Quantum computers: a data security risk?

In order to pro­tect IT, indus­tri­al and pro­duc­tion sys­tems French ener­gy com­pa­ny, EDF, is con­duct­ing advanced research stud­ies in cyber­se­cu­ri­ty to explore the full range of inno­va­tions in this area.

“We are prepar­ing our­selves for the events that will inevitably occur!”, begins Youssef Laarouchi, R&D cyber­se­cu­ri­ty project man­ag­er at EDF and part­ner of the Sei­do Lab with Télé­com Paris (IP Paris). To pre­pare for new threats against indus­tri­al pow­er sys­tems, Youssef Laarouchi and his team study the con­tri­bu­tion of arti­fi­cial intel­li­gence in detec­tion of pos­si­ble attacks.

The issue that they are most inter­est­ed in is how peo­ple who design virus­es and oth­er mal­ware man­age to con­ceal them and make them increas­ing­ly dif­fi­cult to detect. Not only does mal­ware spread by remain­ing hid­den, they also now pos­sess an advanced form of intel­li­gence which allows them to evade the detec­tion of clas­sic pre­ven­tion sys­tems such as intru­sion detec­tion sys­tems, intru­sion pre­ven­tion sys­tems, or firewalls.

To analyse the behav­iour of these mal­wares, the team uses a range of advanced tech­nolo­gies and works in col­lab­o­ra­tion with the aca­d­e­m­ic research world. “To improve the detec­tion rate, we use AI algo­rithms and cou­ple weak attack sig­nals to vol­umes of net­work traf­fic data, for exam­ple”, explains Youssef Laarouchi.

Data cou­pling was not stud­ied much until now. “But today, we have mature AI and machine learn­ing algo­rithms, and most impor­tant­ly ade­quate com­pu­ta­tion­al pow­er, because these analy­ses demand sub­stan­tial com­put­ing time. This makes it pos­si­ble to con­duct inter­est­ing analy­ses with neur­al net­works, super­vised machine learn­ing, etc.”

In addi­tion to improv­ing the detec­tion of mal­ware, the team broad­ens its research field to study new attacks tar­get­ing the low­er lay­ers of phys­i­cal sys­tems. “These mal­wares direct­ly attack the core of the proces­sor by insert­ing a com­mand to gain priv­i­leges. This type of attack is gen­er­al­ly invis­i­ble to the system’s high­er lev­els”, spec­i­fies Youssef Laarouchi.

Ensur­ing con­fi­den­tial­i­ty of per­son­al data is yet anoth­er research sub­ject. Data must be secure when they are trans­ferred from one place to anoth­er or when they are stored on a serv­er. It is pos­si­ble to encrypt data, but they must be read­able when required. “So, the ques­tion is: how can we use data with­out see­ing and access­ing them? This new field of cryp­tog­ra­phy is a key issue for an indus­tri­al com­pa­ny such as EDF. It makes it pos­si­ble, for exam­ple, to offer ser­vices to clients that guar­an­tee the pro­tec­tion of these data, which must remain private.”

The team also leads stud­ies on quan­tum cryp­tog­ra­phy. Future quan­tum accel­er­a­tors will soon be able to “break” the encryp­tion keys cur­rent­ly in use. “We are prepar­ing for this issue by devel­op­ing and test­ing new encryp­tion algo­rithms, and by study­ing cer­tain quan­tum prop­er­ties which we could use in post-quan­tum cryptography.”

This is a char­ac­ter­is­tic of research in indus­try: it con­sists of applied research on real data, some­where between fun­da­men­tal research and mar­ket solu­tions. The aim is to pro­vide busi­ness­es with the tools they need and help to imple­ment them​.To stay up to date with fun­da­men­tal research, EDF par­tic­i­pates in the Chaire Cyber CNI (cyber­se­cu­ri­ty of crit­i­cal infra­struc­tures) of the Insti­tut Mines-Télé­com, in part­ner­ship with Télé­com Paris, Télé­com Sud­Paris, the Pôle d’ex­cel­lence cyber de la région Bre­tagne, as well as man­u­fac­tur­ers includ­ing Nokia Bell Labs or Air­bus. “We have com­mon goals, we might as well try to achieve them by work­ing togeth­er!”, con­cludes Youssef Laarouchi.