SQOUT: A Risk-Based Threat Analysis Framework for Quantum Communication Systems

Abstract

Quantum communication systems, despite their theoretical security guarantees, face practical vulnerabilities across physical infrastructure, protocols, and classical subsystems that existing cybersecurity frameworks do not cover. We propose a kill-chain-based threat model that organises quantum and classical Tactics, Techniques, and Procedures (TTPs) into end-to-end attack sequences, combined with an ISO/IEC 27005-compatible risk scoring methodology. SQOUT, a threat-intelligence platform for quantum technologies, implements this approach and is used to analyse two concrete attack scenarios: Photon-Number Splitting (PNS) and detector-blinding attacks as case studies. The risk assessment uses technique-level likelihood scoring with attack-tree product aggregation across kill-chain steps, producing governance-ready risk ratings for quantum-specific threat scenarios.

Revised version

References in corpus (11)

• Decoy State Quantum Key Distribution
• Quantum Key Distribution with High Loss: Toward Global Secure Communication
• Secure quantum key distribution with realistic devices
• Security Aspects of Practical Quantum Cryptography
• Hacking commercial quantum cryptography systems by tailored bright illumination
• Fully device independent quantum key distribution
• Quantum Hacking on Continuous-Variable Quantum Key Distribution System using a Wavelength Attack
• Controlling passively-quenched single photon detectors by bright light
• Laser seeding attack in quantum key distribution
• Creation of backdoors in quantum communications via laser damage
• An approach for security evaluation and certification of a complete quantum communication system