Toward Quantum Secured Distributed Energy Resources: Adoption of Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD)

Abstract

Quantum computing is a game-changing technology that affects modern cryptography and security systems including distributed energy resources (DERs) systems. Since the new quantum era is coming soon in 5–10 years, it is crucial to prepare and develop quantum-safe DER systems. This paper provides a comprehensive review of vulnerabilities caused by quantum computing attacks, potential defense strategies, and remaining challenges for DER networks. First, new security vulnerabilities and attack models of the cyber-physical DER systems caused by quantum computing attacks are explored. Moreover, this paper introduces potential quantum attack defense strategies including Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), which can be applied to DER networks and evaluates defense strategies. Finally, remaining research opportunities and challenges for next-generation quantum-safe DER are discussed.

1. Introduction

Distributed Energy Sources (DER) such as wind turbines and solar panels are being added to the power system as carbon-neutral policies are promoted around the world. Over the past decade, the proportion of PV and wind-turbine power generation has increased. In California, power generated by PV accounted for 21% of the total power supply [1,2,3]. The number of DERs is on the rise, and the need for a network to control the DER system has increased for the stable operation of the entire system [1,2,3].

Wind speed and solar radiation cannot be controlled, and the amount of power generated by the DER system entirely relies on these meteorological phenomena. Thus, if the DER system is added to the entire power system without control, the DER system induces active power imbalance between generation and demand sides [4,5,6]. The need for security of the DER network increases because active power imbalance can shut down or damage the entire system [4,5,6,7,8]. The DER network connects DER devices to DER management systems (DERMS) in order to monitor the current state of DER and control the active power supply of DER. The DER network also connects DERMS to utilities to keep the entire system stable [4,5,6,7,8]. As the amount and importance of information transmitted and received in the DER network also increase, the interest and importance of DER network security also increases [4,5,6,7,8,9,10,11,12,13,14,15]. Many standards have been established for the security of DER networks [10,16,17,18,19,20,21,22,23,24,25,26,27]. Essentially, these standards protect the DER network with security protocols based on encryption technology [10,16,17,18,19,20,21,22,23,24,25,26,27,28]. However, the development of quantum computing poses a significant threat to the security of current cryptographic systems adopted in DER systems.

Quantum processors have powerful calculation capabilities and can dramatically decrease the time to break existing encryption algorithms [29,30,31,32]. According to [32], half of the existing encryption algorithms will become useless because of quantum computing attacks. Despite a new wave in cryptography technology, quantum attack strategy, method, model, and solution have not been researched yet. It is necessary to predict future quantum attacks and identify vulnerabilities of the DER network to protect the DER network against future quantum attacks [4]. In addition, depending on the vulnerability, new encryption and security technologies should be appropriately applied to the DER network [4].

In order to prepare for the quantum era, this paper analyzes the DER network attack model using quantum attacks, and we also predict when quantum attacks become possible. Then, in order to protect these quantum attacks on the DER network, we consider a method to introduce new encryption and security technologies (i.e., quantum key distribution (QKD) and post-quantum cryptography (PQC)) into the DER network. Conventional studies have, respectively, applied PQC or QKD to DER, and their practicality is low [33,34,35,36,37,38,39,40,41]. In this paper, we consider the practical problems (i.e., network delay, network structure, and cost) when PQC and QKD are simultaneously applied to the DER network. The contributions of the paper are summarized as follows:

• Estimate when quantum attacks can be possible by analyzing current quantum computing technology trends;
• Predict the possible quantum attacks on the DER network;
• When PQC is applied to the DER network, analyze the network delay and compare this delay with the IEEE 2030.5 protocol;
• To apply QKD to the DER network and analyze QKD in terms of communication distance, data rate, and cost;
• When PQC and QKD are simultaneously applied to the DER network, we propose a new DER network structure by considering network delay and implementation cost.

This paper is organized as follows. In Section 2, we analyze the current state of quantum computer development and predict when a quantum attack becomes possible. We also estimate what types of quantum attacks are possible for the DER network and analyze the impact of those attacks on the entire power system in Section 2. Section 3 introduces technologies to defend against the predicted quantum attack in Section 2. We also analyze the issues to be considered when applying this technology to DER. Section 4 concludes and describes future research by the DER network to prepare for the quantum era.

2. Prediction of Future Quantum Attacks on DER Network

This section estimates when encryption algorithms used in the DER network protocol will become insecure according to the trend of quantum computer development. First, the security protocol and encryption algorithm used in the DER network will be described. Then, with the development of quantum computers, we will predict when the current security protocol will not guarantee safety.

2.1. The Security Protocol of the DER Network

DER networks are huge networks that connect DER devices and control devices (SCADA and DERMS) and power plants for the stable operation of the entire system and DER systems. In addition, the DER network is a combination of a sensor network and an existing data communication network for monitoring the current state of the DER device and to control it appropriately. In order to secure the DER network, many standards have been established according to the type of DER system [10,16,17,18,19,20,21,22,23,24,25,26,27,28].

IEEE 1547-2018 mandates DER communication protocols including IEEE 2030.5 (i.e., Smart Energy Profile 2.0 (SEP2)), IEEE 1815 (DNP3), IEC 61850, and SunSpec Modbus. Specifically, California Rule 21 mandates that new DER interconnection with Electric Power Systems (EPS) in California must be ready to communicate to a host utility using the IEEE 2030.5-2018 standard [16]. Figure 1a shows an example of a DER network structure in compliance with IEEE 2030.5 [10], where DER devices are monitored and controlled by a utility’s DER management system (DERMS) or by a DER aggregator (for behind-the-meter (BTM) DER such as home DER and building DER). DERMS and aggregators monitor each part of the DER device in order to keep the DER system stable, which is referred to as a logical node (LN) [42,43,44,45,46,47,48]. LNs in wind turbines and solar panels are represented in Figure 1b.

In Figure 1a, DER devices are monitored and controlled by a utility or by a DER aggregator (for behind-the-meter (BTM) DER such as home DER and building DER). DERMS and a DER aggregator monitor DER devices and sends control commands (e.g., set points/operating points and on/off commands) to these smart inverters by using the SEP2 protocol. Figure 1b shows the specific network structure of DER device monitoring and control network. The sensor value measured at each LN of the DER device is regularly transmitted to the Smart Inverter (SI) and DERMS by using a message in a goose or SV type. DERMS checks the state and output of the DER device based on the received sensor value and controls DER devices.

DER network data are encrypted and authenticated by TLS with SunSpec PKI certificates that are provided by the authorized issuers to fulfill California Rule 21 compliance. Moreover, IEC 61,850 and IEE 1547 protocols utilize TLS-based encrypted traffic (i.e., HTTPS) and X-509 digital certificates for server and client authentications. Although SunSpec Modbus and Modbus TCP implementations do not generally support TLS, incorporating TLS wrapper (e.g., Modbus TLS [17]) enables the use of TLS. Analysis of the current DER network standards shows that the current DER network relies on TLS for security.

TLS is a security protocol that verifies each other (client and server) and encrypts data. By using signature and authentication algorithms, client and server verify one another. Then, the client and server exchange symmetric keys to encrypt data. This process is called a handshake. After the handshake, encrypted data are transmitted. The version of TLS used for each protocol is summarized in

Table 1. TLS version for DER security protocol.

Protocol	Version of TLS
IEC 61850	TLS 1.1/TLS 1.2
IEC 60870-5
IEC 61968
IEEE 1815
DNP3-SA
IEEE 2030.5 (SEP2)	TLS 1.3

[10,16,17,18,19,20,21,22,23,24,25,26,27,28].

The latest version of TLS is 1.3., and it is only introduced in IEEE 2030.5 [16]. TLS 1.3 uses Authenticated Encryption with Associated Data (AEAD), which performs encryption and authentication at the same time. The key exchange, AEAD, and the signature algorithm used in TLS 1.3 are described in

Table 2. Encryption and signature algorithm of TLS 1.3.

AEAD		Key Exchange	Signature and Certification
Bulk Encryption	Hashing
AES-128 GCM	SHA 256	ECDHE	RSA
AES-128 CCM	SHA 256		ECDSA(X. 509)
AES-256 GCM	SHA 384		EdDSA

[43,49].

If the algorithms in Table 2 become insecure due to quantum attacks, the security of the DER network is not guaranteed either. The next subsection describes future quantum attacks on the DER network.

2.2. Predicting Possible Quantum Attacks

Future quantum attacks on the DER network are analyzed based on current attack methods and strategies. In the future, even if an attacker can break the encryption algorithm of the DER network by using a quantum computer, the purpose of the attack is not much different from present purposes. Thus, by analyzing the strategy of the current attack on the DER network, a quantum attack on the DER system can be predicted more realistically in the future.

The main purpose of attacking the DER network is to shut down the entire power system, obtain confidential information, or gain illegal benefits [43,44,45,46]. In order to achieve these goals, attackers set up strategies. Security experts are studying attack models and strategies to prevent the attack and find vulnerabilities of the DER network [6,14,50,51,52]. The attack model is generally divided into 9–12 steps [6,14,50,51,52]. However, these steps can be briefly summarized as four steps according to certain goals: 1. collecting information and analyzing vulnerabilities; 2. selecting target, route, and means of attack; 3. attacking; and 4. eliminating traces. This strategy is shown in Figure 2.

In Figure 2, if the DER network is protected by TLS 1.3, the attacker uses a method to bypass the firewall. In the first step, port scanning tools such as Nmap or sniffing tools such as wire shark or packet capture can be utilized to collect information. The attacker can understand the network structure of the system by using the collected information and find the attack route by using port numbers or packets containing user IDs and passwords. In the second stage, the attacker sets the target and delivers attack tools such as worm, virus, trojan horse, adware, and spyware to the target system. Delivery methods can be websites, apps (APP), emails, P2P, and also be physical connections such as USBs, external hard drives, and stick PCs [51,52]. If the attacker invades the target system by using a rootkit or desired malware, an attacker can obtain confidential information or administrative authority of the target system.

The defense methods are different for each step from step 1 to step 3. The defense methods for the first and second steps are for preventing invasion in networks and extortion of authentication [51,52]. In the third step, since the attack on DER has already happened, defense methods are focused on the detection and restoration of abnormalities in the system [51,52]. Thus, quantum attacks can be utilized to break the first and second steps. When quantum attack is feasible, the attacker does not have to bypass the TLS 1.3 firewall, and the attacker can succeed in the attack only with the first step because the quantum attack renders TLS 1.3 encryption for the DER network useless. Therefore, this paper considers the attack model, which invades from the outside of the DER network and does not consider the bypass attack model that induces leakage of the encryption key inadvertently.

In order to predict future quantum attacks, assume that the attacker attacks DERMS or DER server in Figure 1a. When the encryption of each part of the TLS 1.3 protocol is broken, it analyzes what types of attack is possible. If the attacker can break only the key-exchanging algorithm, the attacker can obtain the Encryption Key (EK) from DERMS and SI handshake. If an attacker can break AEAD using a quantum attack, the attacker can obtain confidential information only with a communication message between DERMS and SI. In addition, obtaining the communication message is easy. If the DER network uses Wi-Fi, Raspberry Pi, or Modbus, attackers can easily sniff messages exchanged between devices in the DER network using packet capture or wire shark. Thus, when AEAD and key-expending algorithms are broken by quantum attacks, privacy security in the DER network is not guaranteed. Figure 3 shows the future quantum attack process based on a sniffing attack.

Let us assume that quantum computing attacks break not only AEAD and key exchanging algorithms but also signature and certification (X.509). The attackers can perform a Man in The Middle (MiTM) attack by pretending to be SI on the DERMS or pretending to be DERMS on the SI. In this case, an attacker may not only steal confidential information but also shut down the entire power system or gain illegal benefits. For example, the attackers can earn illegal benefits by manipulating the amount of curtailment or unit price. In addition, the attacker can shut down the entire power system by manipulating the output during valley load filling or peak load clipping. Figure 4 shows future MiTM quantum attack processes.

As shown in Figure 3 and Figure 4, the method and purpose of the attack vary depending on which part of the TLS 1.3 security protocol is broken by a quantum attack.

Table 3. Future quantum attack on DER depending on TLS 1.3.

Key Exchange	AEAD	Signature and Certification	Attack Methods
◯	╳	╳	The private key is exposed to an adversary. Compromise a user’s private key.
╳	◯	╳	All data (data in transit and data at rest) are decrypted.
◯	◯	╳	Session keys are exposed to an adversary. All data are decrypted.
◯	◯	◯	Private keys are exposed to enemies. Certificate modification. Pretend to be an authenticated user.

shows possible attack methods according to parts of the TLS 1.3 security protocol.

In the next subsection, we predict when quantum attacks will become possible based on the current status of quantum computer development.

2.3. Predicting When Quantum Attacks Become a Reality

Quantum computers calculate using the principle of quantum entanglement or superposition. The unit of information processed by quantum computers is called Q-bit, which is the same concept as a bit in existing computers. Q-bit can represent 0 and 1 at the same time while the bit represents 0 and 1, respectively. Conventional computers can calculate $n$ bit at once while a quantum computer can calculate $2^n$ bit. Thus, quantum computers have faster computational speeds than a conventional computer, and problems that take trillions of years on conventional computers can be calculated in seconds on quantum computers [53,54,55,56,57,58,59,60,61,62,63]. However, the fast computational speed of quantum computers is a major threat to cryptographic algorithms.

Existing cryptographic algorithms use mathematical or computational complexity to obtain security. However, if a quantum computer has a large number of Q-bits for easily solving the encryption algorithm in Table 2, the security of the DER network is not guaranteed. It is necessary to predict the development trend of quantum computers in order to know when quantum attacks become possible. There was a previous study predicting quantum computer development trends in 2009 [64]. However, in 2009, quantum computer research was in its infancy, and actual quantum computer developments were rare; thus, the current development situation and predicted results in [64] are very different. After that, the trend of quantum computer development was predicted based on Moore’s law, and most of the results predict that processors with a Qbit of 10⁵ will be developed by 2030 [65,66,67]. IBM’s roadmap aims to develop a mega-Qbit (10⁶) processor after 2026 [68]. This paper predicted development trends based on currently developed quantum processor specifications [69] and the IBM quantum computer development roadmap [68]. We also predicted when the algorithm in Table 2 was broken based on the quantum processor development trend. The results are represented in Figure 5.

In Figure 5, the black asterisk represents the number of Q-bits of the already developed quantum processor, and cyan colored asterisks represent the roadmap presented by IBM. In this paper, the current development status and IBM roadmap results were curve-fitted with 95% reliability to predict the quantum processor development trend. When performing curve fitting, the exponential function is utilized as a base model in accordance with Moore’s law. As a result, three curve fitting results (black, cyan, and magenta line) were obtained. The black line in Figure 5 is the result of curve fitting using the currently developed quantum processor (black asterisk). The magenta line is the result of curve fitting using the current developed quantum processor (black asterisk) and IBM roadmap (cyan asterisk). The cyan line is the result of curve fitting only with IBM’s development results and roadmap. The prediction results show that the mega Qbit processor will be developed as early as 2026 and 2040 at the latest.

In Figure 5, the marker color represents the security level of the encryption algorithm. Red, green, and blue represents one, three, and five, respectively. Figure 5a,b show symmetric encryption algorithms and key exchange and signature and certification, which are utilized in TLS 1.3, respectively. In Figure 5b, ECDSA, EdDSA, and ECDHE are represented by Elliptic Curves Cryptography (ECC) because they are made based on the same mathematical principle of elliptic curves.

Recent cryptoanalysis studies show that decrypting cryptographic algorithms currently used in DER networks requires processors with thousands of Q-bits [54,55,56,57,58,59,60,61,62,63]. Considering this trend of development, the threat of quantum attacks is expected to be realized in a few years. In Figure 5a, the symmetric key algorithm will not guarantee security after 2032. In Figure 5b, all algorithms used for key exchange and signature and certification will be insecure after 2036.

In Figure 5a, the probability of attack success on AES varies depending on the number of plaintext-ciphertext pairs, and it should be considered to prevent quantum attacks on the DER network. In Figure 5, $r$ represents the minimum number of plaintext-ciphertext pairs required for the 100% success of the attack. If the AES key is used less than $r$-times, an attacker cannot succeed in a quantum attack. However, to operate the DER system stably, monitoring and control messages must be exchanged at very short time intervals. Therefore, it is necessary to analyze whether key distribution delay is less than the minimum delay required by the DER network.

As a result of the analysis, future quantum attacks will be realized after only a few years. In addition, as a result of the quantum attack model on the DER network, the vulnerabilities of the DER network are founded in the first and second steps. In order to increase the security of the DER network, in the first stage, security protocols must prevent the attacker from obtaining or eavesdropping on physical signals. In the second stage, encryption techniques that cannot be broken by quantum attacks are required. Novel protection technologies that meet this purpose include Post Quantum Cryptography (PQC) and Quantum Key Distribution (QKD).

PQC is a future encryption technique that is not broken by quantum attacks, and QKD is a physical layer communication technique that uses quantum communication to determine whether physical signals are eavesdropped on or not. Therefore, in order to prepare for future quantum attacks, these two techniques need to be applied to the DER network.

3. Post-Quantum Era Technologies

In this section, PQC and QKD are briefly described, and the feasibility of the DER network of these two technologies is analyzed in terms of network performance and implementation cost.

3.1. Post-Quantum Cryptography

Post-Quantum Cryptography (PQC) is a novel encryption algorithm that can guarantee safety against quantum computer attacks. The National Institute of Standards and Technology (NIST) has been conducting quantum-resistant cryptography contests since 2016 to develop PQC. By implementing this contest, NIST aims to complete a standard for quantum-resistant cryptography by 2022, and the target algorithms include the signature Key Exchange Mechanism (KEM). Note that the symmetric encryption algorithm is not included as a target. In July 2020, NIST selected 15 algorithms as a candidate for three rounds. Among 15 algorithms, seven algorithms were selected as final candidates. The remaining eight are alternative candidates, and these algorithms are preliminary algorithms in case defects are found in the final candidate algorithm. Currently developed quantum-resistant cryptography is divided into five types (Lattice, Code, Hash, Isogeny, and Multivariate).

Table 4. PQC algorithms in NIST round 3.

Type	Advantage	Disadvantage	Algorithm
Lattice	Fast operation speed	Difficult setting parameter	Sig.	CRYSTALS-DILITHIUM, FALCON
			KEM	CRYSTALS-KYBER, NTRU, NTRU prime, SABER, FRODO
Code	Small signature size Fast operation speed	Large key size	Sig.	—
			KEM	Classic McEliece, BIKE, HQC
Multivariate	Fast encryption and decryption speed	Large key size	Sig.	Rainbow
			KEM	—
Isogeny	Small key size	Slow operation speed	Sig.	—
			KEM	SIKE
Hash	Safety proof possible	Large signature size	Sig.	SPHINCS+, PICNIC
			KEM

shows the advantages and disadvantages of algorithms [70].

As shown in Table 4, the problems with applying PQC to the DER network are larger signatures, key sizes, and slower computational speeds compared to current encryption algorithms. For example, the Rainbow algorithm has a 1200-times larger public key size than ECDHE of TLS 1.3 [39,40,71,72].

The larger the size of the key and signature, the more data there are to be transmitted and received between SI and DERMS. In addition, the processing speed is slowed down due to the increased size of the key and signature. This delay increases handshake time, and it can be a big problem considering future quantum attack characteristics in Section 2. Previously, in Section 2, the probability of quantum attack success depends on the number of plaintext–ciphertext pairs ($r$). Therefore, the number of usages of the encryption key must be less than $r$, and the key must be destroyed after being utilized $r$ times. Then, all devices must receive a new key. Since continuous monitoring is required to operate the DER grid stably, it is difficult to apply PQC to the DER network when the time for the key distribution is greater than the time required for stable operation of the DER grid. Therefore, when PQC is applied to the DER network, the time required for key distribution should be analyzed.

In this paper, in order to analyze which PQC algorithm can be applied to the DER network, the key distribution delay according to the number of devices in the DER network is analyzed. In order to analyze the key distribution delay, assume a DER network, as shown in Figure 6. Each DER device is connected to an SI, and it is connected to DERMS. It is assumed that SIs are divided into sectors, and SIs existing in the same sector are connected by a network hub. The network assumed wired ethernet, which follows the 802.3z protocol.

The actual DER grid senses several LNs, but in this paper, it is assumed that the DER network monitors only the Voltage Regulating part for simplicity of the experiment. Referring to the DER grid using the IEEE 2030.5 protocol, the Voltage Regulating Device (VRD) reporting cycle is 2 s~5 s [73,74].

SI and DERMS were implemented using a virtual machine. The virtual machine was made into an Ubuntu (64-bit) operating system with 2Gram on a computer equipped with AMD Ryzen 53500U. The PQC applied TLS1.3-based DER network is implemented with OQS-OpenSSL. X.509 was utilized as certification. The cipher suite was configured with PQC KEM and the Signature with the same security level. AES 128, 192, and 256 are adopted as the symmetric algorithm according to the security level. In this network, according to the cipher suit and the number of devices, the time required to distribute keys is measured, and the results are shown in Figure 7.

In Figure 7, the results show that the key distribution delay is more affected by the Signature algorithm than the KEM algorithm. In Figure 5, the minimum $r$ for AES 128 is 1, and for AES 192 and 256, the minimum $r$ is 2. If the security level is one, the key can only be used once, and if the security level is three or five, the key can only be used twice. Therefore, keys must be distributed every 2 to 5 s when the security level is one, and the key distribution period is 4~10 s when the security level is three or five. Figure 7a,b show that the key distribution delay is all less than 2 s; thus, QKD with a security level of one and three is expected to be applicable to the current DER network. In the case of using Rainbow-5 in Figure 7c, a key distribution delay is 9 s when the number of SI is 50. If Rainbow 5 (Blue group in Figure 7c) is to be written as the signature algorithm, the number of SI must be set to less than 50. Therefore, in order to apply PQC to the DER network, it is necessary to determine an appropriate security level according to the importance of information to be transmitted and select an appropriate PQC algorithm according to the size of the DER grid.

In this paper, only a VRD cycle is considered as an example. However, the practical DER system requires several millisecond delays to react when controlling critical factors such as Load Frequency Control (LFC) [10,25,26,27,28]. In this case, the algorithm that satisfies this condition is only based on the lattice of security level one. Therefore, it is necessary to make a PQC lighter to apply to the DER system. Figure 7 shows that the key distribution delay of Lattice-based algorithms, such as Falcon, Saber, NTRU, and Frodo, showed less and better performance than other algorithms. As the grouped results in Figure 7 show, the signature algorithm plays a more important role than the KEM algorithm on network performance of key distribution delay.

Therefore, it is feasible to apply a lattice-based algorithm to the current DER network. However, if a new quantum computing algorithm is developed that can speed up the calculation of lattice, the security of lattice-based algorithms is threatened; thus, research should be conducted for application to other types of PQC.

Although PQC can prevent quantum attacks, attackers can steal keys by inducing negligence in key management. Moreover, as mentioned in Section 2, it is safer to prevent signal sniffing in advance when quantum attacks become possible in the future. Therefore, in the next section, QKD technology that can increase the security of the physical layer communication is explained.

3.2. Quantum Key Distribution and Application

QKD is a protocol for distributing encryption keys through the quantum channel (Q-channel). If encryption keys are completely secret and random, the quantum attack cannot conduct cryptanalysis on the ciphertext, and it is theoretically proven [75]. The Q-channel can determine whether the transmitted signal has been eavesdropped or not by utilizing quantum physics laws [76]. Since Wi-Fi, Raspberry Pi, or Modbus cannot know whether there is eavesdropping occuring, network information such as IP is leaked when an attacker attempts to eavesdrop on the network packet using sniffing devices such as wire-shark or packet capture. Since the QKD network can know the presence of eavesdropping, the attacker cannot obtain any network information. When the attacker attempts to eavesdrop, the network stops data transmission to prevent information leakage. Thus, unlike conventional networks (Wi-Fi, Raspberry Pi, or Modbus), applying QKD to the DER network can prevent attackers from stealing $r$ number of messages required to break AEAD. QKD can be categorized into two methods depending on the encoding method of the Q-bit: Prepare and Measurement (PM) [77] and Quantum Entangle base (EB) method [78].

PM can be implemented by using an optical fiber network and has a higher secret key rate (SKR) than EB when the distance is short. Thus, the PM-based method is usually applied to the DER network [79,80]. However, QKD has a shorter communication distance, lower transmitting speed, and much higher cost than the current public network [81,82,83,84,85,86]. In addition, QKD only protects physical networks, does not encrypt data, and uses public networks. Thus, the latest encryption technologies, i.e., PQC must be applied simultaneously to the DER network [4].

In this paper, in order to analyze the applicability of QKD’s DER network, the communication performance of QKD in the future was predicted based on the data in [81,82,83,84,85,86]. The prediction results are shown in Figure 8.

Figure 8a shows the distance by year, and (b) shows the data rate. Looking at Figure 8a, it can be observed that existing QKD networks have been able to communicate over 300 km and have an Mbps data rate since 2015. Although it does not meet the speed of LTE, 4G, and Wi-Fi, which are widely used today, QKD shows sufficient speed because it is used only for key distribution. Moreover, it is predicted that it will show a similar speed to the current general communication equipment within 2025. In Section 2, quantum attacks will become possible after 2025, and QKD can be applied at the proper time. Therefore, when applying QKD to the DER network, the consideration is the cost and the applicability of PQC.

In order to reduce the number of quantum transceivers in a cost-effective QKD network, not all DER or SI devices are connected to the quantum channel [81,82,83,84,85,86]. Figure 9 shows the cost-efficiency QKD network structure.

In Figure 9, only a DERMS/DER aggregator and quantum transceiver node are connected to each other by using quantum channels. SIs are connected to DERMS by using a public channel such as a conventional network, but DERMS distributes quantum-resistant encryption keys for DER/SI through a public channel. The structure of Figure 9 is cost-effective because not all SIs and DER devices are equipped with quantum transceivers. SKT, South Korea’s wireless communication service provider, commercialized QKD with this network structure [84,85]. As the number of DER/SI connected to one quantum node (i.e., quantum server and quantum transceiver node) increases, the cost of installing QKD decreases. The network structure of Figure 9 reduces security because DER and SI are not guaranteed security by quantum channels. Therefore, when using such a QKD network structure, it is essential to apply PQC. The SKT increased security by applying AES-256 encryption to the QKD network. In a cost-efficiency QKD network, as the number of DER/SI connected to one quantum node increases, the number of keys to be distributed by one quantum server also increases. In other words, the security and communication performance of the network and the installation cost have a tradeoff relationship.

In this paper, in order to analyze DER applicability of QKD, key distribution delay and QKD network installation costs were analyzed according to the size of the QKD network. The QKD installation cost is shown in the following equation [86].

$$\mathrm{Cost}=C_Q\times N_Q+C_S\times N_S+C_R\times N_R+C_W\times D_s$$

(1)

In Equation (1), $N_Q,N_S$, and $N_R$ represent the number of quantum devices required to configure the QKD network. $D_L$ is the total length of fibers of the QKD network. Other variables are shown in

Table 5. The cost of a quantum device [86,87].

$C_Q$: Cost of Quantum transceiver	40,000 USD
$C_S$: Cost of Quantum Server	50,000 USD
$C_R$: Cost of Quantum relay node	5000 USD
$C_W$: Cost of fiber per kilometer	8 USD

below. The price of quantum equipment is referenced in the paper [86,87].

According to the latest quantum network study, one quantum server can be connected to a maximum of four quantum transceiver nodes through a quantum channel with a data rate as 2 Kbps [88,89]. Based on Equation (1) and the result of the latest quantum server research, we can calculate the cost of the QKD network for DER in Figure 9. Let us assume $N_{QN-SI}$ is the number of SIs connected to one quantum transceiver. Then, $N_Q$ can be represented as $\left[\frac{100}{N_{Q-SI}}\right]$. As described above, since one quantum server can be connected to up to four quantum transceiver nodes, $N_S$ can be rewritten as $[N_Q/4]$. It is assumed that one quantum relay node is added whenever two quantum servers are added, and $N_R$ can be rewritten as $[N_R/2]$. Thus, the cost required to install QKD varies depending on how many SIs are connected to one quantum transceiver node. For example, the total number of SI ($N_{SI}$: 100) is 100, and five SIs are connected to one quantum transceiver node ($N_{QN-SI}: 5$). Twenty quantum transceiver nodes ($N_Q:20$), five quantum servers ($N_S$: 5), and three quantum relay nodes ($N_R$: 3) are required to implement the QKD network. Therefore, the cost of installing QKD in Equation (1) may be expressed as shown in Equation (2).

$$\mathrm{Cost}=C_Q\times \left[\frac{N_{SI}}{N_{Q-SI}}\right]+C_B\times \left[\frac{N_{SI}}{N_{Q-SI}/4}\right]+C_T\times \left[\frac{N_{SI}}{N_{Q-SI}/8}\right]+C_W\times D_s$$

(2)

The QKD network is assumed, as shown in Figure 10. In Figure 10, the network between the quantum transceiver and SIs is the same as the DER network to which the PQC of Section 3 is applied. The total number of SI ($N_{SI}$) constituting the network is 100.

The optical fiber length required for network configuration was fixed at 100 km. At this time, the cost of installing key distribution delay and QKD according to the number of SI accepted by the quantum transceiver node was analyzed and shown in Figure 11.

According to analysis results in Figure 11, as the number of SI connected to single quantum transceiver node increases, key distribution delay increases linearly, while cost decreases nonlinearly. In particular, when the number of SI connected to a single quantum transceiver node is between three and five, cost decreases dramatically. If the number of SI is seven or higher, the cost does not decrease significantly, even if the number of SI increases.

In Figure 11, the implementation cost is 5.5 million dollars to connect quantum channels to all SIs, and DER can be stably operated because key distribution delay is less than 1 s. If five SIs are connected to the quantum transceiver node, the key distribution delay is 1.5 s to 3.5 s, which can still reliably operate the DER. In addition, cost will be reduced to less than about a million dollars. If 15 to 20 SIs are connected to the quantum transceiver node, the price decreases to 0.2 to 0.3 million dollars, but DER is unable to operate stably because the key distribution delay is greater than 10 s. Therefore, in order to apply QKD to the DER network, optimal cost and network configuration should be researched in terms of the actual cost and key distribution delay.

Comparing the results in Figure 11 with those in Figure 5, the key distribution delay be smaller when QKD and PQC are simultaneously applied to the DER network because the data rate of the QKD network is slower than the conventional network. Therefore, as predicted in Figure 8, the improvement of the data rate of the QKD network is expected to be more advantageous in applying QKD to the DER system.

4. Conclusions and Future Works

Quantum technology will induce greater threats and provides opportunities for more secure encryption in the DER network. New attacks will be created by using a quantum computer that easily breaks current encryption algorithms. Therefore, security researchers need to pay attention to quantum computing trends. This paper analyzes possible quantum attacks in the future and predicts feasible timing. The results show that quantum attacks will be feasible in only three to five years.

In order to protect the DER network from future quantum attacks, this paper investigated the case of simultaneously applying PQC and QKD to the DER network. In addition, we analyzed problems that occur when these two technologies are applied simultaneously in terms of network performance and installation cost.

Future research includes cost-effective and high-performance quantum-safe network DER networks using server-based QKD and lightweight PQC. The network delay of TLS 1.3 currently used in the DER network is measured in several milliseconds [14]. In the case of control critical factors such as load frequency, the DER system requires an immediate response of several milliseconds or less [90]. Therefore, research will be needed to change PQC to being lightweight in order to enable key distribution within milliseconds. In the future, setting appropriate security levels depending on the importance of each part of the DER system also will be researched.

Currently, the QKD network is expensive. In addition, the DER system is usually established in a large area. Thus, there may be an isolated DER system that is hard to apply QKD. Thus, QKD should be priorly applied to important parts of the DER system, and a cost-effective QKD network structure will be researched. If QKD has a cost-effective network structure, as shown in Figure 9, the DER network inevitably uses a public network. In this case, it is necessary to study methods for securing the public network.

Similarly to conventional attack models, DoS or bypassing attack models inadvertently render leakage of the encryption key. Thus, a more in-depth study about future quantum attack models is needed, and a study to score risks according to the quantum attack for each part of the DER system is needed.