We present the first architecture for a trusted execution environment for quantum computers. In the architecture, to protect the user's circuits, they are obfuscated with decoy control pulses added during circuit transpilation by the user. The decoy pulses are removed, i.e. attenuated, by the trusted hardware inside the superconducting quantum computer's fridge before they reach the qubits. This preliminary work demonstrates that protection from possibly malicious cloud providers is feasible with minimal hardware cost.

This work presents the first evaluation of timing and higher-energy attacks on Quantum Random Access Memory (QRAM) circuits. By leveraging quantum principles, QRAM can efficiently store and manipulate both quantum and classical data, leading to potential significant speedups in a variety of quantum algorithms. However, as demonstrated in this work, when used in remote cloud-based quantum computers QRAM is vulnerable to different security attacks. The work demonstrates side-channel attacks, e.g., the timing attacks, as well as fault-injection-like attacks, e.g., the higher-energy attacks. This work evaluates the attacks on QRAM and different circuits that use QRAM. The work also proposes a set of defenses.

Numerous public cloud infrastructure providers today allow for access to Noisy Intermediate-Scale Quantum (NISQ) computers. Changes in the environment or the machine configuration may affect their dependability. Through analysis of real quantum computer calibration data, this work demonstrates that quantum computers available from IBM Quantum experience periods of fluctuation or abrupt qubit frequency changes. This work further analyzes the correlation between the frequency change events, decoherence times, gate errors, and machine maintenance or offline periods. The results highlight that the properties of NISQ computers change over time, affecting their dependability, but not all of the changes can be explained with publicly available data.

Enabling the sharing of quantum computers among different users requires a secure reset operation that can reset the state of a qubit to ground state |0> and prevent leakage of the state to a post-reset circuit. This work highlights that the existing reset operations available in superconducting qubit NISQ quantum computers are not fully secure. In particular, this work demonstrates for the first time a new type of higher-energy state attack. Although NISQ quantum computers are typically abstracted as working with only energy states |0> and |1>, this work shows that it is possible for unprivileged users to set the qubit state to |2 or |3>. By breaking the abstraction of a two-level system, the new higher-energy state attack can be deployed to affect the operation of circuits or for covert communication between circuits. This work shows that common reset protocols are ineffective in resetting a qubit from a higher-energy state. To provide a defense, this work proposes a new Cascading Secure Reset (CSR) operation. CSR, without hardware modifications, is able to efficiently and reliably reset higher-energy states back to |0>. CSR achieves a reduction in |3> -initialized state leakage channel capacity by between 1 and 2 orders of magnitude, and does so with a 25x speedup compared with the default decoherence reset.

The rapidly growing interest in quantum computing also increases the importance of securing these computers from various physical attacks. Constantly increasing qubit counts and improvements to the fidelity of the quantum computers hold great promise for the ability of these computers to run novel algorithms with highly sensitive intellectual property. However, in today's cloud-based quantum computer setting, users lack physical control over the computers. Physical attacks, such as those perpetrated by malicious insiders in data centers, could be used to extract sensitive information about the circuits being executed on these computers. This work shows the first exploration and study of power-based side-channel attacks in quantum computers. The explored attacks could be used to recover information about the control pulses sent to these computers. By analyzing these control pulses, attackers can reverse-engineer the equivalent gate-level description of the circuits, and the algorithms being run, or data hard-coded into the circuits. This work introduces five new types of attacks, and evaluates them using control pulse information available from cloud-based quantum computers. This work demonstrates how and what circuits could be recovered, and then in turn how to defend from the newly demonstrated side-channel attacks on quantum computing systems.

With the increased real-world deployment of quantum computers, there is a security need to be able to fingerprint and track their equipment. This work proposes that cryogenic equipment used in superconducting qubit quantum computers could leverage inexpensive SRAM-based PUFs as fingerprints. This work is the first to perform a security evaluation of SRAM PUFs under cryogenic conditions using liquid nitrogen to rapidly freeze the memories to temperatures approaching -195C (-320F or 77K). This work demonstrates that SRAM PUFs can become more stable under cryogenic conditions. As a result, a possible novel application of the SRAM PUFs is to identify and track quantum computer cryogenic hardware. Other means of fingerprinting quantum computer equipment are also possible, for example, based on the frequency of qubits. The ability to fingerprint quantum computers can be on one hand beneficial, to track the equipment, but on the other detrimental as attackers with access to the fingerprints could identify specific machines. Understanding the benefits and dangers of fingerprinting quantum computers, and securely deploying fingerprinting mechanisms is necessary to protect these emerging computing platforms.