In the face of the threat that quantum computers could crack many of the encryption methods used to protect highly sensitive data, BT has developed a “quantum-secured” network
Many encryption systems are based on the premise that it would take too long for anyone to carry out the mathematical calculations required to reveal the encryption keys, but even basic quantum computers will be capable of determining encryption fast enough for attackers to use.
This would leave critical infrastructure, banking and healthcare networks vulnerable to attack, but to counter this threat, BT has announced the UK’s first practical quantum-secured high-speed fibre network between Cambridge and the BT Labs in Adastral Park, Ipswich.
The announcement comes amid growing concern that huge investments in quantum computing by countries such as China and Russia, as well as US companies like Google and Microsoft, will make quantum computers a reality in the next five to 10 years, and these systems would be capable of cracking most encryption systems in use today.
China, in particular, is known to be investing heavily in developing a quantum computing capability for both defensive and offensive purposes, and although Europe is also investing in developing quantum computing capabilities, the investment pledged so far is way below what China is investing.
The collaborative project was led by the Quantum Communications Hub, part of the UK National Quantum Technologies Programme. The hub is a collaboration between eight UK universities, private companies and public sector stakeholders that have common interests in the exploitation of quantum physics for the development of secure communications technologies and services.
Constructed by researchers from BT, the University of York and the University of Cambridge over the past two years, the “ultra-secure” connection, secured by the laws of physics, was built as part of a project co-funded by the Engineering and Physical Sciences Research Council (EPSRC).
Quantum-secured connections
The quantum-secured link, which will connect to the Cambridge Metropolitan QKD (quantum key distribution) Network, runs across a standard fibre connection through multiple BT exchanges over a distance of 120km, making it the first high-speed “real-world” deployment of quantum-based network security in the UK.
The network link, which is capable of transferring 500Gbps of data, will explore and validate use cases for QKD technologies. This will include how the technology can be deployed to secure critical national infrastructure, as well as to protect the transfer of critical data, such as sensitive medical and financial information.
The quantum link itself is said to be virtually “unhackable” because it relies on the use of single particles of light (photons), to transmit data encryption “keys” across the fibre. Should this communication be intercepted, the sender will be able to tell that the link has been tampered with and the stolen photons cannot then be used as part of the key, rendering the data stream incomprehensible to the hacker.
The partners are using equipment from ID Quantique to transmit the data encryption key using a stream of single photons across the fibre network. In parallel, the encrypted data flows through the same fibre, powered by equipment from ADVA optical networks.
“With the huge growth in cyber attacks across the UK, it’s more important than ever before that we continue to develop ways to protect the most critical data”
Tim Whitley, BT
The fibre runs from Cambridge University Engineering Department’s Centre for Photonic Systems via quantum repeater stations at Bury St Edmunds and Newmarket before making its way to the BT Labs in less than one-thousandth of a second.
Tim Spiller, director of the EPSRC Quantum Communications Hub, said: “We know that QKD technology works. The importance of this network is the demonstration of its operation to potential users and customers in a practical network environment to stimulate market pull.”
Ian White, head of photonics research at the University of Cambridge, said: “This quantum-secured network is an excellent example of the large-scale collaborative research that is feasible because of the creation of the UK’s Quantum Communications Hub. The network will allow detailed analysis of the potential for this new technology to enhance security in advanced communication networks.”
Tim Whitley, BT’s managing director of research and innovation, said: “With the huge growth in cyber attacks across the UK, it’s more important than ever before that we continue to develop ways to protect the most critical data.
“BT has a long history of pioneering innovation so I’m delighted that we’re able to announce this major breakthrough in the field of quantum communications. This is a brilliant example of how academia and business can work together to develop ultra-secure networks to give us the confidence we need in our future digital economy.”
Organisations that do not start preparing now could end up exposing critical data because their encryption methods are not quantum computing-ready, warned Jaya Baloo, CISO of KPN Telecom in the Netherlands.
The good news is that all the symmetric encryption currently in use is unlikely to be affected by the arrival of quantum computing. “As long as we keep refreshing keys and following best practices for transferring keys, we are good to go,” said Baloo.
“The problem arises when it comes to asymmetric encryption. It is all the public key cryptography that is out there because it is based on complex mathematical problems that would take even a supercomputer a long time to solve, but that principle breaks down with quantum computers,” she said.
Although it may already be too late to ensure organisations’ encryption processes are completely secured against cracking by quantum computers because it could take up to 20 years for quantum computing-proof algorithms to mature and be fully integrated into organisations, Baloo said there were things that information security professionals could and should do now to ensure they are not totally defenceless.
“It is about ensuring that organisations are agile when it comes to encryption and have the ability to adapt and to implement post-quantum ciphers and algorithms when they become available,” said Baloo.
“I want to encourage information security professionals to document their organisations’ current situations, to examine and understand their current cryptographic landscape and consider how to extend that into action,” she said.
Baloo advised companies, at the very least, to consider extending the length of their encryption keys to the maximum possible under whatever encryption system they are using, to consider implementing quantum key distribution to preserve the integrity and confidentiality of data, and to start preparing to replace existing algorithms with post-quantum algorithms.
