the quantum internet can be seen as a countermeasure to intelligence gathering disciplines [2].

A surge of funding and interest has led to the establishment of laboratories focusing on the development of a quantum internet across the world. 

This article proposes 6 stages of advancement required to deliver a fully functional quantum internet. The final stage is defined as a quantum internet with abilities to provide distributed quantum computing, fault tolerance with quantum error correction, distributed clock synchronisation and other new distributed algorithms enabled by quantum phenomena.

Post Quantum Cryptography

As quantum computing imposes a theoretical threat on classical communications and in particular the internet, cryptographers are in pursuit of secure cryptography schemes and protocols that can be used in the presence of quantum computers [4]. For this reason, the National Institute of Standards and Technology (NIST) has begun the post-quantum cryptography (PQC) standardization process [5].  

Side Channel Attacks 

  • J. Park, N. Anandakumar, D. Saha, D. Mehta, N. Pundir, F. Rahman, F. Farahmandi, and M. Tehranipoor, IACR Cryptology ePrint Archive, March 2022, https://eprint.iacr.org/2022/527.pdf  

As post-quantum cryptography (PQC) standardization process of the National Institute of Standards and Technology (NIST) is under way, this paper describes the overview of possible side-channel attacks on PQC implementations by considering algorithmic-level, implementation-level and AI-based side-channel attacks. Furthermore, the paper proposes a systematic framework for comprehensive side-channel evaluation of NIST PQC implementation during design phases.

References

[1] Mosca, M., & Piani, M. (2021). 2021 Quantum Threat Timeline Report. https://globalriskinstitute.org/publications/2021-quantum-threat-timeline-report/  

[2] Hoofnagle, C. J., & Garfinkel, S. L. (2022). Law and Policy for the Quantum Age. Cambridge University Press. Publisher Website (open access).  

[3] J. Park, N. Anandakumar, D. Saha, D. Mehta, N. Pundir, F. Rahman, F. Farahmandi, and M. Tehranipoor. PQC-SEP: Power Side-channel Evaluation Platform for Post-Quantum Cryptography Algorithms. IACR Cryptology ePrint Archive, March 2022, https://eprint.iacr.org/2022/527.pdf  

[4] Orman, H. (2021). Internet Security and Quantum Computing. https://eprint.iacr.org/2021/1637.pdf   

[5] Post-quantum cryptography PQC. NIST Information Technology Laboratory, Computer Security Resource Center, 2017. https://csrc.nist.gov/Projects/post-quantum-cryptography/post-quantum-cryptography-standardization/Call-for-Proposals. 

[6] Ash-Saki et al “A Survey and Tutorial on Security and Resilience of Quantum Computing”, IEEE European Test Symposium (ETS), 2021. https://arxiv.org/pdf/2106.06081  

[7] S. Upadhyay, “Robust and Secure Hybrid Quantum-Classical Computation on Untrusted Cloud-Based Quantum Hardware”, HASP, 2022.   https://arxiv.org/pdf/2209.11872.pdf  

[8] Phalak, Koustubh, et al. "Quantum PUF for security and trust in quantum computing." JETCAS, 2021. https://arxiv.org/pdf/2104.06244  

[9] Allen Mi, Shuwen Deng, and Jakub Szefer, "Securing Reset Operations in NISQ Quantum Computers", in Proceedings of the Conference on Computer and Communications Security (CCS), November 2022. https://caslab.csl.yale.edu/publications/mi2022securing.pdf   

[10] Sanjay Deshpande, Chuanqi Xu, Theodoros Trochatos, Yongshan Ding, and Jakub Szefer, "Towards an Antivirus for Quantum Computers", in Proceedings of the International Symposium on Hardware Oriented Security and Trust (HOST), June 2022. https://caslab.csl.yale.edu/publications/deshpande2022towards.pdf   

[11] Acharya, Nikita, et al "A lightweight approach to detect malicious/unexpected changes in the error rates of NISQ computers." ICCAD, 2020. https://dl.acm.org/doi/10.1145/3400302.3415684  

[12] Saki, A Ash et al. "Shuttle-Exploiting Attacks and Their Defenses in Trapped-Ion Quantum Computers." IEEE Access, 2021. https://arxiv.org/pdf/2108.01054  

[13] A. Ash-Saki et al, “Analysis of crosstalk in NISQ devices and security implications in multi-programming regime”, ISLPED, 2020.   

[14] Ash Saki, Abdullah et al. "Qubit Sensing: A New Attack Model for Multi-programming Quantum Computing." arXiv e-prints (2021): arXiv-2104.  https://arxiv.org/pdf/2104.05899  

[15] Suresh, et. al, A Quantum Circuit Obfuscation Methodology for Security and Privacy https://arxiv.org/abs/2104.05943  

[16] Grody, Allan D., Addressing Cyber-Risk in Financial Institutions and in the Financial System (February 21, 2020). Journal of Risk Management in Financial Institutions, Vol. 13 Issue 2, 2020, Available at SSRN: https://ssrn.com/abstract=3579541  

[17] A. Broadbent, J. Fitzsimons and E. Kashefi, "Universal Blind Quantum Computation," 2009 50th Annual IEEE Symposium on Foundations of Computer Science, Atlanta, GA, USA, 2009, pp. 517-526, doi: 10.1109/FOCS.2009.36. 

[18] Stephanie Wehner, David Elkouss, and Ronald Hanson. “Quantum internet: A vision for the road ahead”. In: Science 362.6412 (2018). https://www.science.org/doi/10.1126/science.aam9288 

Last Updated: 5/9/2023 

Date Created: 12/2022