Official Documentation

CQWS Master Guide

Deployment prerequisites, hardware specifications, and network configuration for the CyCity Quantum Web Standard (CQWS) Ring-0 Daemon.

1. Server Prerequisites

CQWS is a kernel-level module. As such, it requires specific OS conditions to operate effectively without causing kernel panics.

  • Supported Architectures: x86_64 / amd64, AArch64 (ARM64).
  • Supported Distributions: Ubuntu 22.04 LTS, Debian 11/12, RHEL 9 (Custom kernels only).
  • Kernel Versions: Linux Kernel 5.15+ (Requires CONFIG_NETFILTER and CONFIG_MODULES).
  • Root Access: Absolutely required. The daemon must install .ko modules.
WARNING: CQWS cannot be deployed on managed containers (e.g., standard Docker, AWS Fargate, Google Cloud Run) due to lack of Ring-0 access. Bare-metal or dedicated hypervisor instances are mandatory.

2. Hardware Requirements

If you are deploying CQWS Quantum or CQWS Sovereign, specialized cryptographic hardware is required.

PCIe QRNGs (Quantum)

The CQWS daemon requires a direct PCIe path to the QRNG to pull physical entropy without network transit.

  • ID Quantique Quantis PCIe Hardware (Recommended)
  • Minimum PCIe 2.0 x1 slot available.

HSM (Sovereign)

For Sovereign Air-Gapped deployments, physical symmetric pads must be loaded.

  • FIPS 140-2 Level 3 Certified USB/Network HSM.
  • Minimum 1TB solid-state storage.

3. Network Configuration

CQWS uses Netfilter NF_INET_PRE_ROUTING hooks. It will intercept traffic before it hits standard firewalls like ufw or iptables.

# 1. Allow ML-KEM Handshake
sudo ufw allow 4433/tcp

# 2. Disable Conflicting DPI
sudo sysctl -w net.ipv4.conf.all.rp_filter=0

4. Client Onboarding

Due to the critical nature of Ring-0 installations, CyCity does not offer automated self-serve deployments for enterprise nodes.

  1. Requisition: Submit an Enterprise Requisition.
  2. Validation: CyCity Solutions Engineering will verify your infrastructure.
  3. Secure Transmission: You receive a zero-knowledge encrypted payload containing cqws_daemon.ko.
  4. Activation: Run the initialization shell script with root privileges.

5. Quantinuum Bridge

For clients on the Standard plan, CQWS utilizes a secure internal API bridge to fetch cryptographic seeds from the Quantinuum Quantum Origin platform. No client-side API integration is required.

  • Endpoint: Handled securely over TLS 1.3 by the daemon.
  • Frequency: Entropy pools are refreshed continuously.
  • Failsafe: Falls back to `/dev/urandom` if unreachable.
Transparency Note: All authentication secrets are securely embedded and encrypted within the CQWS binary.

6. IP Protection

The CQWS Ring-0 module is a proprietary, military-grade system. To protect against reverse-engineering by APTs, safeguards are implemented at the binary level.

  • Code Obfuscation: The `cqws_daemon.ko` binary is heavily obfuscated.
  • Anti-Debugging: Actively detects and neutralizes `gdb`, `strace`.
  • Memory Protection: Pauli Masking is executed in secure, non-pageable memory enclaves.