Arriving at a precise definition of quantum supremacy/advantage largely depends on:
- the evolution of the business model for delivering of QC services to the end users, and,
- the safeguards that secure the Internet from the quantum threats and are relevant to that business model.
Each of these elements are discussed in detail herein:
Quantum-as-a-Service Business Model
By most estimates, a single qubit cost around $10,00030,31,32,33. An encryption breaking QC is estimated to require approximately 317 million qubits.34 On top of the actual cost of the qubits, a host of sophistic electronics, coaxial cabling and other materials that achieve near absolute zero operational temperatures housed in a large, controlled room costs a fortune. Even if the price of each qubit comes down 1,000 times, an encryption breaking QC will still cost in the range of $3 billion, a price far beyond the reach of ordinary mortals, and certainly not a hacker’s cup of tea. The only possible business model that can make quantum computing accessible to customers is through the cloud-based services. Quantum-as-a-Service (QaaS) is rapidly evolving as a likely business model.35 At least six QCSPs (Quantum Computing Service Providers) including Amazon and IBM, have already launched their QaaS product, offering scientists, researchers, and developers cloud services for building, testing, and running quantum computing algorithms.36 Some even offering there QaaS free.37 Such QCSPs can be regulated by governments to restrict subscription to verified subscribers only under terms and conditions that allow target quantum algorithms only to be deployable to pre-registered domains, and mandated to deploy specific security protocols to access the QC services. The QaaS business model is easier to regulate as compared to regulating the desktop hackers. The standardizing and policy-making agencies, the NIST in the US and ENISA, its equivalent in Europe, are currently focusing exclusively on PQC (post-quantum cryptography) to withstand the decryption capabilities of powerful QCs. The recent failures of PQCs23,7,38 and the evolving QaaS business model compels us to rethink our QC safeguarding strategy and look beyond the state-of-the-art for safeguarding classical computers from future quantum hackers.
QC Safeguards
Not all existing security tools are vulnerable to attacks with QC.39 The quantum threat to legacy computers can be broadly dealt with in following two ways9 (Fig.1):
- Protecting each Internet-connected legacy computer individually from quantum attacks with state-of-the-art PQC.
- Segregating all QC activities from mainstream Internet with encryption agnostic ZVC (Zero Vulnerability Computing).8
State-of-the-art Safeguards with PQC:
Cryptography is omnipresent in securing data and authenticating its access,40,41 and is used in almost all inter-device communications whether within network or in non-network scenarios.42 Cryptography remains the foundation of Internet security.43 The state of the art therefore takes the first approach in protecting individual computers with PQC algorithms. It is also a natural culmination of prevailing cybersecurity practices in prior art. As it is an impossible task to instantly modernize the encryption algorithms of all and sundry IT systems operating today, preparations must be commenced to handle the new situation.44 Securing a computer in a network without cryptography is inconceivable in legacy systems. It is for this reason that quantum threats exist, and it is for the same reason that a number of standardization bodies are currently working on standardization processes of PQC. These efforts are being led by the US-based NIST, the International Standards Organization (ISO), the Internet Engineering Task Force (IETF) and the European Telecommunications Standards Institute (ETSI). Each one of these initiatives is at a different stage and covering different PQC schemes. With the recent setbacks that NIST is facing, and no clear success emerging out of NIST’s PQC standardization process initiated 5 years ago, it becomes important to explore the possibilities beyond PQC. In that context a new hypothesis on quantum resilient computing is worth investigating9 (Fig. 1: graphical abstract)
Beyond State-of-the-art
Since the birth of the modern computer, cryptography has remained the mainstay of the computer security. If a technology can secure a connected computer without the need for encryption algorithms, it will automatically make the connected device quantum safe.
An encryption agnostic approach constituting the second strategy was recently proposed as an alternative to the Internet-wide deployment of PQC.9 Winning a Seal of Excellence from European Commission, Zero Vulnerability Computing (ZVC) revolutionizes the classical architecture of computers by completely obliterating a computer’s attack surface by banning all 3rd party permissions and as illustrated in the graphical abstract in Fig, 1 transforms the multilayered legacy computing systems to solid state software on a chip (3SoC).45
Encryption Agnostic Cybersecurity
In legacy computing systems all hardware and software are designed to grant 3rd party permissions so that vendors and developers can create a range of applications that make computers useful. It is impossible to build a computer without incorporating 3rd party permissions. Almost all computer vulnerabilities, originate from those inherent permissions.8 As illustrated in Fig. 2, ZVC achieves zero vulnerability by
- banning all 3rd party permissions, thus completely obliterating the attack surface.
- creating switchable in-computer offline storage within the connected device itself.
As illustrated in Fig. 3 this encryption agnostic approach essentially segregates QC from the mainstream computing infrastructure within the Internet. In this ZVC-powered novel QaaS architecture, a typical QCSP (Quantum Computing Service Provider) provides its cloud-based quantum computing services to its subscribers in a business model that is quite similar to any cloud computing service provider of today. As we have seen in a previous section, such isolation of QC from legacy Internet is anyway supported by QC’s evolving subscription based QaaS business model that caters to the highly specialized high-power computing needs of specific industry users. As a term of service, the subscribers are provided with a 3SoC client for accessing the quantum computing services of the QCSP. The QCSP routes access to the quantum computer through a 3SoC server that only accepts authentication requests from a 3SoC client device. All other requests from non-subscribers or hackers with legacy computing devices are declined (Fig. 3).
As illustrated in Fig. 4 this novel QaaS architecture can potentially provide unbreakable end-to-end security to access QC and isolate it from the rest of the Internet (Fig. 4) This means that the genuine subscribers of QaaS platform can be mandated to deploy specific security protocols to access QC within a secure Intranet segregated from rest of the Internet. The 3SoC tunnel connecting the user to the QC is encryption agnostic and therefore immune to encryption-breaking quantum algorithms. This makes QC inaccessible to bad actors. Most importantly, this strategy neutralizes the need for Internet-wide, device/resource-focused deployment of the resource intensive PQCs that demand significant processing time and power.46 Thus, a 3SoC intranet can potentially offer defense against misuse of quantum computing by bad actors even if the PQC algorithms fail to deliver the promise.