Cybersecurity in Critical Infrastructures: A Post-Quantum Cryptography Perspective
Javier Oliva del Moral,Antonio deMarti iOlius,Gerard Vidal,Pedro M. Crespo,Josu Etxezarreta Martinez
DOI: https://doi.org/10.1109/jiot.2024.3410702
IF: 10.6
2024-09-03
IEEE Internet of Things Journal
Abstract:The machinery of industrial environments was connected to the Internet years ago with the scope of increasing their performance. However, this change made such environments vulnerable against cyber-attacks that can compromise their correct functioning resulting in economic or social problems. Moreover, implementing cryptosystems in the communications between operational technology (OT) devices is a more challenging task than for information technology (IT) environments since the OT networks are generally composed of legacy elements, characterized by low-computational capabilities. Consequently, implementing cryptosystems in industrial communication networks faces a tradeoff between the security of the communications and the amortization of the industrial infrastructure. Critical infrastructure (CI) refers to the industries which provide key resources for the daily social and economical development, e.g., electricity. Furthermore, a new threat to cybersecurity has arisen with the theoretical proposal of quantum computers, due to their potential ability of breaking state-of-the-art cryptography protocols, such as RSA or elliptic curve cryptography. Many global agents have become aware that transitioning their secure communications to a quantum secure paradigm is a priority that should be established before the arrival of fault-tolerance. In this article, we aim to describe the problematic of implementing post-quantum cryptography (PQC) to CI environments. For doing so, we describe the requirements for these scenarios and how they differ against IT. We also introduce classical cryptography and how quantum computers pose a threat to such security protocols. Furthermore, we introduce state-of-the-art proposals of PQC protocols and present their characteristics. We conclude by discussing the problematic of integrating PQC in industrial environments.
computer science, information systems,telecommunications,engineering, electrical & electronic