Securing IoT in the Quantum Age

Article By : Maurizio Di Paolo Emilio

Quantum computers will make security mechanisms vulnerable to new types of cyberattacks — a problem for both chip cards and complex technological systems...

Quantum computers will make current security mechanisms vulnerable to new types of cyberattacks — a real problem for both chip cards and complex technological systems such as networked vehicles or industrial control systems. They have the potential to break the cryptographic patterns widely used in internet of things data communication systems.

With the advent of quantum computers, modern encryption algorithms are undergoing an evolution that will significantly change their current use. In order to support the security of the internet and other cryptographic-based technologies, it is necessary to increase mathematical research to build the cryptography of tomorrow, which is resistant to quantum attacks and will become known as post-quantum or quantum-resistant cryptography.

“A quantum computer that could break cryptography would be a powerful tool for attackers,” said Dr. Thomas Poeppelmann, senior staff engineer, Infineon Technologies.

According to the latest Thales Data Threat Report, 72 percent of the security experts surveyed worldwide believe that quantum computing power will affect data security technologies within the next five years. Robust and future-proof security solutions are therefore necessary. The potential threats are widespread, everything from the cars of the future to industrial robots.

Thomas Poeppelmann

IoT security

The modern use of cryptography aims to help ensure the confidentiality, authenticity, and integrity of the multiple data traveling in the IoT ecosystem, both the consumer and industrial one.

“Security requirements of IoT devices can be very complex,” said Poeppelmann. “As a result, security cannot be achieved by a single technology or method. For example, a vendor has to consider aspects like secured software development, protected patch management, supply chain security, protection against physical attacks, trust and identity management, and secured communication.”

Many companies, such as Infineon, are developing chip-based quantum security mechanisms. In particular, the applicability and practical implementation of quantum security cryptographic methods for embedded systems will be highlighted.

“An IoT device has to check that a software update is really from the vendor and that it was not created by an attacker,” said Poeppelmann. “If the cryptographic methods used in an IoT device can be broken by an attacker, this would expose it to a lot of vulnerabilities. With quantum-safe cryptography, we want to provide our customers with cryptographic methods that are even protected against attacks using quantum computers. With our post-quantum technology, we aim to provide security in the long term and against very powerful attackers.”

A classic computer attacker can use all the necessary means, such as artificial intelligence and increasingly powerful computers, to defeat security barriers.

Depending on the results and tasks, an attacker may be willing to spend several months of work to break a cryptographic pattern. Developers must provide maximum security that is accessible and easy-to-integrate solutions.

“The security industry is developing cryptography that can be executed on cost-efficient classical computers or even tiny smart card chips while being guarded against even the most powerful attackers,” said Poeppelmann.

He added, “This situation is also applicable to the development of post-quantum cryptography that should withstand quantum computing power. The defender could still be implementing cryptography on classical computers and machines, while the attacker may use a quantum computer in the near future. Current approaches for so-called quantum-key distribution [QKD], where quantum technology is used to achieve confidentiality, are currently too expensive or too constraining, whereas current assessments of post-quantum cryptography prove that it could be quantum-safe as well as affordable. This is why we at Infineon focus on the development of post-quantum cryptography [PQC].”

Security for IoT
(Image: Infineon Technologies)

Large-scale QKD technology has already been tested in several countries to provide secure quantum protection to critical infrastructures.

Today, cryptography is used in many applications in automobiles and industrial control equipment. This aims to prevent the transfer of malware that could disrupt security systems and seriously endanger independent driving and production equipment.

Conventional encryption tools such as elliptical curve encryption are indestructible for today’s computers. However, with constant progress in the development of quantum computers, many encryption algorithms may become ineffective in the near future.

Projects

The project Aquorypt will investigate the applicability and practical implementation of quantum-safe cryptographic methods for embedded systems. The project team evaluates procedures that have an adequate security level and implements them efficiently in hardware and software. The results could be used to protect industrial control systems with a long service life.

In the Aquorypt research project, the Technical University of Munich (TUM) will collaborate with researchers and industrial partners to develop new protection measures for the quantum computing era.

“The project will first assess several new protocols and check if the new protocols are suitable for the use cases; i.e. industrial control and chip cards,” said Poeppelmann. “The best way to build a secured system is always a combination of appropriate software and hardware methods. However, some security goals cannot be achieved if the underlying hardware is not secured. Some bugs cannot be fixed by software alone.”

Another project, PQC4MED, is focused on embedded systems in medical products. The associated hardware and software must allow the exchange of cryptographic procedures to counteract external threats. The solution will be tested in a use case in the field of medical technology.

“In health-care applications, data privacy and data security are of particular importance,” said Poeppelmann. “Moreover, these devices have been in the field for a very long time so that software needs to be updated to comply with the latest regulations. As a consequence, it is important to first understand how suppliers of health-care devices could handle the threats caused by attacks using quantum computers. And secondly, [it is important] to research how they can implement software updates and software management mechanisms that allow [protection of] a device over its life cycle of more than 20 years. If the security of the update mechanism is low, an attacker will always take the path of least resistance and attack this component.”

Infineon is working in this field for the development and standardization of New Hope and SPHINCS+ quantum security cryptographic schemes. New Hope is a key exchange protocol based on the Ring-Learning-with-Errors (Ring-LWE, or RLWE) problem.

Ring-LWE has been designed to protect against cryptoanalysis of quantum computers and also to provide the basis for homomorphic encryption. A key advantage of RLWE-based cryptography is in the size of the public and private keys.

SPHINCS+ is a stateless hash-based signature scheme based on conservative security assumptions.

Google’s quantum computer

Conclusion

Cyberattacks on industrial plants could lead to the theft of knowledge about production processes or to tampering plants with a loss of production efficiency. Over time, electronic systems will become increasingly more networked and information security will play a key role.

“As for security, post-quantum cryptography now mainly needs standards and awareness,” said Poeppelmann. “The standards are required to grant interoperability of different systems; e.g., an IoT device communicating with a cloud system. Device manufacturers, on the other hand, should be aware that quantum computers can become a real threat to their solutions’ security. They should assess future risks as properly [as possible] and implement appropriate security as early as possible.”

In addition to security, a second factor in determining whether a cryptographic algorithm can be used in a given application environment is its efficiency. The performance takes into account not only processing speed but also memory requirements: key size, data expansion speed, signature size, etc. For example, schemes based on more structured mathematical problems tend to have reduced keys.

“Quantum technology such as quantum computers or quantum sensors have different requirements for market adoption,” said Poeppelmann. “For the adoption of quantum computers, we need a computer that is really able to prove a benefit for real-world tasks (e.g., chemical analysis, AI, etc.) over currently used cloud methods. In general, it is important to raise awareness to foster market adoption of quantum-resistant cryptography. The threat is real, but with PQC, we have a migration path available.”

Improving the strength of encryption remains a goal for many IT security experts. As computers become smarter and faster and codes become easier to decode, a more advanced encryption mechanism is more urgently needed.