Methods and systems for estimating risk of enterprise application for quantum cryptography migration

A system, comprising:

• a memory storing instructions;
• one or more input/output (I/O) interfaces;
• and
• one or more hardware processors coupled to the memory via the one or more I/O interfaces,
• wherein the one or more hardware processors are configured by the instructions to:
• define one or more application risk input parameters, one or more platform risk input parameters, and one or more risk policy input parameters, for a host enterprise application;
• receive an application related data of the host enterprise application, a data shelf life of the application related data of the host enterprise application, a time to migrate the host enterprise application whose risk is to be estimated from a quantum threat after migration, and a time by which quantum computer manufactured;
• extract an input parameter value of each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, from the application related data of the host enterprise application whose risk is to be estimated from the quantum threat, using a data extraction technique, wherein a code parser is configured to fetch the input parameter value of an user type and a validity by analyzing an user access policy related data, and wherein the input parameter value corresponding to a vulnerability is extracted from an audit report or from vulnerability information generated during an application testing phase, and wherein the input parameter value associated with validity of a third party library is fetched based on dependency information of one or more third party libraries present in the host enterprise application;
• compute a hazard value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, based on an associated input parameter value, using a modified cox model, wherein computing the hazard value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, based on the associated input parameter value, using the modified cox model, comprising:
• receiving a number of qubits of a quantum computer, and a number of qubits needed to break a predefined cryptographic scheme defined for the host enterprise application, of one or more predefined cryptographic schemes;
• determining a quantum hazard value, based on the number of qubits of the quantum computer and the number of qubits needed to break a predefined cryptographic scheme defined for the host enterprise application;
• determining a partial likelihood function value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, using the modified cox model, by estimating a probability of attack on the predefined cryptographic scheme for a current instance with respect to one or more historical instances that are vulnerable to computing capability of the quantum computer;
• and
• calculating the hazard value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters values, using the quantum hazard value, an associated partial likelihood function value and the associated input parameter value;
• estimate a hazard risk value of the host enterprise application, based on the hazard value computed for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters;
• determine a Mosca risk value of the host enterprise application, based on the data shelf life of application related data of the host enterprise application, the time to migrate the host enterprise application, and the time by which quantum computer manufactured, using a rule of Mosca;
• calculate a cumulative risk value of the host enterprise application, using the hazard risk value of the host enterprise application and the Mosca risk value of the host enterprise application;
• evaluate the risk of the host enterprise application for quantum cryptography migration, based on the cumulative risk value of the host enterprise application and an average cumulative risk value, wherein evaluating the risk the host enterprise application for quantum cryptography migration, based on the cumulative risk value of the host enterprise application and the average cumulative risk value, comprising:
• (i) assigning the host enterprise application with a high priority and allowing a migration of the host enterprise application when the cumulative risk value of the host enterprise application is higher than the average cumulative risk value;
• and
• (ii) assigning the host enterprise application with a low priority and postponing the migration of the host enterprise application when the cumulative risk value of the host enterprise application is less than or equal to the average cumulative risk value;
• and
• perform the quantum cryptography migration based on the evaluated risk of the host enterprise application.

One or more non-transitory machine-readable information storage mediums comprising one or more instructions which when executed by one or more hardware processors cause:

• defining one or more application risk input parameters, one or more platform risk input parameters, and one or more risk policy input parameters, for a host enterprise application;
• receiving an application related data of the host enterprise application, a data shelf life of the application related data of the host enterprise application, a time to migrate the host enterprise application whose risk is to be estimated from a quantum threat after migration, and a time by which a quantum computer manufactured;
• extracting an input parameter value of each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, from the application related data of the host enterprise application whose risk is to be estimated from the quantum threat, using a data extraction technique, wherein a code parser is configured to fetch the input parameter value of an user type and a validity by analyzing an user access policy related data, and wherein the input parameter value corresponding to a vulnerability is extracted from an audit report or from vulnerability information generated during an application testing phase, and wherein the input parameter value associated with validity of a third party library is fetched based on dependency information of one or more third party libraries present in the host enterprise application;
• computing a hazard value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, based on an associated input parameter value, using a modified cox model, wherein computing the hazard value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, based on the associated input parameter value, using the modified cox model, comprising:
• receiving a number of qubits of a quantum computer, and a number of qubits needed to break a predefined cryptographic scheme defined for the host enterprise application, of one or more predefined cryptographic schemes;
• determining a quantum hazard value, based on the number of qubits of the quantum computer and the number of qubits needed to break a predefined cryptographic scheme defined for the host enterprise application;
• determining a partial likelihood function value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters, using the modified cox model, by estimating a probability of attack on the predefined cryptographic scheme for a current instance with respect to one or more historical instances that are vulnerable to computing capability of the quantum computer;
• and
• calculating the hazard value for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters values, using the quantum hazard value, an associated partial likelihood function value and the associated input parameter value;
• estimating a hazard risk value of the host enterprise application, based on the hazard value computed for each of the one or more application risk input parameters, the one or more platform risk input parameters, and the one or more risk policy input parameters;
• determining a Mosca risk value of the host enterprise application, based on the data shelf life of application related data of the host enterprise application, the time to migrate the host enterprise application, and the time by which quantum computer manufactured, using a rule of Mosca;
• calculating a cumulative risk value of the host enterprise application, using the hazard risk value of the host enterprise application and the Mosca risk value of the host enterprise application;
• evaluating the risk of the host enterprise application for quantum cryptography migration, based on the cumulative risk value of the host enterprise application and an average cumulative risk value, wherein evaluating the risk the host enterprise application for quantum cryptography migration, based on the cumulative risk value of the host enterprise application and the average cumulative risk value, comprising:
• (i) assigning the host enterprise application with a high priority and allowing a migration of the host enterprise application when the cumulative risk value of the host enterprise application is higher than the average cumulative risk value;
• and
• (ii) assigning the host enterprise application with a low priority and postponing the migration of the host enterprise application when the cumulative risk value of the host enterprise application is less than or equal to the average cumulative risk value;
• and
• performing the quantum cryptography migration based on the evaluated risk of the host enterprise application.