Quantum Leak: Timing Side-Channel Attacks on Cloud-Based Quantum Services

TL;DR

This paper reveals timing-based side-channel vulnerabilities in cloud-based quantum services, demonstrating that attackers can identify quantum hardware and leak sensitive quantum information with minimal measurements, highlighting urgent security concerns.

Contribution

It introduces the first practical timing attack on cloud quantum services, showing how to extract confidential information with few measurements and emphasizing the need for improved security measures.

Findings

Attacker can identify quantum hardware with 10 measurements.

Leakage of quantum oracle achieved with 500 measurements.

Highlights security vulnerabilities in cloud-based quantum computing.

Abstract

Quantum computing offers significant acceleration capabilities over its classical counterpart in various application domains. Consequently, there has been substantial focus on improving quantum computing capabilities. However, to date, the security implications of these quantum computing platforms have been largely overlooked. With the emergence of cloud-based quantum computing services, it is critical to investigate the extension of classical computer security threats to the realm of quantum computing. In this study, we investigated timing-based side-channel vulnerabilities within IBM's cloud-based quantum service. The proposed attack effectively subverts the confidentiality of the executed quantum algorithm, using a more realistic threat model compared to existing approaches. Our experimental results, conducted using IBM's quantum cloud service, demonstrate that with just 10 measurements, it is possible to identify the underlying quantum computer that executed the circuit. Moreover, when evaluated using the popular Grover circuit, we showcase the ability to leak the quantum oracle with a mere 500 measurements. These findings underline the pressing need to address timing-based vulnerabilities in quantum computing platforms and advocate for enhanced security measures to safeguard sensitive quantum algorithms and data.