CyCity Logo
CyCity CQWS
Official Sovereign Technical Guide

CQWS Master Guide

Deployment prerequisites, hardware specifications, and network configuration for the CyCity Quantum Web Standard (CQWS) Ring-0 Daemon.

1. Server Prerequisites

CQWS is a kernel-level module. As such, it requires specific OS conditions to operate effectively without causing kernel panics.

  • Supported Architectures: x86_64 / amd64, AArch64 (ARM64).
  • Supported Distributions: Ubuntu 22.04 LTS, Debian 11/12, RHEL 9 (Custom kernels only).
  • Kernel Versions: Linux Kernel 5.15+ (Requires CONFIG_NETFILTER and CONFIG_MODULES).
  • Root Access: Absolutely required. The daemon must install .ko modules.
WARNING: CQWS cannot be deployed on managed containers (e.g., standard Docker, AWS Fargate, Google Cloud Run) due to lack of Ring-0 access. Bare-metal or dedicated hypervisor instances are mandatory.

2. Hardware Requirements

If you are deploying CQWS Quantum or CQWS Sovereign, specialized cryptographic hardware is required.

PCIe QRNGs (Quantum)

  • ID Quantique Quantis PCIe Hardware (Recommended)
  • Minimum PCIe 2.0 x1 slot available.

HSM (Sovereign)

  • FIPS 140-2 Level 3 Certified USB/Network HSM.
  • Minimum 1TB solid-state storage.

3. Network Configuration

CQWS uses Netfilter NF_INET_PRE_ROUTING hooks. It will intercept traffic before it hits standard firewalls like ufw or iptables.

# 1. Allow ML-KEM Handshake
sudo ufw allow 4433/tcp

# 2. Disable Conflicting DPI
sudo sysctl -w net.ipv4.conf.all.rp_filter=0

4. Client Onboarding

Due to the critical nature of Ring-0 installations, CyCity does not offer automated self-serve deployments for enterprise nodes.

  1. Requisition: Submit an Enterprise Requisition.
  2. Validation: CyCity Solutions Engineering will verify your infrastructure.
  3. Secure Transmission: You receive a zero-knowledge encrypted payload containing cqws_daemon.ko.
  4. Activation: Run the initialization shell script with root privileges.

5. Quantinuum Bridge

For clients on the Standard plan, CQWS utilizes a secure internal API bridge to fetch cryptographic seeds from the Quantinuum Quantum Origin platform. No client-side API integration is required.

  • Endpoint: Handled securely over TLS 1.3 by the daemon.
  • Frequency: Entropy pools are refreshed continuously.
  • Failsafe: Falls back to `/dev/urandom` if unreachable.
Transparency Note: All authentication secrets are securely embedded and encrypted within the CQWS binary.

6. IP Protection

The CQWS Ring-0 module is a proprietary, military-grade system. To protect against reverse-engineering by APTs, safeguards are implemented at the binary level.

  • Code Obfuscation: The `cqws_daemon.ko` binary is heavily obfuscated.
  • Anti-Debugging: Actively detects and neutralizes `gdb`, `strace`.
  • Memory Protection: Pauli Masking is executed in secure, non-pageable memory enclaves.