Scalable Quantum Cryptography Network for Protected Automation Communication Making quantum key distribution (QKD) available to critical energy infrastructure Background changes the key in an immediate and Benefits measurable way, reducing the risk that The power grid is increasingly more reliant information thought to be securely • QKD lets the operator know, in real- on a distributed network of automation encrypted has actually been compromised. time, if a secret key has been stolen components such as phasor measurement units (PMUs) and supervisory control and Objectives • Reduces the risk that a “man-in-the- data acquisition (SCADA) systems, to middle” cyber-attack might allow In the past, QKD solutions have been unauthorized access to energy manage the generation, transmission and limited to point-to-point communications sector data distribution of electricity. As the number only. To network many devices required of deployed components has grown dedicated QKD systems to be established Partners rapidly, so too has the need for between every client on the network. This accompanying cybersecurity measures that resulted in an expensive and complex • Qubitekk, Inc. (lead) enable the grid to sustain critical functions network of multiple QKD links. To • Oak Ridge National Laboratory even during a cyber-attack. To protect achieve multi-client communications over (ORNL) against cyber-attacks, many aspects of a single quantum channel, Oak Ridge cybersecurity must be addressed in • Schweitzer Engineering Laboratories National Laboratory (ORNL) developed a parallel. However, authentication and cost-effective solution that combined • EPB encryption of data communication between commercial point-to-point QKD systems • University of Tennessee distributed automation components is of with a new, innovative add-on technology particular importance to ensure resilient called Accessible QKD for Cost-Effective energy delivery systems. Period of Performance Secret Sharing (AQCESS) nodes. Advantages of Quantum Key AQCESS nodes are low-cost modules that October 2016 – September 2019 Distribution modulate the quantum signal being propagated in a commercial QKD Total Project Cost This research is making quantum key channel. Multiple AQCESS nodes can distribution (QKD), a key exchange Total: $4,612,000 utilize the same common QKD channel, technology grounded in the principles of Federal: $3,112,000 allowing any one node to communicate quantum-physics, available to the energy with any other node on the channel. Cost Share: $1,137,319 sector, helping prevent unauthorized access Because the nodes are relatively simple— to critical energy infrastructure data. The having no quantum source or detection use of QKD to exchange secret devices—they have the potential to be cryptographic keys for use in traditional low-cost and can be integrated into encryption algorithms, allows for the real- existing products. This research aims to time detection of an adversary’s attempt to make QKD a near-term solution to help intercept the key exchange, because any secure critical energy infrastructure data attempt to steal the key as it is from unauthorized access. communicated between trusted parties, Cybersecurity for Energy Delivery Systems (CEDS) Contact Information: For More Information: CEDS projects are funded through the Department of Energy’s (DOE) Carol Hawk Duncan Earl • http://energy.gov/oe/technology- Office of Electricity Delivery and Energy Reliability (OE) research and Program Manager Principal Investigator development/energy-delivery- development (R&D) program, which aims to enhance the reliability and DOE OE R&D Qubitekk, Inc. systems-cybersecurity resilience of the nation’s energy infrastructure by reducing the risk of 202-586-3247 (865) 599-5233 • www.controlsystemsroadmap.net energy disruptions due to cyber-attacks. [email protected] [email protected] Figure 1: Commercial Quantum Key Distribution System - 1 Quantum Transmitter (middle), 2 Quantum Receivers (Left/Right) Project Description developed network will provide a Anticipated Results scalable method of authentication and The proposed technology will help data protection that is more secure Project results will include the following: secure communications between against eavesdropping attacks. • Commercially-viable quantum key deployed automation equipment distribution network for the electrical critical to the operation of the Phase 1: R&D of a commercially- grid that provides long-term security electrical grid. viable, prototype quantum network and meets minimum performance The industry-led team will utilize requirements necessary for grid capabilities from quantum product The team will review the design of the automation. developers, automation equipment proof-of-principle AQCESS nodes, • Affordable, long-term security to a large vendors, utilities, national laboratories, and develop firmware to fully integrate number of distributed power system and academia to develop the proposed the QKD system, the AQCESS nodes, devices. technology, which will be integrated and third-party automation equipment. with commercial automation equipment. • Real-time detection of adversarial The team will deploy the technology on Phase 2: System deployment and attempts to steal the cryptographic keys an operational grid where its field testing needed to prevent unauthorized access interoperability, security features, and Twenty automation devices—equipped to critical energy infrastructure data commercial viability will be with integrated pre-commercial demonstrated in a working controlled AQCESS nodes—will be deployed grid environment. with a compatible pre-commercial Tasks QKD system. Testing will include the measurement of system performance The project team will develop and metrics. demonstrate a quantum encrypted network. By integrating newly developed entanglement-based QKD products, 2xN fiber optic switches, and automation devices equipped with enhanced AQCESS nodes, the May 2017 .