Quantum cryptography storage system, distribution control device, and computer program product

According to an embodiment, a quantum cryptography storage system includes a plurality of storage, a distribution control device, and a distribution device. The plurality of storage devices are connected via a communication network. The distribution control device determines a distribution mode of shares into which data is distributed, based on quantum key distribution network (QKDN) information. The generation device generates an encryption key and a decryption key by using a quantum key shared by using a QKDN. The distribution device distributes the data into the shares, based on the distribution mode. When receiving a share encrypted using the encryption key via the communication network, each of the plurality of storage devices that stores the shares in a distributed manner decrypts the share encrypted with the decryption key and stores a share decrypted.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2021-184355, filed on Nov. 11, 2021; the entire contents of which are incorporated herein by reference.

FIELD

Embodiments described herein relate generally to a quantum cryptography storage system, a distribution control device, and a computer program product.

BACKGROUND

A network system (storage network) in which storage devices (storages) such as hard disks are arranged as nodes of a communication network, and writing/reading of data from a user application connected to the communication network to/from these storages is conventionally known. In a case where data stored by an application needs to be kept secret in a storage network, there is a method of improving safety by distributing the data on the basis of a secret sharing algorithm and storing the data in a distributed manner in a plurality of physically separated nodes.

DETAILED DESCRIPTION

According to an embodiment, a quantum cryptography storage system includes a plurality of storage, a distribution control device, a generation device, and a distribution device. The plurality of storage devices are connected via a communication network. The distribution control device determines a distribution mode of shares into which data is distributed, based on quantum key distribution network (QKDN) information. The generation device generates an encryption key and a decryption key by using a quantum key shared by using a QKDN. The distribution device distributes the data into the shares, based on the distribution mode. When receiving a share encrypted using the encryption key via the communication network, each of the plurality of storage devices that stores the shares in a distributed manner decrypts the share encrypted with the decryption key and stores a share decrypted.

Hereinafter, embodiments of a quantum cryptography storage system, a distribution control device, and a program will be described in detail with reference to the accompanying drawings.

In a case where data is distributed on the basis of a secret sharing algorithm and stored in a distributed manner in a plurality of physically separated nodes, the original data cannot be restored unless a certain number or more or all distribution pieces (shares), which depends on the secret sharing algorithm, are obtained. For example, even if a share stored in one node is stolen due to an intrusion into the node via a network or a physical intrusion, it is ensured that the original data cannot be restored and even partial information of the original data cannot be obtained.

In addition, when shares are stored in a distributed manner in a plurality of physically separated nodes, it is necessary not only to protect the shares stored in the nodes, but also to protect communication on communication paths from eavesdropping in a process of transmitting the shares to shareholders which are nodes as distributed storage destinations.

Therefore, there has also been proposed a method of applying one-time pad (OTP) encryption using a quantum key supplied from a quantum key distribution network (hereinafter referred to as QKDN), which is a network different from a storage network, to communication for share transmission to ensure information-theoretic security. In this method, the storage network is positioned as a user who consumes the quantum key provided by the QKDN. That is, the storage network is positioned as an application of the quantum key network.

Since OTP encryption is an encryption scheme that requires a key having the same length as data to be encrypted (plaintext), when a share is transmitted in the storage network by using OTP encryption, it is necessary to receive an OTP encryption key having the same size as the transmitted share from the QKDN. Typically, a rate at which the QKDN can generate and supply a quantum key (OTP encryption key) is lower than a rate of a communication path in a storage network as a general communication path. Therefore, the maximum transmission rate at the time of transmitting the share depends on the OTP encryption key generation/supply rate between the nodes that perform the transmission. When there is a difference in OTP encryption key sharing rate between node pairs, if shares are generated so that sizes of all shares are the same, share transmission in a slower node pair takes a longer time, and the distributed storage processing as a whole is not completed until share transmission in a slowest node pair is completed.

In the following embodiments, a quantum cryptography storage system, a distribution control device, and a program capable of determining a distribution mode of shares in which share transmission in a node pair having a slow rate does not become a bottleneck in the entire distributed storage processing of shares even when there is a difference in OTP encryption key sharing rate different depending on the node pair will be described.

First Embodiment

FIG.1is a diagram illustrating an example of a device configuration of a quantum cryptography storage system100according to a first embodiment. The quantum cryptography storage system100of the first embodiment includes three nodes10-1to10-3, a secure storage network (SSN) user plane20, and secure storage agents (SSAs)30-1to30-2.

Hereinafter, the nodes10-1to10-3will be simply referred to as nodes10when not distinguished from each other. Each node10is installed in each base (for example, a communication office building or the like).

The node10-1includes a QKD module1-1, a key manager (KM)2-1, and an SSN shareholder3-1.

The node10-2includes a QKD module1-2a, a QKD module1-2b, a KM2-2, an SSN shareholder3-2, and an SSN controller4.

The node10-3includes a QKD module1-3, a KM2-3, an SSN shareholder3-3, and a QKDN controller5.

Hereinafter, the QKD modules1-1to1-3will be simply referred to as QKD modules1when not distinguished from each other. Similarly, the KM2-1to KM2-3will be simply referred to as KMs2when not distinguished from each other. Similarly, the SSN shareholders3-1to3-3will be simply referred to as SSN shareholders3when not distinguished from each other. Similarly, the SSAs30-1to30-2will be simply referred to as SSAs30when not distinguished from each other.

Note that the devices installed in each node10may be housed in one housing, or may be configured as a plurality of devices by separate housings.

In an SSN user plane20, an SSN data owner, which is an owner of SSN user data, transmits and receives SSN user data. Upon receiving the SSN user data, the SSAs30distribute the SSN user data into a plurality of shares on the basis of a secret sharing algorithm.

Next, a network configuration of the quantum cryptography storage system100of the first embodiment will be described. The quantum cryptography storage system100of the first embodiment includes two networks of a quantum key distribution network (QKDN)200and an SSN300.

Example of QKDN

The QKDN200in the first embodiment is a quantum key distribution network including the three nodes10-1to10-3. Specifically, the QKDN200of the first embodiment includes the QKD modules1, the KMs2, and the QKDN controller5.

The QKD module1-1and the QKD module1-2agenerate a bit string (quantum key) shared by both through the QKD link connecting both. The QKD module1-1and the QKD module1-2atransmit quantum keys to the KM2-1and the KM2-2, respectively, whereby the KM2-1and the KM2-2share a quantum key.

The QKD module1-2band the QKD module1-3similarly generate a quantum key, and the quantum key is shared between the KM2-2and the KM2-3.

In the present embodiment, the QKD module1-1and the QKD module1-3are not connected by a QKD link. Therefore, the KM2-1and the KM2-3share a quantum key by a key relay via KM2-2, for example, by transmitting a part of the quantum key shared by the KM2-1and the KM2-2from the KM2-2to the KM2-3.

The shared quantum keys are transmitted from the KMs2to the SSN shareholders3in response to requests from the SSN shareholders3connected to the respective KMs2.

Example of SSN

The SSN300of the first embodiment is a storage network including the three nodes10-1to10-3(the SSN shareholders3-1to3-3and the SSN controller4), the SSN user plane20, and the SSAs30.

For example, an SSN data owner accommodated in the SSA30-1transmits a storage request to the SSA30-1to store SSN user data in the SSN shareholders3.

Upon receiving the storage request, the SSA30-1distributes SSN user data101(hereinafter referred to as “original data101”) into a plurality of shares on the basis of a secret sharing algorithm. The SSA30-1inquires of the SSN controller4about a distribution mode (for example, the number of shares after distribution and the size of each share) for distribution to the shares.

The SSN controller4determines a distribution mode and notifies the SSA30-1of the distribution mode. In determining the distribution mode, the SSN controller4determines a distributed storage mode of the shares to the SSN shareholders3.FIG.1illustrates an example of a case where it is determined that shares101-2and101-3are stored in a distributed manner in the SSN shareholders3-2and3-3, and at this time, the distribution number in the distribution mode is 2.

In addition, the SSN controller4determines the size of each share in the distribution mode between the SSN shareholder3-1and the SSN shareholder3-2and between the SSN shareholder3-1and the SSN shareholder3-3according to communication rates available while applying the OTP encryption. In the present embodiment, the communication rates available while applying the OTP encryption are sharing rates of the OTP encryption keys between the KM2-1and the KM2-2and between the KM2-1and the KM2-3. The SSN controller4acquires these sharing rates from the QKDN controller5.

In the embodiment illustrated inFIG.1, for example, it is assumed that the OTP encryption key sharing rate between the KM2-1and the KM2-2is higher than the OTP encryption key sharing rate between the KM2-1and the KM2-3. In this case, the OTP encryption transmission rate between the SSN shareholders3-1and3-2is higher than the OTP encryption transmission rate between the SSN shareholders3-1and3-3. Therefore, the SSN controller4makes the size of the share3-2stored in a distributed manner in the SSN shareholder3-2larger than the size of the share101-3stored in a distributed manner in the SSN shareholder3-3.

In the example ofFIG.1, the SSA30-1distributes the original data101into the shares101-2and101-3on the basis of the distribution mode determined by the SSN controller4as described above, that is, the distribution number to shares and the size of each share. Then, the SSA30-1temporarily stores the shares101-2and101-3in the SSN shareholder3-1accommodated in the SSA30-1, and notifies the SSN controller4that distribution and temporary storage have been completed.

Upon receiving the notification from the SSA30-1, the SSN controller4instructs the SSN shareholders3-1to3-3to execute the storage control process. In the storage control process, first, the SSN shareholder3-1transmits the share101-2to the SSN shareholder3-2while performing OTP encryption. Upon receiving the encrypted share101-2, the SSN shareholder3-2decrypts the share101-2and stores the decrypted share101-2. When the share101-2is stored in the SSN shareholder3-2, the SSN shareholder3-1deletes the share101-2temporarily stored in the SSN shareholder3-1.

Also for the share101-3, similarly to the share101-2, first, the SSN shareholder3-1transmits the share101-3to the SSN shareholder3-3while performing OTP encryption. Upon receiving the encrypted share101-3, the SSN shareholder3-3decrypts the share101-3and stores the decrypted share101-3. When the share101-3is stored in the SSN shareholder3-3, the SSN shareholder3-1deletes the share101-3temporarily stored in the SSN shareholder3-1. Note that the process of transmitting the share101-3to the SSN shareholder3-3while performing OTP encryption starts at the same time as the start of the process of the SSN shareholder3-1transmitting the share101-2to the SSN shareholder3-2while performing OTP encryption.

OTP keys (OTP encryption keys) supplied from the KMs2connected to the respective SSN shareholder3are used for the OTP-encrypted communication between the SSN shareholders3. For example, when transmitting the share101-2to the SSN shareholder3-2, the SSN shareholder3-1acquires an OTP encryption key from the KM2-1, and encrypts and transmits the share101-2using the OTP encryption key.

The SSN shareholder3-2acquires the same OTP encryption key as the OTP encryption key transmitted from the KM2-1to the SSN shareholder3-1from the KM2-2, and decrypts the encrypted share101-2using the OTP encryption key acquired from the KM2-2.

Note that the communication paths between the SSN shareholders3are, for example, the Internet, but the communication paths may be arbitrary.

According to the present embodiment, it is possible to ensure information-theoretic security against eavesdropping on communication paths for distributed storage in a storage network in which the shares101-2and101-3into which distribution is made on the basis of a secret sharing algorithm are stored in a distributed manner. In addition, since the time until the transmission of the share101-2to the SSN shareholder3-2is completed and the time until the transmission of the share101-3to the SSN shareholder3-3is completed can be brought close to each other, the time until the distributed storage of the shares101-2and101-3is completed can be brought close to the shortest.

Note that the process in which the SSA30-1acquires the distribution mode from the SSN controller4does not necessarily need to be performed after the storage request is received by the user, and for example, the distribution mode may be periodically notified from the SSN controller4to the SSA30-1. Similarly, the process in which the SSN controller4acquires the sharing rates of the OTP encryption keys from the QKDN controller5is not necessarily performed in response to a request from the SSA30-1, and a method of periodically notifying the SSN controller4from the QKDN controller5may be adopted.

Furthermore, in the present embodiment, the SSN controller4is included in the node10-2, but for example, the other node10-1or node10-3may include the SSN controller, or a plurality of nodes may include SSN controllers, and the SSN controllers may perform the storage control execution instruction in cooperation.

In addition, the share101-2and the share101-3do not necessarily need to be a single share in the secret sharing algorithm to be used, and each may be a set of a plurality of shares. For example, in a case where the size ratio of the shares101-2and101-3stored in a distributed manner in the shareholders3-2and3-3is 3:1, the SSN user data may be distributed into 40 shares all having the same size, a set of 30 shares may be allocated to the share101-2, and a set of the remaining 10 shares may be allocated to the share101-3. Furthermore, for example, the SSN user data may be distributed into four distribution pieces having different sizes, where two pieces are allocated to the share101-2and two pieces are allocated to the share101-3, and the ratio of the sum of the sizes of the two shares allocated to the share101-2and the sum of the sizes of the two shares allocated to the share101-3may be 3:1.

The secret sharing algorithm in the present embodiment can use, for example, all-or-nothing transform (AONT), but the secret sharing algorithm is not limited thereto, and may be a predetermined secret sharing algorithm.

Example of Functional Configuration

FIG.2is a diagram illustrating an example of a functional configuration of the SSN controller4of the first embodiment. The SSN controller4of the first embodiment includes a communication control unit41and a determination unit42.

The communication control unit41receives QKDN information from the QKDN controller5. For example, the QKDN information includes a sharing rate of the quantum key between each KM2. Further, for example, the QKDN information includes a stock amount of the quantum key that can be used in each of the plurality of SSN shareholders3(storage devices).

In addition, the communication control unit41notifies an SSA30(distribution device) of a distribution mode of shares into which data is distributed (for example, the distribution number indicating the number of shares into which data is distributed, sizes of the shares, and SSN shareholders3that store the shares in a distributed manner).

The determination unit42determines a distribution mode of the shares into which the data is distributed on the basis of the QKDN information. For example, the determination unit42determines the distribution number, the sizes of the shares, and the SSN shareholders3that store the shares in a distributed manner on the basis of at least one of the sharing rate of the quantum key and the stock amount of the quantum key. An example of the determination processing based on the sharing rate of the quantum key will be described later with reference toFIGS.3A and4. In addition, an example of determination processing based on both the sharing rate of the quantum key and the stock amount of the quantum key will be described later with reference toFIG.5.

FIG.3Ais a diagram for explaining a distributed storage method and a required time for the shares101-2and101-3according to the first embodiment.FIG.3Aillustrates an example of the sizes of the shares101-2and101-3specifically determined in the embodiment illustrated above with reference toFIG.1.

In the example ofFIG.3A, the SSA30-1distributes the original data101into the two shares101-2and101-3with a total of 240 MB, which are stored in a distributed manner in the SSN shareholder3-2and the SSN shareholder3-3. Between the SSN shareholder3-1and the SSN shareholder3-2, a quantum key (OTP encryption key) is provided from the QKDN at a rate of 1 Mbps, that is, OTP-encrypted communication at 1 Mbps is available. On the other hand, between the SSN shareholder3-1and the SSN shareholder3-3, a quantum key (OTP encryption key) is provided from the QKDN at a rate of 250 kbps, that is, OTP-encrypted communication at 250 kbps is available.

In this case, the SSN controller4acquires the quantum key sharing rate between the KM2-1and the KM2-2and the quantum key sharing rate between the KM2-1and the KM2-3from the QKDN controller5, and recognizes that the OTP-encrypted communication rate between the SSN shareholders3-1and3-2and the OTP-encrypted communication rate between the SSN shareholders3-1and3-3are 1 Mbps and 250 kbps, respectively. Then, the SSN controller4determines that the size ratio of the shares101-2and101-3is 4:1, that is, the share101-2is 192 MB and the share101-3is 48 MB, based on the fact that the ratio of the OTP-encrypted communication rate is 4:1.

With this determination, the time required to transmit the share101-2from the SSN shareholder3-1to the SSN shareholder3-2is 192*8 [Mbit]/1 [Mbps]=1536 seconds. The time required to transmit the share101-3from the SSN shareholder3-1to the SSN shareholder3-3is also 48*8 [Mbit]/0.25 [Mbps]=1536 seconds. As a result, in a case where transmission of the share101-2and transmission of the share101-3are simultaneously started, transmission of both are completed after 1536 seconds. That is, the SSN controller4determines the sizes of the shares101-2and101-3so that the times required for distributed storage approach the same value, whereby the original data101can be stored in a distributed manner in the shareholders3-2and3-3in a shorter time.

Note thatFIG.3Bis a diagram for explaining the time required for transmission of the share101-2and the share101-3in a case where the sizes of the share101-2and the share101-3are equally divided, that is, 120 MB, for example, without using the method according to the present embodiment. In this case, while the time required to transmit the share101-2is 120*8 [Mbit]/1 [Mbps]=960 seconds, the time required to transmit the share101-3is 120*8 [Mbit]/0.25 [Mbps]=3840 seconds. Therefore, the distributed storage of the shares101-2and101-3is completed after 3840 seconds.

As illustrated inFIGS.3A and3B, according to the present embodiment, it is possible to shorten the time until the distributed storage of the shares101-2and101-3is completed.

Note that, althoughFIGS.1and3Aillustrate an example in which the original data101is distributed into two pieces, the number of SSN shareholders3and the distribution number of the original data101are not limited thereto, and can take various forms according to the configuration of the SSN, the capacity of the storage means included in the SSN shareholders3, the management policy, and the like.

FIG.4is a diagram for explaining a distributed storage method and a required time for shares101-1to101-3according to the first embodiment. For example, as illustrated inFIG.4, the SSA30-1may distribute data into three shares101-1to101-3, and the share101-1may be stored in a distributed manner in the SSN shareholder3-1. In this case, assuming that 120 MB is stored in a distributed manner in the share3-1, the SSN controller4determines the sizes of the share101-2and the share101-3such that 240−120=120 M is distributed to be 4:1, that is, they are 96 MB and 24 MB.

The example illustrated usingFIGS.1and3Ais a mode in which the QKDN200supplies the OTP encryption keys to the SSN shareholder3pairs (pair of SSN shareholders3-1and3-2and pair of SSN shareholders3-1and3-3) while generating the OTP encryption keys. That is, the example illustrated usingFIGS.1and3Ais a mode in which the sizes of the shares101-1and101-2are determined on the basis of the supply rates of the OTP encryption keys (the sharing rates of the quantum keys of the KM2pairs corresponding to the shareholder3pairs), but there is a case where OTP encryption keys accumulated in advance in the QKDN200(hereinafter referred to as a “key stock”) is available in some pairs of the SSN shareholders3or all pairs of the SSN shareholders3.

FIG.5is a diagram for explaining a distributed storage method and a required time for the shares101-2and101-3according to the first embodiment. The example ofFIG.5illustrates a case where the key stock is 16 MB, that is, a maximum of 16 MB of the share101-3can be transmitted by OTP-encrypted communication using the key stock between the SSN shareholder3-1and the SSN shareholder3-3. The communication rate for this 16 MB is a normal communication rate between the SSN shareholder3-1and the SSN shareholder3-3regardless of the sharing rate of the OTP encryption key between the KM2-1and the KM2-3in the QKDN200. In the example ofFIG.5, the normal communication rate is 4 Mbps, which is the same as the link rate between the SSN shareholder3-1and the SSN shareholder3-3.

At this time, the SSN controller4acquires from the QKDN controller5that the key sharing rate between the KM2-1and the KM2-3is 250 kbps and that the key stock of 16 MB is available, recognizes that transmission is possible at 4 Mbps for 16 MB of the share and at 250 kbps for more than 16 MB between the shareholder3-1and the SSN shareholder3-3, and determines the size of the share101-2to 180 MB and the size of the share101-3to 60 MB, so that the time required for transmission of the share101-2and the time required for transmission of the share101-3are both 1440 seconds. That is, out of 60 MB, 16 MB is transmitted at 4 Mbps using the key stock, and 44 MB is transmitted at 250 kbps. Therefore, the time required for transmission of the share101-3is the sum of 32 seconds (16*8 Mbit/4 Mbps) required for transmission of 16 MB and 1408 seconds ((60−16)*8 Mbit/0.25 Mbps) required for transmission of 44 MB.

Note that if a key stock larger than the size of the share to be transmitted is available, the SSN controller4determines the relationship between the time required for transmission and the size of the share on the assumption that the entire share can be transmitted at the rate when the key stock is used, and can determine the size of the share.

Example of Control Method

FIG.6is a flowchart illustrating an example of a distribution control method according to the first embodiment. First, the SSN controller4(an example of a distribution control device) determines the distribution mode of the share on the basis of the sharing rate of the quantum key and the stock amount (step S1). The distribution mode of the share includes, for example, a distribution number indicating the number of shares into which the data is distributed, sizes of the shares, and SSN shareholders3(an example of distributed storage devices) that store the shares in a distributed manner.

Next, an SSA30(an example of a distribution device) distributes data into a plurality of shares on the basis of the distribution mode determined by the processing of step S1(step S2).

Next, among the plurality of SSN shareholders3connected by the SSN300(an example of a storage network), the SSN shareholder3determined in the processing of step S1stores a plurality of shares in a distributed manner (step S3). Specifically, when receiving the share encrypted with the encryption key via the SSN300, each SSN shareholder3decrypts the encrypted share with the decryption key corresponding to the encryption key, and stores the decrypted share. The encryption key and the decryption key are generated from a quantum key shared using the QKDN200.

As described above, according to the quantum cryptography storage system of the first embodiment, it is possible to store data in a distributed manner in a plurality of storage devices in a shorter time while ensuring information-theoretic security of communication paths.

Modification of First Embodiment

Next, a modification of the first embodiment will be described. In the description of the modification, the description similar to that of the first embodiment will be omitted, and parts different from those of the first embodiment will be described.

FIG.7is a diagram illustrating an example of a device configuration of a quantum cryptography storage system100-2according to a modification of the first embodiment. The quantum cryptography storage system100-2of the modification is different from that of the first embodiment in that QKDN controllers5-1to5-3are provided in each node10. The SSN controller4may receive the QKDN information from the QKDN controller5provided in each node10.

Second Embodiment

Next, a second embodiment will be described. In the description of the second embodiment, the description similar to that of the first embodiment will be omitted, and parts different from those of the first embodiment will be described. In the second embodiment, a case where a secret sharing algorithm that generates a share having the same size as the original data101, such as secret sharing by a threshold method using exclusive OR, is used will be described. That is, in the second embodiment, an embodiment will be described on the assumption that the size of the share cannot be varied as in the first embodiment.

FIG.8is a diagram for explaining a distributed storage method and a required time for shares101-1to101-3according to the second embodiment. In the present embodiment, any three of SSN shareholders3-2to3-6are selected, and the three shares101-1to101-3temporarily stored in the SSN shareholder3-1are stored in a distributed manner. The SSN controller4acquires information on the OTP-encrypted communication rates (the sharing rate of the quantum key between the corresponding KMs2) between the SSN shareholders3from the QKDN controller5, and selects three SSN shareholders3that can complete transmission of the shares101-1to101-3in a shorter time.

In the example ofFIG.8, the OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-2is 1.5 Mbps. The OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-3is 200 kbps. The OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-4is 400 kbps. The OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-5is 1 Mbps. The OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-6is 3 Mbps.

Note that, in the example ofFIG.8, only the links between the SSN shareholder3-1and the respective SSN shareholders3-2to3-6are illustrated for the sake of explanation, but the topology of the storage network including the SSN shareholders3-1to3-6may be any topology such as a full mesh (fully connected).

When transmitting the shares101-1to101-3from the SSN shareholder3-1, the SSN controller4selects SSN shareholders3capable of completing the transmission of the shares101-1to101-3in as short a time as possible. That is, the SSN controller4selects the three SSN shareholders3connected by links having higher OTP-encrypted communication rates. Specifically, in the example ofFIG.8, the SSN controller4selects the SSN shareholder3-2(link's OTP-encrypted communication rate is 1.5 Mbps), the SSN shareholder3-5(link's OTP-encrypted communication rate is 1 Mbps), and the SSN shareholder3-6(link's OTP-encrypted communication rate is 3 Mbps).

In the example ofFIG.8, while the QKDN200generates the OTP encryption key, the distributed storage destinations of the shares101-1to101-3are determined on the basis of the supply rates (the sharing rates in the KM2pairs corresponding to the shareholder3pairs) in a case where the OTP encryption key is supplied to the SSN shareholder3pairs. In some or all pairs of SSN shareholders3, when OTP encryption keys (key stock described above) previously accumulated in the QKDN200is available, it may be as illustrated inFIG.9.

FIG.9is a diagram for explaining a distributed storage method and a required time for the shares101-1to101-3according to the second embodiment. The difference fromFIG.8is that there is 160 MB of key stock between the SSN shareholder3-1and the SSN shareholder3-4. That is, when the SSN shareholder3-1transmits the share101-2to the SSN shareholder3-4, up to 160 MB of the share101-2can be transmitted by OTP-encrypted communication using the key stock. The communication rate when using the key stock is not bound by the supply rate of the OTP encryption key, and is a normal communication rate (in the example ofFIG.9, 8 Mbps) between the SSN shareholder3-1and the SSN shareholder3-3.

In the example ofFIG.9, when the share101-2is transmitted from the SSN shareholder3-1to the SSN shareholder3-4, 160 MB of 240 MB is transmitted at 8 Mbps using the key stock, and 80 MB is transmitted at 400 kbps. Therefore, the time required for transmission of the share101-2is a total of 1760 seconds including 160 seconds (160*8 Mbit/8 Mbps) required for transmission of 160 MB and 1600 seconds ((240−160)*8 Mbit/0.4 Mbps) required for transmission of 80 MB.

In the example ofFIG.9, since the time required for transmission to the SSN shareholder3-4(1760 seconds) is shorter than the time required for transmission to the SSN shareholder3-5inFIG.8(1920 seconds), the SSN shareholder3-4is selected as the distributed storage destination of the share101-2.

Third Embodiment

Next, a third embodiment will be described. In the description of the third embodiment, the description similar to that of the first embodiment will be omitted, and parts different from those of the first embodiment will be described. In the first and second embodiments, transmission is directly performed from the SSN shareholder3-1serving as the starting point to the SSN shareholders3serving as the distributed storage destinations. In the present embodiment, as illustrated inFIGS.10A and10B, a case where shares101-2to101-4are transmitted to the SSN shareholders3as the distributed storage destinations via other SSN shareholders3will be described.

FIGS.10A and10Bare diagrams for explaining a distributed storage method and a required time for the shares101-2to101-4according to the third embodiment. The examples ofFIGS.10A and10Billustrate a case where distributed storage is performed such that the storage capacity consumption of the SSN shareholder3-2and the storage capacity consumption of the SSN shareholder3-3are equal.

In the example illustrated inFIGS.10A and10B, the OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-2is 1 Mbps. The OTP-encrypted communication rate between the SSN shareholder3-2and the SSN shareholder3-3is 1 Mbps. The OTP-encrypted communication rate between the SSN shareholder3-1and the SSN shareholder3-3is 250 kbps.

In the example ofFIGS.10A and10B, the SSN controller4determines to distribute the original data101into the three shares101-2to101-4. Then, the SSN controller4performs control to transmit the share101-3from the SSN shareholder3-1to the SSN shareholder3-3, and transmit the shares101-2and101-4from the SSN shareholder3-1to the SSN shareholder3-2. Note that, regardless of the transmission order of the shares101-2and101-4, either may precede, or part of the share101-2and part of the share101-4may be alternately transmitted.

In addition, when the transmission of the share101-4to the SSN shareholder3-2is completed, the SSN controller4causes the share101-4to be transmitted from the SSN shareholder3-2to the SSN shareholder3-3, and after the transmission is completed, causes the share101-4to be deleted from the SSN shareholder3-2.

FIG.10Ais an example in which transmission of the share101-4from the SSN shareholder3-2to the SSN shareholder3-3is started after transmission of both the share101-2and the share101-4from the SSN shareholder3-1to the SSN shareholder3-2is completed. If the SSN shareholder3-2is able to receive the share101-2from the SSN shareholder3-1and transmit the share101-4to the SSN shareholder3-3in parallel, it can be as inFIG.10B.

InFIG.10B, distribution is made such that the shares101-2,101-3, and101-4are 120 MB, 48 MB, and 72 MB, respectively. The SSN controller4starts the transmission of the share101-3from the SSN shareholder3-1to the SSN shareholder3-3, and at the same time, starts transmission of the share101-4from the SSN shareholder3-1to the SSN shareholder3-2. Then, when the transmission of the share101-4is completed 576 seconds after the start, the SSN controller4immediately starts the transmission of the share101-4from the SSN shareholder3-2to the SSN shareholder3-3, and simultaneously starts the transmission of the share101-2from the SSN shareholder3-1to the SSN shareholder3-2.

Further, after 576 seconds, the transmission of the share101-4to the SSN shareholder3-3is completed, and similarly after 960 seconds, the transmission of the share101-2to the SSN shareholder3-2is completed. Therefore, after 576 seconds+960 seconds=1536 seconds after the transmission of the share101-4from the SSN shareholder3-1to the SSN shareholder3-2is started, the processing of storing the shares101-2and101-4in a distributed manner in the SSN shareholders3-2and3-4is completed, and at the same time, the transmission of the share101-3to the SSN shareholder3-3is completed. As a result, the distributed storage can be completed in a shorter time than in the case ofFIG.10A.

Furthermore,FIGS.10A and10Billustrate an example of a case where there is no key stock, but in a case where key stock is available between the SSN shareholders3, the SSN controller4may determine a distribution mode of the shares in consideration of the key stock.

Note that, in the first to third embodiments described above, in order to simplify the description, the time required for controlling the start of the transmission process, the time required for controlling the end of the transmission process, the time required for controlling the start of the reception process, the time required for controlling the end of the reception process, and the time required for controlling the start of the next transmission subsequent to the completion of the transmission have been described as 0, but these times do not need to be 0. In the process of calculating the time required for the transmission of the shares from the OTP-encrypted communication rates and the key stock acquired from the QKDN controller5, the SSN controller4may determine the sizes of the shares in consideration of these times.

In addition, in order to simplify the description, inFIGS.3A,3B,4, and5, an example in which the size of the original data101is the same as the total size of the shares101-2to101-3into which the distribution is made has been described. In addition, inFIGS.10A and10B, an example in which the size of the original data101and the total size of the shares101-2to101-4into which the distribution is made are the same has been described. It is not essential that the total sizes are the same, and for example, as in the AONT, a case where the total of the sizes of the shares101-2to101-N (N is an integer) into which the distribution is made by the secret sharing algorithm is larger than the size of the original data101is also assumed. Even in such a case, similarly to the first to third embodiments described above, the time required for transmission of the shares101-2to101-N can be obtained from the sizes of the shares101-2to101-N after distribution, the OTP-encrypted communication rates between the SSN shareholders3, and the key stock.

Finally, an example of a hardware configuration of the QKD modules1, the KMs2, the SSN shareholders3, the SSN controller4, and the QKDN controllers5of the first to third embodiments will be described.

Example of Hardware Configuration

FIG.11is a diagram illustrating an example of a hardware configuration of a QKD module1according to the first to third embodiments. The QKD module1includes a processor201, a main storage device202, an auxiliary storage device203, a display device204, an input device205, a quantum communication IF (interface)206, and a classical communication IF207. The processor201, the main storage device202, the auxiliary storage device203, the display device204, the input device205, the quantum communication IF206, and the classical communication IF207are connected via a bus210.

The processor201executes a program read from the auxiliary storage device203to the main storage device202. The main storage device202is a memory such as a read only memory (ROM) and a random access memory (RAM). The auxiliary storage device203is a hard disk drive (HDD), a memory card, or the like.

The display device204displays the state and the like of the QKD module1. The input device205receives an input from the user. Note that the QKD module1may not include the display device204and the input device205.

The quantum communication IF206is an interface for connection to a quantum cryptography communication path (optical fiber link). The classical communication IF207is an interface for connecting to a QKD control signal communication path, the KMs2, and the like. When the QKD module1does not include the display device204and the input device205, for example, the display function and the input function of the external terminal connected via the classical communication IF207may be used.

FIG.12is a diagram illustrating an example of a hardware configuration of the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30according to the first to third embodiments. Since the hardware configurations of the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30are similar to each other, the SSN controller4will be described as an example in the following description.

The SSN controller4includes a processor301, a main storage device302, an auxiliary storage device303, a display device304, an input device305, and a communication IF306. The processor301, the main storage device302, the auxiliary storage device303, the display device304, the input device305, and the communication IF306are connected via a bus310.

The processor301executes a program read from the auxiliary storage device303to the main storage device302. The main storage device302is a memory such as a ROM and a RAM. The auxiliary storage device303is an HDD, a memory card, or the like.

The display device304displays the state and the like of the SSN controller4. The input device305receives an input from the user. Note that the SSN controller4may not include the display device304and the input device305.

The communication IF306is an interface for connecting to the SSN shareholders3, the SSAs30, and the like. When the SSN controller4does not include the display device304and the input device305, for example, a display function and an input function of an external terminal connected via the communication IF306may be used.

The programs executed by the QKD modules1, the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30are stored in computer-readable storage media such as a CD-ROM, a memory card, a CD-R, a digital versatile disc (DVD), and a Blu-ray (registered trademark) disc as a file in an installable format or an executable format, and are provided as computer program products.

In addition, the programs executed by the QKD modules1, the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30may be stored on a computer connected to a network such as the Internet and provided by being downloaded via the network.

In addition, the programs executed by the QKD modules1, the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30may be provided via a network such as the Internet without being downloaded.

In addition, the programs executed by the QKD modules1, the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30may be provided by being incorporated in a ROM or the like in advance.

Some or all of the functions of the QKD modules1, the KMs2, the SSN shareholders3, the SSN controller4, the QKDN controllers5, and the SSAs30may be realized by hardware such as an integrated circuit (IC). The IC is, for example, a processor that is designed to execute an application-specific task.

In addition, in a case where each function is realized by using a plurality of processors, each processor may realize one of the functions or may realize two or more of the functions.

Although some embodiments of the present invention have been described, these embodiments have been presented as examples, and are not intended to limit the scope of the invention. These novel embodiments can be implemented in various other forms, and various omissions, substitutions, and changes can be made without departing from the gist of the invention. These embodiments and modifications thereof are included in the scope and gist of the invention, and are included in the invention described in the claims and the equivalent scope thereof.

For example, the distributed storage method of the third embodiment may be applied to the first or second embodiment.