Quantum computers : a data security risk ?

In order to pro­tect IT, indus­trial and pro­duc­tion sys­tems French ener­gy com­pa­ny, EDF, is conduc­ting advan­ced research stu­dies in cyber­se­cu­ri­ty to explore the full range of inno­va­tions in this area.

“We are pre­pa­ring our­selves for the events that will inevi­ta­bly occur!”, begins Yous­sef Laa­rou­chi, R&D cyber­se­cu­ri­ty pro­ject mana­ger at EDF and part­ner of the Sei­do Lab with Télé­com Paris (IP Paris). To pre­pare for new threats against indus­trial power sys­tems, Yous­sef Laa­rou­chi and his team stu­dy the contri­bu­tion of arti­fi­cial intel­li­gence in detec­tion of pos­sible attacks.

The issue that they are most inter­es­ted in is how people who desi­gn viruses and other mal­ware manage to conceal them and make them increa­sin­gly dif­fi­cult to detect. Not only does mal­ware spread by remai­ning hid­den, they also now pos­sess an advan­ced form of intel­li­gence which allows them to evade the detec­tion of clas­sic pre­ven­tion sys­tems such as intru­sion detec­tion sys­tems, intru­sion pre­ven­tion sys­tems, or firewalls.

To ana­lyse the beha­viour of these mal­wares, the team uses a range of advan­ced tech­no­lo­gies and works in col­la­bo­ra­tion with the aca­de­mic research world. “To improve the detec­tion rate, we use AI algo­rithms and couple weak attack signals to volumes of net­work traf­fic data, for example”, explains Yous­sef Laarouchi.

Data cou­pling was not stu­died much until now. “But today, we have mature AI and machine lear­ning algo­rithms, and most impor­tant­ly ade­quate com­pu­ta­tio­nal power, because these ana­lyses demand sub­stan­tial com­pu­ting time. This makes it pos­sible to conduct inter­es­ting ana­lyses with neu­ral net­works, super­vi­sed machine lear­ning, etc.”

In addi­tion to impro­ving the detec­tion of mal­ware, the team broa­dens its research field to stu­dy new attacks tar­ge­ting the lower layers of phy­si­cal sys­tems. “These mal­wares direct­ly attack the core of the pro­ces­sor by inser­ting a com­mand to gain pri­vi­leges. This type of attack is gene­ral­ly invi­sible to the system’s higher levels”, spe­ci­fies Yous­sef Laarouchi.

Ensu­ring confi­den­tia­li­ty of per­so­nal data is yet ano­ther research sub­ject. Data must be secure when they are trans­fer­red from one place to ano­ther or when they are sto­red on a ser­ver. It is pos­sible to encrypt data, but they must be rea­dable when requi­red. “So, the ques­tion is : how can we use data without seeing and acces­sing them ? This new field of cryp­to­gra­phy is a key issue for an indus­trial com­pa­ny such as EDF. It makes it pos­sible, for example, to offer ser­vices to clients that gua­ran­tee the pro­tec­tion of these data, which must remain private.”

The team also leads stu­dies on quan­tum cryp­to­gra­phy. Future quan­tum acce­le­ra­tors will soon be able to “break” the encryp­tion keys cur­rent­ly in use. “We are pre­pa­ring for this issue by deve­lo­ping and tes­ting new encryp­tion algo­rithms, and by stu­dying cer­tain quan­tum pro­per­ties which we could use in post-quan­tum cryptography.”

This is a cha­rac­te­ris­tic of research in indus­try : it consists of applied research on real data, somew­here bet­ween fun­da­men­tal research and mar­ket solu­tions. The aim is to pro­vide busi­nesses with the tools they need and help to imple­ment them​.To stay up to date with fun­da­men­tal research, EDF par­ti­ci­pates in the Chaire Cyber CNI (cyber­se­cu­ri­ty of cri­ti­cal infra­struc­tures) of the Ins­ti­tut Mines-Télé­com, in part­ner­ship with Télé­com Paris, Télé­com Sud­Pa­ris, the Pôle d’ex­cel­lence cyber de la région Bre­tagne, as well as manu­fac­tu­rers inclu­ding Nokia Bell Labs or Air­bus. “We have com­mon goals, we might as well try to achieve them by wor­king toge­ther!”, concludes Yous­sef Laarouchi.