Quantum cryptography storage system, distributed control device and program

Abstract

To distribute and store data in a plurality of storage device in a shorter time while ensuring information theoretical security of a communication path.SOLUTION: A quantum cryptographic storage system in an embodiment includes a plurality of storage devices, a distributed control device, a generation device, and a dispersion device. The plurality of storage devices are connected via a communication network. The distributed control device determines the distribution mode of shares dispersed from data based on QKDN (Quantum Key Distribution Network) information. The generation device uses a shared quantum key shared by using a QKDN to generate an encryption key and a decryption key. The dispersion device disperses the data into a plurality of shares based on the distribution mode. Each of the storage devices that stores some of the shares, on receiving shares encrypted using the encryption key via the communication network, decrypts the encrypted shares using the decryption key, and stores the decrypted shares.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] An embodiment of the present invention relates to a quantum cryptography storage system, a distributed control device, and a program. [Background technology]

[0002] There has been known a network system (storage network) in which storage devices such as hard disks are arranged as nodes in a communication network, and data is written to and read from these storage devices by user applications connected to the communication network. In a storage network, if data stored by an application needs to be kept secret, there is a method of increasing security by distributing the data based on a secret sharing algorithm and distributing and storing the data among multiple physically separated nodes. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-134841 A [Non-patent literature]

[0004] [Non-Patent Document 1] M. Fujiwara, A. Waseda, R. Nojima, S. Moriai, W. Ogata, and M. Sasaki, “Unbreakable distributed storage with quantum key distribution network and password-authenticated secret sharing,” Sci.Reports, 6, 28988-1-8 (2016), [Retrieved November 10, 2021], Internet<URL:https: / / arxiv.org / abs / 1607.00468> Summary of the Invention [Problem to be solved by the invention]

[0005] However, with conventional techniques, it has been difficult to distribute and store data in multiple storage devices in a short period of time while ensuring the information-theoretic security of the communication path. [Means for solving the problem]

[0006] A quantum cryptography storage system according to an embodiment includes a plurality of storage devices, a distribution control device, a generation device, and a distribution device. The plurality of storage devices are connected by a communication network. The distribution control device determines a distribution mode of shares to be distributed from data based on QKDN (Quantum Key Distribution Network) information. The generation device generates an encryption key and a decryption key using a quantum key shared using the QKDN. The distribution device distributes the data into a plurality of shares based on the distribution mode. When a share encrypted using the encryption key is received via the communication network, each of the storage devices that distributes and stores the shares decrypts the encrypted share with the decryption key and stores the decrypted share. [Brief description of the drawings]

[0007] [Figure 1] FIG. 2 is a diagram showing an example of the device configuration of the quantum cryptography storage system according to the first embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of the functional configuration of an SSN controller according to the first embodiment. [Figure 3A] 5A and 5B are diagrams for explaining a method for distributing and storing shares and a required time according to the first embodiment; [Figure 3B] FIG. 13 is a diagram for explaining the time required for distributed storage of shares. [Figure 4] 5A and 5B are diagrams for explaining a method for distributing and storing shares and a required time according to the first embodiment; [Diagram 5] 5A and 5B are diagrams for explaining a method for distributing and storing shares and a required time according to the first embodiment; [Figure 6] 4 is a flowchart showing an example of a distributed control method according to the first embodiment. [Figure 7] FIG. 13 is a diagram showing an example of the device configuration of a quantum cryptography storage system according to a modified example of the first embodiment. [Figure 8] 13A and 13B are diagrams for explaining a method for distributing and storing shares and a required time according to the second embodiment. [Figure 9] 13A and 13B are diagrams for explaining a method for distributing and storing shares and a required time according to the second embodiment. [Figure 10A] 13A and 13B are diagrams for explaining a method for distributing and storing shares and a required time according to the third embodiment. [Figure 10B] 13A and 13B are diagrams for explaining a method for distributing and storing shares and a required time according to the third embodiment. [Figure 11] FIG. 2 is a diagram showing an example of the hardware configuration of a QKD module according to the first to third embodiments. [Figure 12] FIG. 2 is a diagram showing an example of the hardware configuration of a KM, an SSN shareholder, an SSN controller, a QKDN controller, and an SSA in the first to third embodiments. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Hereinafter, embodiments of a quantum cryptography storage system, a distributed control device, and a program will be described in detail with reference to the accompanying drawings.

[0009] When data is distributed based on a secret sharing algorithm and stored in multiple physically separated nodes, the original data cannot be restored unless a certain number of shares or all of the shares are collected, depending on the specifications of the secret sharing algorithm. For example, even if a node is intruded into via a network or physically intruded and the shares stored in that node are stolen, the original data cannot be restored, and it is guaranteed that even partial information about the original data cannot be obtained.

[0010] Furthermore, when shares are stored in a distributed manner across multiple physically separated nodes, it is necessary not only to protect the shares stored in the nodes, but also to protect communications on the communication path from eavesdropping during the process of sending the shares to the shareholder, which is the node where the shares are to be distributed stored.

[0011] Therefore, a method has been proposed to ensure information-theoretic security by using a quantum key distribution network (QKDN), which is a separate network from the storage network, and applying one-time pad (OTP) cryptography using a quantum key provided by the QKDN to the communication for sending shares. In this method, the storage network is positioned as a user that uses the quantum key provision function provided by the QKDN. In other words, the storage network is positioned as an application of the quantum key network.

[0012] Since OTP encryption is an encryption method that requires a key of the same length as the data (plain text) to be encrypted, when sending a share using OTP encryption in a storage network, an OTP encryption key of the same size as the share to be sent must be received from the QKDN. Typically, the speed at which QKDN can generate and supply quantum keys (OTP encryption keys) is slower than the speed of a communication path in a storage network as a general communication path. Therefore, the maximum transmission speed when sending a share depends on the OTP encryption key generation and supply speed between the nodes that perform the transmission. If there is a difference in the OTP encryption key sharing speed between node pairs, if shares are generated so that all shares are the same size, it will take longer for the slower node pairs to send shares, and the distributed storage process as a whole will not be completed until the slowest node pair has completed sending shares.

[0013] In the following embodiments, a quantum cryptography storage system, a distributed control device, and a program are described that can determine a share distribution mode in which share transmission from a node pair with a slower speed does not become a bottleneck for the entire distributed storage process of shares, even if there is a difference in OTP encryption key sharing speed between node pairs.

[0014] (First embodiment) 1 is a diagram showing an example of a device configuration of a quantum cryptography storage system 100 according to the first embodiment. The quantum cryptography storage system 100 according to the first embodiment includes three nodes 10-1 to 10-3, a Secure Storage Network (SSN) user plane 20, and Secure Storage Agents (SSAs) 30-1 to 30-2.

[0015] Hereinafter, when there is no need to distinguish between the nodes 10-1 to 10-3, they will simply be referred to as nodes 10. Each node 10 is installed in a respective base (for example, a communication station or the like).

[0016] The node 10-1 includes a QKD module 1-1, a KM (Key Manager) 2-1, and an SSN shareholder 3-1.

[0017] Node 10-2 includes QKD module 1-2a, QKD module 1-2b, KM 2-2, SSN shareholder 3-2, and SSN controller 4.

[0018] Node 10-3 includes a QKD module 1-3, a KM 2-3, an SSN shareholder 3-3, and a QKDN controller 5.

[0019] Hereinafter, when there is no need to distinguish between QKD modules 1-1 to 1-3, they will simply be referred to as QKD module 1. Similarly, when there is no need to distinguish between KM2-1 to 2-3, they will simply be referred to as KM2. Similarly, when there is no need to distinguish between SSN shareholder 3-1 to 3-3, they will simply be referred to as SSN shareholder 3. Similarly, when there is no need to distinguish between SSA 30-1 to 30-2, they will simply be referred to as SSA 30.

[0020] The devices installed in each node 10 may be housed inside one housing, or may be configured as multiple devices in separate housings.

[0021] In the SSN user plane 20, an SSN data owner who is the owner of SSN user data transmits and receives SSN user data. When the SSA 30 receives the SSN user data, the SSA 30 distributes the SSN user data into a plurality of shares based on a secret sharing algorithm.

[0022] Next, the network configuration of the quantum cryptographic storage system 100 according to the first embodiment will be described. The quantum cryptographic storage system 100 according to the first embodiment includes two networks, a QKDN (Quantum Key Distribution Network) 200 and an SSN 300.

[0023] <Example of QKDN> The QKDN 200 according to the first embodiment is a quantum key distribution network including three nodes 10-1 to 10-3. Specifically, the QKDN 200 according to the first embodiment includes a QKD module 1, a KM 2, and a QKDN controller 5.

[0024] The QKD module 1-1 and the QKD module 1-2a generate a bit string (quantum key) shared by both of them through a QKD link connecting the two. By transmitting the quantum key from the QKD module 1-1 and the QKD module 1-2a to the KM 2-1 and the KM 2-2 respectively, the KM 2-1 and the KM 2-2 share the quantum key.

[0025] Similarly, the QKD module 1-2b and the QKD module 1-3 generate a quantum key, and the quantum key is shared by the KM 2-2 and the KM 2-3.

[0026] In this embodiment, the QKD module 1-1 and the QKD module 1-3 are not connected by a QKD link. Therefore, the KM 2-1 and the KM 2-3 share the quantum key by key relay via the KM 2-2. For example, a part of the quantum key shared by the KM 2-1 and the KM 2-2 is transmitted from the KM 2-2 to the KM 2-3.

[0027] The shared quantum key is transmitted from KM2 to the SSN share holders 3 in response to requests from the SSN share holders 3 connected to the respective KM2s.

[0028] <Example of SSN> The SSN 300 of the first embodiment is a storage network including three nodes 10-1 to 10-3 (SSN share holders 3-1 to 3-3 and SSN controller 4), an SSN user plane 20, and an SSA 30.

[0029] For example, the SSN data owner stored in the SSA 30-1 sends a storage request for storing the SSN user data to the SSN share holders 3 to the SSA 30-1.

[0030] Upon receiving the storage request, the SSA 30-1 distributes the SSN user data 101 (hereinafter referred to as "original data 101") into a plurality of shares based on a secret sharing algorithm. When distributing to the shares, the SSA 30-1 inquires of the SSN controller 4 about the distribution mode (for example, the number of shares after distribution and the size of each share).

[0031] The SSN controller 4 determines the distribution mode and notifies the SSA 30-1 of the distribution form. When determining the distribution mode, the SSN controller 4 determines the distributed storage mode of the shares to the SSN share holders 3. FIG. 1 shows an example when it is determined that the shares 101-2 and 101-3 are distributed and stored in the SSN share holders 3-2 and 3-3. At this time, the number of distributions in this distribution mode is 2.

[0032] The SSN controller 4 also determines the size of each share in the distributed mode according to the communication speed possible while applying OTP encryption between the SSN shareholders 3-1 and 3-2, and between the SSN shareholders 3-1 and 3-3. In this embodiment, the communication speed possible while applying OTP encryption is the sharing speed of the OTP encryption key between KM2-1 and KM2-2, and between KM2-1 and KM2-3. The SSN controller 4 obtains these sharing speeds from the QKDN controller 5.

[0033] In the embodiment shown in Fig. 1, for example, assume that the OTP encryption key sharing speed (OTP encryption key sharing speed) between KM2-1 and KM2-2 is faster than the OTP encryption key sharing speed between KM2-1 and KM2-3. In this case, the OTP encryption transmission speed between SSN shareholders 3-1 and 3-2 is faster than the OTP encryption transmission speed between SSN shareholders 3-1 and 3-3. Therefore, the SSN controller 4 makes the size of the share 3-2 distributed and stored in the SSN shareholders 3-2 larger than the size of the share 101-3 distributed and stored in the SSN shareholders 3-3.

[0034] 1, the SSA 30-1 distributes the original data 101 to shares 101-2 and 101-3 based on the distribution mode determined by the SSN controller 4 as described above, i.e., the number of shares to be distributed and the size of each share. The SSA 30-1 then temporarily stores the shares 101-2 and 101-3 in the SSN shareholder 3-1 contained in the SSA 30-1, and notifies the SSN controller 4 that the distribution and temporary storage have been completed.

[0035] When the SSN controller 4 receives the notification from the SSA 30-1, it instructs the SSN shareholders 3-1 to 3-3 to execute a storage control process. In the storage control process, first, the SSN shareholders 3-1 transmits the share 101-2 to the SSN shareholders 3-2 while performing OTP encryption. When the SSN shareholders 3-2 receives the encrypted share 101-2, it decrypts the share 101-2 and stores the decrypted share 101-2. When the share 101-2 is stored in the SSN shareholders 3-2, the SSN shareholders 3-1 deletes the share 101-2 that was temporarily stored in the SSN shareholders 3-1.

[0036] As with share 101-2, first, SSN shareholder 3-1 transmits share 101-3 to SSN shareholder 3-3 while performing OTP encryption. Upon receiving encrypted share 101-3, SSN shareholder 3-3 decrypts share 101-3 and stores the decrypted share 101-3. Once share 101-3 is stored in SSN shareholder 3-3, SSN shareholder 3-1 deletes share 101-3 that was temporarily stored in SSN shareholder 3-1. The process of transmitting share 101-3 to SSN shareholder 3-3 while performing OTP encryption starts at the same time as the process of SSN shareholder 3-1 transmitting share 101-2 to SSN shareholder 3-2 while performing OTP encryption starts.

[0037] The OTP encrypted communication between the SSN shareholders 3 uses an OTP key (OTP encryption key) supplied from the KM 2 connected to each SSN shareholder 3. For example, when the SSN shareholder 3-1 transmits the share 101-2 to the SSN shareholder 3-2, the SSN shareholder 3-1 obtains the OTP encryption key from the KM 2-1 and encrypts and transmits the share 101-2 using the OTP encryption key.

[0038] The SSN shareholder 3-2 obtains from KM 2-2 an OTP encryption key that is the same as the OTP encryption key sent from KM 2-1 to the SSN shareholder 3-1, and decrypts the encrypted share 101-2 using the OTP encryption key obtained from KM 2-2.

[0039] The communication path between the SSN shareholders 3 is, for example, the Internet, but the communication path may be any path.

[0040] According to this embodiment, in a storage network in which the shares 101-2 and 101-3 distributed based on a secret sharing algorithm are distributed and stored, information theoretical security against eavesdropping on the communication path for the distributed storage can be guaranteed. In addition, since the time required to complete the transmission of the share 101-2 to the SSN shareholder 3-2 can be made closer to the time required to complete the transmission of the share 101-3 to the SSN shareholder 3-3, the time required to complete the distributed storage of the shares 101-2 and 101-3 can be made closer to the shortest.

[0041] The process by which the SSA 30-1 obtains the distribution mode from the SSN controller 4 does not necessarily have to be performed after receiving a storage request from the user, and for example, the SSN controller 4 may periodically notify the SSA 30-1 of the distribution mode. Similarly, the process by the SSN controller 4 to obtain the sharing speed of the OTP encryption key from the QKDN controller 5 does not necessarily have to be performed in response to a request from the SSA 30-1, and a method in which the QKDN controller 5 periodically notifies the SSN controller 4 may also be used.

[0042] In addition, in this embodiment, the SSN controller 4 is provided in node 10-2, but other nodes, such as node 10-1 or node 10-3, may also be provided with an SSN controller, or multiple nodes may be provided with SSN controllers, and these SSN controllers may cooperate to issue instructions to execute storage control.

[0043] Also, the shares 101-2 and 101-3 do not necessarily have to be single shares in the secret sharing algorithm used, and each may be a set of multiple shares. For example, when the size ratio of the shares 101-2 and 101-3 distributed and stored in the share holders 3-2 and 3-3 is 3:1, the SSN user data may be distributed into 40 shares of the same size, and a set of 30 of the shares may be assigned to the share 101-2, and a set of the remaining 10 shares may be assigned to the share 101-3. Also, for example, the SSN user data may be distributed into four pieces of different sizes, two of which may be assigned to the share 101-2 and two to the share 101-3, and the ratio of the total size of the two shares assigned to the share 101-2 to the total size of the two shares assigned to the share 101-3 may be 3:1.

[0044] The secret sharing algorithm in this embodiment may be, for example, AONT (All-Or-Nothing-Transform), but the secret sharing algorithm is not limited to this and may be any predetermined secret sharing algorithm.

[0045] [Example of functional configuration] 2 is a diagram showing an example of the functional configuration of the SSN controller 4 of the first embodiment. The SSN controller 4 of the first embodiment includes a communication control unit 41 and a determination unit .

[0046] The communication control unit 41 receives QKDN information from the QKDN controller 5. For example, the QKDN information includes the quantum key sharing speed between each KM 2. Also, for example, the QKDN information includes the stock amount of quantum keys that can be used in each of the multiple SSN shareholders 3 (storage devices).

[0047] In addition, the communication control unit 41 notifies the SSA 30 (distribution device) of the distribution manner of the shares distributed from the data (for example, the distribution number indicating the number of shares distributed from the data, the size of the share, and the SSN share holder 3 that will distribute and store the share).

[0048] The determination unit 42 determines the distribution mode of the shares distributed from the data based on the QKDN information. For example, the determination unit 42 determines the number of shares, the size of the shares, and the SSN shareholder 3 that distributes and stores the shares based on at least one of the quantum key sharing speed and the quantum key inventory. An example of the determination process based on the quantum key sharing speed will be described later with reference to Figures 3A and 4. Also, an example of the determination process based on both the quantum key sharing speed and the quantum key inventory will be described later with reference to Figure 5.

[0049] 3A is a diagram for explaining a method for distributing and storing shares 101-2 to 101-3 and a required time according to the first embodiment. FIG 3A shows an example of the sizes of shares 101-2 and 101-3 specifically determined in the embodiment shown above with reference to FIG 1.

[0050] In the example of Fig. 3A, the SSA 30-1 distributes the original data 101 into two shares 101-2 and 101-3, each of which has a total size of 240 MB, and distributes and stores the data in the SSN shareholder 3-2 and the SSN shareholder 3-3. A quantum key (OTP encryption key) is provided between the SSN shareholder 3-1 and the SSN shareholder 3-2 from the QKDN at a speed of 1 Mbps, i.e., OTP encryption communication is possible at 1 Mbps. On the other hand, a quantum key (OTP encryption key) is provided between the SSN shareholder 3-1 and the SSN shareholder 3-3 from the QKDN at a speed of 250 kbps, i.e., OTP encryption communication is possible at 250 kbps.

[0051] In this case, the SSN controller 4 acquires the quantum key sharing speed between KM2-1 and KM2-2 and the quantum key sharing speed between KM2-1 and KM2-3 from the QKDN controller 5, and specifies the OTP encryption communication speed between the SSN shareholders 3-1 and 3-2 and the OTP encryption communication speed between the SSN shareholders 3-1 and 3-3 to be 1 Mbps and 250 kbps, respectively.Then, since the ratio of the OTP encryption communication speeds is 4:1, the SSN controller 4 determines the size ratio of shares 101-2 and 101-3 to be 4:1, i.e., share 101-2 is 192 MB and share 101-3 is 48 MB.

[0052] By determining the size in this way, the time required to transmit the share 101-2 from the SSN shareholder 3-1 to the SSN shareholder 3-2 is 192*8[Mbit] / 1[Mbps]=1536 seconds. Also, the time required to transmit the share 101-3 from the SSN shareholder 3-1 to the SSN shareholder 3-3 is 48*8[Mbit] / 0.25[Mbps]=1536 seconds. As a result, if the transmission of the share 101-2 and the transmission of the share 101-3 are started at the same time, the transmission of both can be completed after 1536 seconds. In other words, by determining the size of the shares 101-2 and 101-3 so that the time required for the distributed storage approaches the same value, the original data 101 can be distributed and stored in the share holders 3-2 and 3-3 in a shorter time.

[0053] 3B is a diagram for explaining the time required to transmit shares 101-2 and 101-3 when the size of shares 101-2 and 101-3 is divided equally, i.e., 120 MB, without using the method according to this embodiment. In this case, the time required to transmit share 101-2 is 120*8[Mbit] / 1[Mbps]=960 seconds, whereas the time required to transmit share 101-3 is 120*8[Mbit] / 0.25[Mbps]=3840 seconds. Therefore, the distributed storage of shares 101-2 and 101-3 is completed after 3840 seconds.

[0054] As shown in FIGS. 3A and 3B, according to this embodiment, it is possible to reduce the time required to complete distributed storage of the shares 101-2 and 101-3.

[0055] Note that, although Figures 1 and 3A show an example in which the original data 101 is distributed into two pieces, the number of SSN shareholders 3 and the number of distributions of the original data 101 are not limited to this, and can take various forms depending on the configuration of the SSN, the capacity of the storage means provided by the SSN shareholders 3, and the management policy, etc.

[0056] Fig. 4 is a diagram for explaining the distributed storage method and required time of shares 101-1 to 101-3 in the first embodiment. For example, as shown in Fig. 4, SSA 30-1 may distribute shares to three shares 101-1 to 101-3, and distribute and store share 101-1 in SSN share holder 3-1 as well. In this case, if 120MB is to be distributed and stored in share 3-1, SSN controller 4 distributes the sizes of shares 101-2 and 101-3 so that 240-120=120M is 4:1, that is, 96MB and 24MB, respectively.

[0057] The example shown in Figures 1 and 3A is a form in which the QKDN200 generates an OTP encryption key and supplies it to the SSN shareholder 3 pairs (the pair of SSN shareholder 3-1 and 3-2, and the pair of SSN shareholder 3-1 and 3-3). That is, the example shown in Figures 1 and 3A is a form in which the size of the shares 101-1 and 101-2 is determined based on the supply speed of the OTP encryption key (the sharing speed of the quantum key of the KM2 pair corresponding to the shareholder 3 pair), and further, in some SSN shareholder 3 pairs or all SSN shareholder 3 pairs, the OTP encryption key (hereinafter referred to as "key stock") previously stored in the QKDN200 may be available.

[0058] FIG. 5 is a diagram for explaining the distributed storage method and required time of the shares 101-2 to 101-3 in the first embodiment. The example of FIG. 5 shows a case where the key inventory between the SSN shareholder 3-1 and the SSN shareholder 3-3 is 16MB, that is, a maximum of 16MB of the share 101-3 can be transmitted by OTP encryption communication using the key inventory. The communication speed for this 16MB is the normal communication speed between the SSN shareholder 3-1 and the SSN shareholder 3-3, regardless of the sharing speed of the OTP encryption key between KM2-1 and KM2-3 in QKDN200. In the example of FIG. 5, this normal communication speed is 4Mbps, which is the same as the link speed between the SSN shareholder 3-1 and the SSN shareholder 3-3.

[0059] At this time, the SSN controller 4 acquires from the QKDN controller 5 that the key sharing speed between KM2-1 and KM2-3 is 250 kbps and that a 16 MB key inventory is available, and specifies that 16 MB of the shares can be transmitted between the shareholder 3-1 and the SSN shareholder 3-3 at 4 Mbps and the portion exceeding 16 MB at 250 kbps. By setting the size of the share 101-2 to 180 MB and the size of the share 101-3 to 60 MB, the time required to transmit the share 101-2 and the time required to transmit the share 101-3 are both 1440 seconds. In other words, of the 60 MB, 16 MB is transmitted at 4 Mbps using the key inventory, and 44 MB is transmitted at 250 kbps. Therefore, the time required to transmit share 101-3 is the sum of 32 seconds (16*8Mbit / 4Mbps) required to transmit 16MB and 1408 seconds ((60-16)*8Mbit / 0.25Mbps) required to transmit 44MB.

[0060] In addition, if there is a key inventory available that exceeds the size of the share to be transmitted, the SSN controller 4 can determine the size of the share by determining the relationship between the time required for transmission and the size of the share, assuming that the entire share can be transmitted at the speed that would be achieved if the key inventory were used.

[0061] [Example of control method] 6 is a flowchart showing an example of a distributed control method according to the first embodiment. First, the SSN controller 4 (an example of a distributed control device) determines the distribution mode of the shares based on the sharing speed and inventory amount of the quantum key described above (step S1). The distribution mode of the shares includes, for example, a distribution number indicating the number of shares distributed from the data, the size of the shares, and the SSN share holders 3 (an example of a distributed storage device) that distribute and store the shares.

[0062] Next, the SSA 30 (an example of a distribution device) distributes the data into a plurality of shares based on the distribution mode determined by the processing of step S1 (step S2).

[0063] Next, among the multiple SSN shareholders 3 connected by SSN 300 (an example of a storage network), the SSN shareholders 3 determined in the processing of step S1 distribute and store the multiple shares (step S3). Specifically, when each SSN shareholders 3 receives a share encrypted with an encryption key via SSN 300, it decrypts the encrypted share with a decryption key corresponding to the encryption key, and stores the decrypted share. The encryption key and decryption key are generated from a quantum key shared using QKDN 200.

[0064] As described above, according to the quantum cryptography storage system of the first embodiment, data can be distributed and stored in a plurality of storage devices in a shorter time while ensuring the information-theoretic security of the communication path.

[0065] (Modification of the first embodiment) Next, a modified example of the first embodiment will be described. In the description of the modified example, the same parts as those in the first embodiment will be omitted, and only the differences from the first embodiment will be described.

[0066] 7 is a diagram showing an example of the device configuration of a quantum cryptography storage system 100-2 according to a modification of the first embodiment. The quantum cryptography storage system 100-2 according to the modification is different from the first embodiment in that QKDN controllers 5-1 to 5-3 are provided in each node 10. The SSN controller 4 may receive QKDN information from the QKDN controller 5 provided in each node 10.

[0067] Second embodiment Next, a second embodiment will be described. In the description of the second embodiment, the same description as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. In the second embodiment, a case will be described in which a secret sharing algorithm that generates shares of the same size as the original data 101 is used, such as secret sharing in a threshold method using an exclusive OR. That is, in the second embodiment, an embodiment will be described under the premise that it is not possible to give a gradient to the share size as in the first embodiment.

[0068] 8 is a diagram for explaining the method of distributing and storing shares 101-1 to 101-3 and the time required in the second embodiment. In this embodiment, three shares 101-1 to 101-3 temporarily stored in SSN shareholder 3-1 are distributed and stored by selecting any three of SSN shareholder 3-2 to 3-6. SSN controller 4 obtains information on the OTP encryption communication speed (the speed of sharing the quantum key between corresponding KM2) between SSN shareholder 3 from QKDN controller 5, and selects three SSN shareholder 3 that can complete the transmission of shares 101-1 to 101-3 in a shorter time.

[0069] In the example of FIG. 8, the OTP encrypted communication speed between SSN shareholder 3-1 and SSN shareholder 3-2 is 1.5 Mbps. The OTP encrypted communication speed between SSN shareholder 3-1 and SSN shareholder 3-3 is 200 kbps. The OTP encrypted communication speed between SSN shareholder 3-1 and SSN shareholder 3-4 is 400 kbps. The OTP encrypted communication speed between SSN shareholder 3-1 and SSN shareholder 3-5 is 1 Mbps. The OTP encrypted communication speed between SSN shareholder 3-1 and SSN shareholder 3-6 is 3 Mbps.

[0070] In the example of Figure 8, for the sake of explanation, only the links between SSN shareholder 3-1 and each of SSN shareholder 3-2 to 3-6 are shown, but the shape of the storage network including SSN shareholder 3-1 to 3-6 may be any shape, such as full mesh (full connect).

[0071] When transmitting shares 101-1 to 101-3 from SSN shareholder 3-1, SSN controller 4 selects SSN shareholder 3 that can complete transmission of shares 101-1 to 101-3 in the shortest possible time. That is, SSN controller 4 selects the top three SSN shareholder 3 connected by links with faster OTP encryption communication speeds. Specifically, in the example of FIG. 8, SSN controller 4 selects SSN shareholder 3-2 (link OTP encryption communication speed 1.5 Mbps), SSN shareholder 3-5 (link OTP encryption communication speed 1 Mbps), and SSN shareholder 3-6 (link OTP encryption communication speed 3 Mbps).

[0072] In the example of Fig. 8, the QKDN200 generates an OTP encryption key and determines the distribution storage destination of the shares 101-1 to 101-3 based on the supply speed (the sharing speed in the KM2 pair corresponding to the shareholder 3 pair) when supplying the OTP encryption key to the SSN shareholder 3 pair. If the OTP encryption key (the above-mentioned key inventory) previously stored in the QKDN200 can be used in some or all of the SSN shareholder 3 pairs, it can also be as shown in Fig. 9.

[0073] FIG. 9 is a diagram for explaining the method of distributing and storing shares 101-1 to 101-3 in the second embodiment and the required time. The difference from FIG. 8 is that there is a key inventory of 160 MB between SSN shareholder 3-1 and SSN shareholder 3-4. In other words, when SSN shareholder 3-1 transmits share 101-2 to SSN shareholder 3-4, up to 160 MB of the share 101-2 can be transmitted by OTP encryption communication using the key inventory. The communication speed when using the key inventory is not limited by the supply speed of the OTP encryption key, and is the normal communication speed between SSN shareholder 3-1 and SSN shareholder 3-3 (8 Mbps in the example of FIG. 9).

[0074] In the example of Figure 9, when SSN shareholder 3-1 sends share 101-2 to SSN shareholder 3-4, 160MB of the 240MB is sent at 8Mbps using the key inventory, and 80MB is sent at 400kbps. Therefore, the time required to send share 101-2 is 160 seconds (160*8Mbit / 8Mbps) to send 160MB, and 1600 seconds ((240-160)*8Mbit / 0.4Mbps) to send 80MB, totaling 1760 seconds.

[0075] In the example of FIG. 9, the time required for transmission to SSN share holder 3-4 (1760 seconds) is shorter than the time required for transmission to SSN share holder 3-5 in FIG. 8 (1920 seconds), so SSN share holder 3-4 is selected as the distributed storage destination for share 101-2.

[0076] Third embodiment Next, a third embodiment will be described. In the description of the third embodiment, the same description as in the first embodiment will be omitted, and only the differences from the first embodiment will be described. The first and second embodiments are modes in which data is transmitted directly from the SSN shareholder 3-1, which is the origin, to the SSN shareholder 3, which is the distributed storage destination. In this embodiment, as shown in Figures 10A and 10B, a case will be described in which shares 101-2 to 101-4 are transmitted to the SSN shareholder 3, which is the distributed storage destination, via another SSN shareholder 3.

[0077] 10A and 10B are diagrams for explaining the distributed storage method and required time of shares 101-2 to 101-4 in the third embodiment. The example of Figures 10A and 10B shows a case where distributed storage is performed so that the consumption of storage capacity of SSN shareholder 3-2 and SSN shareholder 3-3 is equal.

[0078] 10A and 10B, the OTP encryption communication speed between the SSN shareholder 3-1 and the SSN shareholder 3-2 is 1 Mbps. The OTP encryption communication speed between the SSN shareholder 3-2 and the SSN shareholder 3-3 is 1 Mbps. The OTP encryption communication speed between the SSN shareholder 3-1 and the SSN shareholder 3-3 is 250 kbps.

[0079] 10A and 10B, the SSN controller 4 decides to distribute the original data 101 into three shares 101-2 to 101-4. The SSN controller 4 then controls the transmission of the share 101-3 from the SSN shareholder 3-1 to the SSN shareholder 3-3, and the transmission of the shares 101-2 and 101-4 from the SSN shareholder 3-1 to the SSN shareholder 3-2. The order in which the shares 101-2 and 101-4 are transmitted does not matter, and either may be transmitted first, or a part of the share 101-2 and a part of the share 101-4 may be transmitted alternately.

[0080] Furthermore, when the transmission of share 101-4 to SSN shareholder 3-2 is complete, SSN controller 4 causes share 101-4 to be transmitted from SSN shareholder 3-2 to SSN shareholder 3-3, and after transmission is complete, causes share 101-4 to be deleted from SSN shareholder 3-2.

[0081] Figure 10A shows an example in which the transmission of share 101-4 from SSN shareholder 3-2 to SSN shareholder 3-3 begins after the transmission of share 101-2 and share 101-4 from SSN shareholder 3-1 to SSN shareholder 3-2 is completed. If SSN shareholder 3-2 can receive share 101-2 from SSN shareholder 3-1 and transmit share 101-4 to SSN shareholder 3-3 in parallel, it can also be as shown in Figure 10B.

[0082] In Figure 10B, shares 101-2, 101-3, and 101-4 are distributed so that their sizes are 120MB, 48MB, and 72MB, respectively. SSN controller 4 starts the transmission of share 101-3 from SSN shareholder 3-1 to SSN shareholder 3-3, and simultaneously starts the transmission of share 101-4 from SSN shareholder 3-1 to SSN shareholder 3-2. Then, when the transmission of share 101-4 is completed 576 seconds after the start, SSN controller 4 immediately starts the transmission of share 101-4 from SSN shareholder 3-2 to SSN shareholder 3-3, and simultaneously starts the transmission of share 101-2 from SSN shareholder 3-1 to SSN shareholder 3-2.

[0083] After another 576 seconds, the transmission of share 101-4 to SSN shareholder 3-3 is completed, and after 960 seconds, the transmission of share 101-2 to SSN shareholder 3-2 is completed. Therefore, after 576 seconds + 960 seconds = 1536 seconds from the start of the transmission of share 101-4 from SSN shareholder 3-1 to SSN shareholder 3-2, the process of distributing and storing shares 101-2 and 101-4 to SSN shareholder 3-2 and 3-4 is completed, and at the same time, the transmission of share 101-3 to SSN shareholder 3-3 is completed. This allows the distributed storage to be completed in a shorter time than in the case of FIG. 7A.

[0084] Furthermore, although Figures 10A and 10B show examples in which there is no key inventory, if key inventory is available among the SSN shareholder 3, the SSN controller 4 may determine the manner of distribution of shares taking into account the key inventory.

[0085] In the above-described first to third embodiments, for simplicity of explanation, the control time required to start a transmission process, the control time required to end a transmission process, the control time required to start a reception process, the control time required to end a reception process, and the control time required to start the next transmission following completion of a transmission are described as being 0, but these control times do not have to be 0. The SSN controller 4 may determine the size of a share by taking these control times into consideration in the process of calculating the time required to transmit a share from the OTP encryption communication speed and key inventory acquired from the QKDN controller 5.

[0086] Also, for the sake of simplicity, in Figs. 3A, 3B, 4 and 5, an example has been described in which the size of the original data 101 and the total size of the distributed shares 101-2 to 101-3 are the same. Also, in Figs. 10A and 10B, an example has been described in which the size of the original data 101 and the total size of the distributed shares 101-2 to 101-4 are the same. It is not essential that the total size is the same, and it is assumed that, for example, as in AONT, the total size of the shares 101-2 to 101-N (N is an integer) distributed by a secret sharing algorithm is generally larger than the size of the original data 101. Even in such a case, the time required to transmit the shares 101-2 to 101-N can be calculated from the size of the shares 101-2 to 101-N after distribution, the OTP encryption communication speed between the SSN shareholders 3, and the key inventory, in the same manner as in the first to third embodiments described above.

[0087] Finally, examples of the hardware configurations of the QKD module 1, KM 2, SSN shareholder 3, SSN controller 4, and QKDN controller 5 of the first to third embodiments will be described.

[0088] [Example of hardware configuration] 11 is a diagram showing an example of the hardware configuration of the QKD module 1 of the first to third embodiments. The QKD module 1 includes a processor 201, a main memory device 202, an auxiliary memory device 203, a display device 204, an input device 205, a quantum communication IF 206, and a classical communication IF 207. The processor 201, the main memory device 202, the auxiliary memory device 203, the display device 204, the input device 205, the quantum communication IF 206, and the classical communication IF 207 are connected via a bus 210.

[0089] The processor 201 executes a program read from the auxiliary storage device 203 to the main storage device 202. The main storage device 202 is a memory such as a read only memory (ROM) and a random access memory (RAM). The auxiliary storage device 203 is a hard disk drive (HDD), a memory card, or the like.

[0090] The display device 204 displays the state of the QKD module 1. The input device 205 accepts input from the user. It is noted that the QKD module 1 does not necessarily have to include the display device 204 and the input device 205.

[0091] The quantum communication IF 206 is an interface for connecting to a quantum cryptography communication channel (optical fiber link). The classical communication IF 207 is an interface for connecting to a QKD control signal communication channel, and to KM 2, etc. If the QKD module 1 does not include the display device 204 and the input device 205, the display function and input function of an external terminal connected via the classical communication IF 207, for example, may be used.

[0092] 12 is a diagram showing an example of the hardware configuration of the KM 2, the SSN shareholder 3, the SSN controller 4, the QKDN controller 5, and the SSA 30 in the first to third embodiments. Since the explanation of the hardware configuration of the KM 2, the SSN shareholder 3, the SSN controller 4, the QKDN controller 5, and the SSA 30 is similar, the following explanation will be given taking the SSN controller 4 as an example.

[0093] The SSN controller 4 includes a processor 301, a main memory device 302, an auxiliary memory device 303, a display device 304, an input device 305, and a communication IF 306. The processor 301, the main memory device 302, the auxiliary memory device 303, the display device 304, the input device 305, and the communication IF 306 are connected via a bus 310.

[0094] The processor 301 executes a program read from the auxiliary storage device 303 to the main storage device 302. The main storage device 302 is a memory such as a ROM and a RAM. The auxiliary storage device 303 is a HDD, a memory card, or the like.

[0095] The display device 304 displays the status of the SSN controller 4. The input device 305 accepts input from a user. It is noted that the SSN controller 4 does not necessarily have to include the display device 304 and the input device 305.

[0096] The communication IF 306 is an interface for connecting to the SSN shareholder 3, the SSA 30, etc. If the SSN controller 4 does not have a display device 304 and an input device 305, the display function and input function of an external terminal connected via the communication IF 306, for example, may be used.

[0097] The programs executed by the QKD module 1, KM 2, SSN shareholder 3, SSN controller 4, QKDN controller 5 and SSA 30 are provided as a computer program product stored in an installable or executable format on a computer-readable storage medium such as a CD-ROM, memory card, CD-R, DVD (Digital Versatile Disc), or Blu-ray (registered trademark) Disc.

[0098] In addition, the programs executed by the QKD module 1, KM 2, SSN shareholder 3, SSN controller 4, QKDN controller 5 and SSA 30 may be stored on a computer connected to a network such as the Internet and provided by downloading via the network.

[0099] In addition, the programs executed by the QKD module 1, KM 2, SSN shareholder 3, SSN controller 4, QKDN controller 5 and SSA 30 may be configured to be provided via a network such as the Internet without being downloaded.

[0100] Furthermore, the programs executed by the QKD module 1, KM 2, SSN shareholder 3, SSN controller 4, QKDN controller 5, and SSA 30 may be configured to be provided by being pre-installed in a ROM or the like.

[0101] Some or all of the functions of the QKD module 1, the KM 2, the SSN shareholder 3, the SSN controller 4, the QKDN controller 5, and the SSA 30 may be realized by hardware such as an integrated circuit (IC). The IC is, for example, a processor that executes dedicated processing.

[0102] Furthermore, when multiple processors are used to realize the respective functions, each processor may realize one of the respective functions, or may realize two or more of the respective functions.

[0103] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope and spirit of the invention, and are included in the scope of the invention and its equivalents described in the claims.

[0104] For example, the distributed storage method of the third embodiment may be applied to the first or second embodiment. [Explanation of symbols]

[0105] 1 QKD module 2 KM 3 SSN Shareholder 4. SSN Controller 5 QKDN Controller 10 nodes 20 SSN User Plane 30 SSA 41 Communication control section 42 Decision Section 100 Quantum cryptography storage system 200 QKD 201 Processor 202 Main storage 203 Auxiliary storage device 204 Display device 205 Input Device 206 Quantum Communication Interface 207 Classical Communication IF 210 Bus 300 SSN 301 Processor 302 Main storage 303 Auxiliary storage device 304 Display device 305 Input Device 306 Communication Interface 310 Bus

Claims

1. A plurality of storage devices connected via a communication network; A distribution control device that determines a distribution mode of shares to be distributed from data based on QKDN (Quantum Key Distribution Network) information; A generating device that generates an encryption key and a decryption key using a quantum key shared using a QKDN; A distribution device that distributes the data into a plurality of shares based on the distribution manner, each of the storage devices that distribute and store the shares receives a share encrypted using the encryption key via the communication network, decrypts the encrypted share using the decryption key, and stores the decrypted share; Quantum cryptography storage system.

2. the share is encrypted by one-time pad using the encryption key; The quantum cryptography storage system according to claim 1 .

3. the distribution manner includes a distribution number indicating the number of shares distributed from the data, a size of the shares, and information indicating a distributed storage device that distributes and stores the shares; The distributed control device determines the number of shares, the size of the shares, and the distributed storage devices based on at least one of a sharing speed of the quantum key and an inventory amount of the quantum key used in each of the plurality of storage devices. The quantum cryptography storage system according to claim 2 .

4. The QKDN information includes at least one of a sharing speed of the quantum key and an inventory amount of the quantum key used in each of the plurality of storage devices; the distributed control device calculates a required time for distributing and storing the shares for each storage device from at least one of the sharing speed of the quantum key and the inventory amount of the quantum key used in each of the plurality of storage devices, and determines the number of shares, the size of the shares, and the distributed storage device based on the required time; The quantum cryptography storage system according to claim 3 .

5. the distributed control device selects a storage device for temporarily storing the plurality of shares from the plurality of storage devices, and determines a size of each of the shares so that a time required for distributively storing the shares in each of the distributed storage devices from the selected storage device via the communication network approaches the same value; The quantum cryptography storage system according to claim 4 .

6. The QKDN information includes at least one of a sharing speed of the quantum key and an inventory amount of the quantum key used in each of the plurality of storage devices; the distribution manner includes a distribution number indicating the number of shares distributed from the data, and information indicating a distributed storage device that distributes and stores the shares; the distributed control device calculates a required time for the distributed storage of the shares for each storage device from at least one of the sharing speed of the quantum key and the inventory amount of the quantum key used in each of the plurality of storage devices, and selects a predetermined number of distributed storage devices from the plurality of storage devices in order of the shortest required time. The quantum cryptography storage system according to claim 3 .

7. A QKDN control device that acquires the QKDN information from a key management device, The distributed control device receives the QKDN information from the QKDN control device. The quantum cryptography storage system according to claim 3 .

8. the sharing device distributes the data into the plurality of shares based on the sharing manner and a predetermined secret sharing algorithm. The quantum cryptography storage system according to claim 1 .

9. A distributed control device that communicates with a plurality of storage devices and distributed devices connected by a communication network, A determination unit that determines a distribution mode of shares to be distributed from the data based on Quantum Key Distribution Network (QKDN) information; A communication control unit that notifies the distribution device of the distribution mode; A distributed control device comprising:

10. A computer that communicates with a plurality of storage devices and distributed devices connected by a communication network, A determination unit that determines a distribution mode of shares to be distributed from the data based on Quantum Key Distribution Network (QKDN) information; A communication control unit that notifies the distribution device of the distribution mode; A program to function as a

Images