Power Grids Require Comprehensive Upgrades Before Quantum Cryptography Implementation
As businesses and organizations accelerate their preparations for a post-quantum world, the operational technology (OT) landscape, particularly in the power sector, presents a significantly distinct challenge. Anwaya Bilas Sengupta, the deputy general manager and alternate Chief Information Security Officer (CISO) at Grid Controller of India, elaborates on the complexities of transitioning to post-quantum cryptography (PQC) within OT environments, emphasizing that this migration is likely to lag behind information technology (IT) systems. He argues that national quantum readiness must assess more than simply updating encryption protocols.
The Tension Between IT and OT Readiness
The discourse surrounding PQC migration often frames it as a primarily IT-oriented challenge, focused on upgrading components such as certificates, Virtual Private Networks (VPNs), and remote access capabilities to guard against future quantum threats. However, Sengupta points out that while the IT segment of OT may see advancements relatively soon—within the next two to three years—other crucial segments will face substantial barriers. This is primarily due to the reliance on outdated systems, proprietary protocols, and the pressing need for real-time operational availability.
The migration can be divided into two fundamental segments. The first segment comprises the IT-heavy portion of OT, which includes systems designed to interface with the internet. This portion includes upgrading relevant security measures, including Public Key Infrastructure (PKI) certificates. It is considered realistic to achieve post-quantum readiness for these systems by 2030. On the other hand, the second segment focuses on the communication protocols unique to OT, which connect field devices to Programmable Logic Controllers (PLCs) and are predominantly based on plaintext exchanges. This latter segment lacks the groundwork necessary for an efficient transition and may require an additional three to four years beyond the 2031 timeline.
Legacy Systems: The Major Roadblock
One of the most significant challenges is the existence of legacy systems that underpin the OT infrastructure. The importance of this infrastructure lies more in its availability than in confidentiality or integrity, a reality that complicates the migration to PQC. Downtime is not an option in a real-time environment where grid stability is paramount. Each system relies on outdated kernels that may not have been updated, leading to considerable variation across the infrastructure.
Patching, a process that is often seen as a straightforward fix, becomes complex in this context. Operators must carefully evaluate how any patch might affect existing communication systems and functionality. Unfortunately, many organizations lack adequate testing environments, such as digital twins of their live systems, to validate these changes. Successful PQC migration will thus require detailed knowledge of the existing systems, identifying components that can be phased out without causing service interruptions, and mapping the dependencies that remain.
Growing Infrastructure Needs
In addressing these challenges, Sengupta emphasizes the need for a comprehensive migration plan that incorporates features like digital twins to facilitate testing and validation. The Centre for Development of Advanced Computing (C-DAC) is actively working on automated tools that facilitate such assessments. India’s National Quantum Mission is presently focused more on IT infrastructures than the OT elements like Supervisory Control and Data Acquisition (SCADA) systems, which adds another layer of complexity.
Sengupta argues that quantum readiness must not only consider PQC but also require an OT infrastructure that enables quicker decision-making based on real-time data analysis. Currently, SCADA and protection systems can respond only within a window of seconds or milliseconds. As quantum technologies evolve, the aim should be to create systems capable of conducting faster analyses, anticipating variations and disturbances, and executing automated responses accordingly.
The Evolving Vendor Landscape
As the discourse evolves regarding PQC migration, the vendor ecosystem also faces scrutiny. Sengupta classifies vendors into two categories: those that develop software for data analytics and visualization, and those focused on Intelligent Electronic Devices (IEDs) and hardware. The response from these vendors has been markedly different, particularly in how they approach the challenges of integrating PQC.
Software vendors are moving at a commendable pace, aligned with government initiatives aimed at creating a quantum-safe infrastructure by around 2029 or 2030. Innovations in visualization platforms and the strategic emphasis on indigenous SCADA systems are positive developments in this context. Conversely, the hardware segment remains fragmented and hesitant. Many vendors grapple with the uncertainty surrounding implementation and its practical implications at the firmware and chip levels.
In conclusion, as power grids navigate the complexities of PQC adoption, the insights provided by Sengupta underscore the critical importance of a comprehensive and thoughtful approach. Successfully bridging the gap between legacy OT infrastructures and new quantum-ready systems will require time, research, and meticulous planning. Only through coordinated efforts will national quantum readiness be achieved, effectively safeguarding vital critical infrastructure for the future.