The “Cyber Security via Determinism” Paradigm for a Quantum Safe Zero Trust Deterministic Internet of Things (IoT)
Ted H. Szymanski
Abstract
The next-generation <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Internet of Things</i> (IoT) will control the critical infrastructure of the 21st century, including the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Smart Power Grid</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Smart Cities</i> . It will also support <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Deterministic Communications</i> , where ‘deterministic traffic flows’ (D-flows) receive strict <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Quality-of-Service</i> (QoS) guarantees. A <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">‘Cybersecurity via Determinism’</i> paradigm for the next-generation <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">‘Industrial and Tactile Deterministic IoT’</i> is presented. A forwarding sub-layer of simple and secure ‘deterministic packet switches’ (D-switches) is introduced into layer-3. This sub-layer supports many deterministic <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Software Defined Wide Area Networks</i> (SD-WANs), along with 3 new tools for improving cyber security: <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Access Control</i> , <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Rate Control</i> , and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Isolation Control</i> . A <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Software Defined Networking</i> (SDN) control-plane configures each D-switch (ie FPGA) with multiple deterministic schedules to support D-flows. The SDN control-plane can embed millions of isolated <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Deterministic Virtual Private Networks</i> (DVPNs) into layer 3. This paradigm offers several benefits: 1) All congestion, interference, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Distributed Denial-of-Service</i> (DDOS) attacks are removed; 2) Buffer sizes in D-switches are reduced by 1000+ times; 3) End-to-end IoT delays can be reduced to ultra-low latencies, i.e., the speed-of-light in fiber; 4) The D-switches do not require Gigabytes of memory to store large IP routing tables; 5) Hardware support is provided in layer 3 for the US NIST <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Zero Trust Architecture</i> ; 6) Packets within a DVPN can be entirely encrypted using <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Quantum Safe</i> encryption, which is impervious to attacks by <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Quantum Computers</i> using existing quantum algorithms; 7) The probability of an undetected cyberattack targeting a DVPN can be made arbitrarily small by using long <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Quantum Safe</i> encryption keys; and 8) Savings can reach <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\$ $ </tex-math></inline-formula> 10s of Billions per year, through reduced capital, energy and operational costs.