Export PDFWhat Is Quantum Security?
Quantum security leverages two core technologies—Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC)—to build a security system capable of defending against threats from quantum computers, thereby ensuring data confidentiality and integrity. QKD operates based on quantum mechanics principles (such as the no-cloning principle) to implement unconditional, secure key distribution. PQC employs quantum-resistant algorithms (such as the lattice-based cryptographic algorithm) to safeguard traditional encryption algorithms against threats posed by quantum computing. Quantum security technologies have been widely used in many industries, like communications, finance, and cloud storage, offering reliable protection for future data security.
Why Do We Need Quantum Security?
Technical Background of Quantum Security
In the digital era, data security underpins national security, enterprise security, and personal privacy. Traditional cryptographic algorithms rely on the computational complexity of mathematical problems (such as integer factorization and the discrete logarithm problem) to ensure data security. However, the rapid development of quantum computing technologies threatens the security of these traditional cryptographic algorithms.
- Quantum computing threats
Quantum computing technology follows quantum mechanics principles to perform information processing and computing using quantum bits as fundamental units. Its core advantages stem from the following key features:
- Superposition: A quantum bit can represent both 0 and 1, enabling parallel computation of multiple states.
- Entanglement: Strong correlations are established between multiple quantum bits, further enhancing overall computational efficiency and collaboration capabilities.
By harnessing superposition and entanglement, quantum computers can process vast amounts of data in parallel. Shor's algorithm reduces the complexity of cracking asymmetric cryptography from exponential to polynomial, so that a password can be cracked in seconds. Meanwhile, Grover's algorithm halves the security strength of symmetric cryptography, which means that the key length must be doubled to maintain the original security level. This poses a disruptive threat to the existing cryptographic system: asymmetric algorithms become completely insecure and must be entirely replaced with quantum-resistant algorithms. Although symmetric algorithms remain effective, they face the risk of brute-force attacks.
More seriously, there is the "Harvest Now, Decrypt Later" risk. Attackers can obtain and store encrypted data in advance, waiting for quantum computers to mature before decrypting it. This type of latent attack poses a significant threat to data requiring long-term confidentiality, such as financial data.
- Driven by service requirements
In critical infrastructure sectors such as finance, government, industry, and electric power, communication data demands extremely high confidentiality. Traditional encryption methods are no longer sufficient to defend against quantum computing threats, making the upgrade to quantum-resistant encryption an urgent need.
- Finance: International settlement and cross-border payment require protection against fund security risks posed by quantum computing. The maturity of quantum computing could lead to the collapse of traditional cryptographic systems. Therefore, financial institutions need to deploy quantum encryption platforms in advance to meet regulatory requirements and services' security requirements.
- Government: A quantum security architecture must be established for e-government and national critical information to secure national secrets and sensitive data.
- Industrial Internet: Industrial control system communication must ensure data confidentiality for over 10 years to prevent long-term stored data from being decrypted by quantum computers in the future.
Value and Advantages of Quantum Security Technologies
To address the threats posed by quantum computing, quantum security technologies have emerged. Their core value and advantages are primarily reflected in the following aspects:
- Defense against quantum computing threats to ensure long-term data confidentiality: These technologies address the issue of traditional asymmetric cryptography being cracked in seconds by quantum computers and help defend against long-term "Harvest Now, Decrypt Later" attacks, ensuring the security of sensitive data in finance, government, and other sectors.
- Compliance with regulatory requirements: These technologies help key sectors such as finance, government, and electric power meet national regulatory requirements, support end-to-end quantum-secure communications, and ensure the security of data throughout its lifecycle, including transmission, storage, and processing.
- Theoretical unconditional security: QKD technology is based on the quantum mechanics principles of no-cloning and no-eavesdropping. Any attempt at eavesdropping will disturb the quantum state and be instantly detected by both communicating parties. Once eavesdropping is detected, both parties immediately discard the current key and generate a new one, ensuring absolute communication security.
- Support for smooth migration and service continuity: Hybrid encryption or software upgrades (such as PQC) can be used to implement quantum resistance while retaining existing infrastructure. This reduces service interruptions caused by technological iterations.
Promoting and applying quantum security technologies are not only a necessity for countering emerging quantum threats but also a key to advancing industries and ensuring future data security.
Key Quantum Security Technologies
Quantum security technologies like QKD and PQC are vital for coping with quantum computing threats and safeguarding data during transmission and storage by leveraging quantum-resistant cryptography algorithms and quantum physics. QKD is a protocol that uses quantum physics to securely distribute keys, while PQC is a cryptographic algorithm designed to withstand quantum computing attacks based on the traditional computing architecture.
QKD
QKD is used to securely generate and distribute encryption keys between two communicating parties. It transmits keys based on quantum states (such as the polarization state of a single photon) and safeguards the communication process by relying on the fundamental principles (such as the uncertainty and no-cloning principles) of quantum mechanics. Unlike traditional key distribution methods, QKD does not rely on computational complexity for its security but instead bases its security on physical laws. Therefore, it offers theoretically unconditional security, meaning that even an eavesdropper with unlimited computing power cannot intercept a key without being detected.
The BB84 protocol, named after its inventors Charles Bennett and Gilles Brassard in 1984, is one of the earliest and most famous protocols in the QKD family. In this protocol, the sender (usually called Alice) encodes information by randomly selecting the polarization direction of a photon, and the receiver (usually called Bob) randomly selects a method for measurement. After the communication is complete, the two parties compare some of the measurement results over a public channel, selecting the consistent bits to form a shared key. This approach ensures that any eavesdropping attempt introduces detectable errors, which can be identified by both parties.
With QKD technology, a QKD communication system consisting of multiple key distribution nodes can be constructed to implement large-scale and highly secure key distribution and communication. This technology has been deployed in sectors with extremely high security requirements, such as government, finance, and healthcare, providing quantum-level security assurance for critical information infrastructure.
QKD Communication System
A QKD communication system primarily consists of a quantum application network, a Key Management System (KMS), and a Quantum Key (QK) physical network, as illustrated in the figure below.
QKD communication system
- Quantum application network
Leveraging QKD, this network offers a quantum-secure communication channel built over a traditional IP network.
- KMS
The KMS uses QKD and Chinese cryptographic algorithms to manage keys in a unified manner. It stores, distributes, and updates keys through key management servers, providing efficient and secure key services for service systems. The KMS focuses on key management and distribution to ensure that a service system can securely obtain and use keys.
- QK physical network
This network is a dedicated physical network built based on quantum mechanics principles. It is designed for highly secure key transmission and sharing through QKD. This network is mainly composed of Quantum Key Distribution and Management (QKDM) terminals, which implement functions such as generating, storing, synchronizing, relaying, and outputting keys.
Through collaboration between these three networks, the QKD communication system can implement end-to-end security from key generation to key transmission and application, providing communication assurance for data communication against quantum computing threats.
QK Application and Distribution
The QK application and distribution process is vital for the QKD communication system. This process ensures that keys are securely generated and transmitted between two communicating parties. The following figure shows the QK application and distribution process. DeviceA functions as the service initiator, and DeviceB as the receiver.
QK application and distribution process
- Negotiating QK-based encryption
DeviceA sends packets from its service component to DeviceB to negotiate the use of QKs for encrypted communication.
- Obtaining a QK by DeviceB
DeviceB functions as a client and initiates an HTTP/HTTPS connection request to the KMS.
DeviceB uses an injected key to exchange two login requests. After being authenticated, DeviceB obtains a QK.
- Returning the KeyID of the QK
DeviceB sends packets from its service component to DeviceA to return the KeyID of the obtained QK.
- Synchronizing the QK to the initiator
Key management server B synchronizes the QK obtained by DeviceB to key management server A, ensuring that the QK is available on both ends.
- Obtaining a QK by DeviceA
DeviceA functions as a client and initiates an HTTP/HTTPS connection request to the KMS.
DeviceA also uses an injected key to exchange two login requests. After being authenticated, DeviceA obtains a QK that has the same KeyID as the QK obtained by DeviceB.
- Establishing a quantum-encrypted channel
DeviceA and DeviceB use the obtained QKs to encrypt the service data channel, establishing a secure quantum-encrypted channel.
PQC
PQC is a new cryptographic technology that can still ensure security in the quantum computing era. Its goal is to design and implement cryptographic algorithms that remain effective against quantum computer attacks. These algorithms are typically based on certain mathematical problems that are difficult to solve efficiently on both classical and quantum computers. This ensures that data security can still be guaranteed even in the future when quantum computing technologies become widespread.
Common PQC algorithms are classified into the following types:
- Lattice-based cryptographic algorithm: leverages mathematical problems in high-dimensional lattice structures, such as the shortest vector problem and the closest vector problem.
- Hash-based cryptographic algorithm: utilizes the one-way and collision-resistant properties of hash functions to construct signature and encryption mechanisms.
- Code-based cryptographic algorithm: relies on the decoding problem in the error-correcting code theory.
- Multivariate-based cryptographic algorithm: works based on the hardness of solving systems of multivariate nonlinear equations.
Typical Application Scenarios of Quantum Security
In real-world applications, quantum security is deeply integrated with security protocols such as IPsec and Xsec to provide communication assurance against quantum computing threats for industries with high security requirements, such as finance and electric power.
Typical Application of QKD
Take the electric power industry as an example. To address the severe challenges posed by quantum computing, a quantum security communication solution that combines QKD and IPsec can be used to defend against quantum attacks and ensure the security of power grid data.
As shown in the following figure, each device functioning as an IPsec VPN gateway interacts with the QKD network to obtain a quantum key. The quantum key is used to enhance the IPsec security mechanism, thereby establishing a highly secure IPsec-encrypted tunnel over the physical link between the master station and substation in the power system. To defend against quantum computing threats, this tunnel provides data confidentiality and integrity protection for key services such as differential protection and precise load control.
Application of QKD in IPsec-based encryption and decryption
Typical Application of PQC
Take the financial industry as an example. The combination of PQC and Xsec implements quantum encryption communication with enhanced security, effectively countering quantum computing attacks and addressing the issues of complex configuration and insufficient security in traditional point-to-point encryption.
As shown in the following figure, a bank uses SRv6 to build an intelligent network between the HQ and branch, and adopts the Xsec solution integrated with PQC to achieve quantum-secure communication. In this solution, PQC algorithms are deployed during the establishment of BGP secure channels to exchange keys, thereby defending against quantum computing attacks at the protocol layer. In addition, the solution combines control-plane PQC hardening with data-plane high-strength encryption based on Xsec's in-line encryption mechanism. This dual-protection system effectively defends against current cryptographic cracking and future quantum computing threats, ensuring the secure transmission of financial services in the post-quantum era.
Application of PQC in Xsec-based encryption and decryption
- Author： Gao Tingting
- Updated on： 2026-10-15
- Views： 2468
- Average rating：
