The amount of digital data that requires long-term protection of integrity, authenticity, and confidentiality grows rapidly. Examples include electronic health records, genome data, and tax data. In this paper we present the secure storage system LINCOS, which provides protection of integrity, authenticity, and confidentiality in the long-term, i.e., for an indefinite time period. It is the first such system. It uses the long-term integrity scheme COPRIS, which is also presented here and is the first such scheme that does not leak any information about the protected data. COPRIS uses information-theoretic hiding commitments for confidentiality-preserving integrity and authenticity protection. LINCOS uses proactive secret sharing for confidential storage of secret data. We also present implementations of COPRIS and LINCOS. A special feature of our LINCOS implementation is the use of quantum key distribution and one-time pad encryption for information-theoretic private channels within the proactive secret sharing protocol. The technological platform for this is the Tokyo QKD Network, which is one of worlds most advanced networks of its kind. Our experimental evaluation establishes the feasibility of LINCOS and shows that in view of the expected progress in quantum communication technology, LINCOS is a promising solution for protecting very sensitive data in the cloud.
The amount of digital data that requires long-term protection of integrity, authenticity, and confidentiality grows rapidly. Examples include electronic health records, genome data, and tax data. In this paper we present the secure storage system LINCOS, which provides protection of integrity, authenticity, and confidentiality in the long-term, i.e., for an indefinite time period. It is the first such system. It uses the long-term integrity scheme COPRIS, which is also presented here and is the first such scheme that does not leak any information about the protected data. COPRIS uses information-theoretic hiding commitments for confidentiality-preserving integrity and authenticity protection. LINCOS uses proactive secret sharing for confidential storage of secret data. We also present implementations of COPRIS and LINCOS. A special feature of our LINCOS implementation is the use of quantum key distribution and one-time pad encryption for information-theoretic private channels within the proactive secret sharing protocol. The technological platform for this is the Tokyo QKD Network, which is one of worlds most advanced networks of its kind. Our experimental evaluation establishes the feasibility of LINCOS and shows that in view of the expected progress in quantum communication technology, LINCOS is a promising solution for protecting very sensitive data in the cloud.
Abstract Supercomputers, quantum computers, other computers, and algorithmic advancements that can break cryptographic systems currently in use are becoming a reality. For information that requires long-term confidentiality (e.g. national security, military security, genomic data etc.), the threat of eavesdropping must be seriously considered. The leakage of such information would not only cause temporary confusion but would also have serious repercussions for future generations. Part of such important data are already being exchanged over the Internet using cryptography that is not resistant to quantum computers. Considering the possibility of harvest attacks on information that must be kept secret for centuries, developing a technology that can immediately eliminate the risk of eavesdropping in principle is desirable. In response to these demands, we previously developed an information-theoretically secure method for data transmission, storage, recovery, and authentication with a single password using a quantum key distribution network called a quantum secure cloud. We now apply this technology to develop an information-theoretically secure long-distance data-relay function and succeed in developing a distributed data-relay simulator that is compatible with current quantum key distribution networks. The throughput of this protocol is more than 10 Mbps for 10 MB data, so it can be applied to practical use.
Abstract Secret sharing, as an important cryptographic technique, effectively reduces the risk of single points of failure and centralized leakage by distributing secret information across multiple independent entities. With the widespread application of cloud computing and cloud storage, achieving long-term secure storage and controllable recovery of sensitive data in untrusted cloud environments has become a critical issue. Traditional cloud storage solutions face potential risks of security degradation and privacy exposure under long-term operation and future quantum computing threats. This paper proposes a quantum secret sharing (QSS) scheme for cloud storage scenarios, combining the threshold secret sharing with quantum secure communication and quantum information processing to achieve distributed storage and secure reconstruction of secret information across multiple cloud servers. A quantum identity authentication mechanism is introduced to the authenticated user based on a quantum sequence. This protocol enhances the long-term security of the system during the storage phase through threshold distribution and proactive share refreshing mechanisms, and utilizes quantum states to complete the secure reconstruction of secrets during the recovery phase. Additionally, this scheme avoids direct interaction between cloud servers, improving the security in untrusted cloud environments. Security analysis shows that this protocol can effectively resist threats such as external eavesdropping and internal collusion.
A large amount of sensitive data must remain accessible for decades or even centuries (e.g, electronic health records, governmental documents). Communicating such data over the Internet requires long-term secure communication channels, which, in turn, require robust key distribution protocols. Currently used key distribution protocols, however, are not designed for long-term security. Their security is either threatened by quantum computers, or, in principle, due to their reliance on computational problems. Quantum key distribution (QKD) protocols are information-theoretically secure and thereby offer long-term security against computational attacks. However, significant obstacles to their real-world use remain. This position paper, which is a multidisciplinary effort of computer scientists and physicists, systematizes knowledge about challenges of and strategies for realizing long-term secure Internet communication from QKD. We first analyze the performance and security of existing point-to-point QKD technology. Then, we discuss several approaches to enabling QKD in large-scale multi-user networks. Finally, we list important challenges that need to be addressed in order to make QKD-based long-term secure communication on the Internet practical.
Quantum key distribution (QKD) is a technology for distributing cryptographic keys between two communication parties based on the quantum physics for the secure communication. A trusted nodebased key relay technique is integrated with QKD to overcome the technical limitations of QKD and to enable key distribution between two arbitrary communication parties in the trusted node network, which we refer to as the QKD network. In addition, secret sharing technology has been integrated with the QKD network to realize secure data storage and secure data communication, which we call a quantum secure cloud. This paper presents the development and evaluation of the proof-of-concept (PoC) system for the QKD network and quantum secure cloud, specially applied to the genome medicine domain. The PoC system was developed at Tohoku University and Toshiba sites to address the “cancer clinical sequencing” use-case. We evaluated three practical scenarios with the PoC system: (1) real-time transmission of genome analysis data, (2) “expert panel”, an online video conference for medical experts' discussion, and (3) distributed backup of genome analysis data. To support these scenarios, we developed three new functions: (1) a function for monitoring output data and pipeline processing of data encryption/decryption and transmission for secure large-scale data transfer, (2) a key management system function to achieve both large-scale data transmission and low-latency data communication, and (3) a function for preemptive key data reading and direct access to storage devices to enable high-speed data transmission and distributed data backup using a secret sharing scheme. These scenarios and functions were evaluated and demonstrated using real or simulated genome data. The evaluation results reveal that QKD network and quantum secure cloud technologies can be applied to cancer clinical sequencing as a use-case of the genome medicine domain.
The increasing use of cloud computing has raised concerns about the security of sensitive data. Quantum computers pose a serious threat to the security of traditional encryption schemes, as they could be used to break these schemes in a relatively short amount of time. Quantum cryptography offers a promising solution to this problem, as it provides a secure way to exchange keys that cannot be broken by quantum computers. In this paper, we propose a novel data security scheme for cloud computing that uses quantum key distribution (QKD). The scheme uses a QKD protocol to establish a shared secret key between the cloud server and the client. This key is then used to encrypt the data before it is sent to the cloud server. The scheme also proposes a new method for verifying the integrity of the data after it has been decrypted. The proposed scheme is secure against both classical and quantum attacks. It is also efficient, as it does not require the transmission of large amounts of data. The scheme is also scalable, as it can be easily implemented in cloud computing environments.
Distributed storage plays an essential role in realizing robust and secure data storage in a network over long periods of time. A distributed storage system consists of a data owner machine, multiple storage servers and channels to link them. In such a system, secret sharing scheme is widely adopted, in which secret data are split into multiple pieces and stored in each server. To reconstruct them, the data owner should gather plural pieces. Shamir's (k, n)-threshold scheme, in which the data are split into n pieces (shares) for storage and at least k pieces of them must be gathered for reconstruction, furnishes information theoretic security, that is, even if attackers could collect shares of less than the threshold k, they cannot get any information about the data, even with unlimited computing power. Behind this scenario, however, assumed is that data transmission and authentication must be perfectly secure, which is not trivial in practice. Here we propose a totally information theoretically secure distributed storage system based on a user-friendly single-password-authenticated secret sharing scheme and secure transmission using quantum key distribution, and demonstrate it in the Tokyo metropolitan area.