Special Feature

Cyber Security Project for Safe andSecure Network Services
Yoshitaka Kagei, Kazuyuki Nakagawa, Takeshi Tachi†,Masao Takeda, and Tetsuya Nakagawa
Abstract
To respond to various security-related topics for our information-technology-driven society, the Cyber
Security Project, which is composed of security producers, is performing a broad range of activities. For
example, it is promoting the development of products that take advantage of the latest security technology from NTT Laboratories and Group corporations. It is also supporting the deployment of such products and technical know-how across the Group and studying the types of security technology that will beneeded in the future, including performing analyses that go beyond sociological studies.

1. Role of the Project
The Cyber Security Project, which was set up in
2003, consists of a team of security producers who

Needs of NTT Group
corporations

perform a broad range of activities related to security
for the entire NTT Group. An overview of the prevailing external environment that is relevant to the
Cyber Security Project is shown in Fig. 1. Activities

Trends of social security& security business• Identify trends(1), (2), (3)Products & technology• Grasp business needs (1), (3)of vendors and system• Coordinate product introduction (1)• Spread technical know-how andintegrators outside NTT Group• Identify• Develop & introduce
promote common measurescommercial
R&D productsin the NTT Group (2)product trends (2), (3)Producers• Support maintenance• Coordinate R&D• Gather technical know-how (2), (3)product introduction (1)• Identify commercial product trends (2), (3)• Gather technical know-how
R&D directors(2), (3)• Ask to test commercial
products (2), (3)Security products & technology
Security technology & know-how
in NTT Group corporationsof NTT Laboratories

Numbers in parentheses refer topatterns discussed in section 2.

Fig. 1. External environment relevant to the Cyber Security Project.
† NTT Department III
Chiyoda-ku, Tokyo, 100-8116 Japan
E-mail: security-p@ml.hco.ntt.co.jp

Vol. 3 No. 5 May 2005

17

Special Featureinclude matching the needs of Group corporations tothe seeds of NTT Laboratories and promoting measures to cope with security-related issues common to
the entire NTT Group. The main needs are for security technology and know-how about IP networks thatwill help system operators manage the system stably.
The project’s main activities and results are describedin Section 2. By continually observing trends in theworld at large from a sociological perspective, theProject works to ascertain the types of security-related businesses that will be in demand in the future andunderstand the direction of current technologicaldevelopment. Section 3 explains some achievements
up to FY 2004.
2. Security development coordination activities
Common patterns in coordination activities can beorganized according to their purpose. There are threepatterns: (1) commercializing technology seeds in
NTT Laboratories, (2) organizing and implementing
security know-how within NTT Group, and (3) promoting security measures for NTT Group businesses.
Typical activities for each pattern are described
below.
Pattern (1): Cultivating and commercializing
applications of security technologies created in
NTT Laboratories
Pattern (1-1) Applying technology for centralized
network profile management to businessIn recent years, the computing environment haschanged due to an increase in remote access andmobile terminals and the severe damage caused byviruses from terminals connected to the Internet(especially via corporate local area networks(LANs)). The security management and surveillance systems needed to manage terminals and
LAN connections are also growing more and more
complex and sophisticated. Along with thesechanges, hidden problems have come to light, suchas the difficulty of managing user registration andupdates for systems individually introduced to the
network and the significant complexity of systemsettings that needed to be made by the users themselves.
To respond to such issues, NTT Laboratories
developed technology for centrally managing profile settings for each of the user terminals and different access networks (e.g., wired LAN, wirelessLAN, RAS (remote access server), and Internet
VPN (virtual private network)). This secure enter18

prise network access control system is called
SENACS. It lets system administrators perform
centralized user management spanning multiple
access networks and lets users connect to the internal corporate LAN safely without changing complicated terminal settings (Fig. 2). It has three mainfeatures: 1) Regardless of the location from which
an employee connects to the intranet, SENACS
automatically selects the optimum communication
protocol; 2) no manual setup is required for network profiles (layer 2/3) for each different terminalor access line, except for an initial installation ofterminal software and user profile; and 3) by interlinking to a commercial quarantine system, infected or untested terminals are isolated from theintranet.
To let corporate customers use such advanced
technology without confusion, security producers
integrate it with complementary systems that arecommercially available, such as a quarantine system and an authentication VLAN (virtual LAN).
Moreover, this integrated solution is provided toenterprises along with the know-how needed to
introduce the system while keeping any changes tocustomers’ legacy infrastructures to the absolute
minimum.
Pattern (1-2) Commercializing time authenticationand time delivery technologies
The so-called E-Document Law was ratified by
the Diet in autumn 2004 and took effect in April
2005. This law allows companies to store tax-related and other official documents in digital format,
instead of only being allowed to use paper documents as in the past. Keidanren (Japan Business
Federation) expects the economic effects of thischange to be as high as 300 billion yen. However,in order to store documents electronically under the
E-Document Law, it is necessary to construct aninfrastructure including document management
applications and additional functions, such as atime authentication (timestamp) function and a
traceable time delivery function. A time authentication function associates a specific time with each
digital document and can prove that the document
has not been changed after storage. A traceable
time delivery function announces the correct timeto the entire network and can be used to confirm theprecision with which time announcements weretransmitted in the past. To enable each NTT Group
company to efficiently develop the document storage management and other related businesses,
security producers coordinate activities among
NTT Technical Review

Special Feature

Headquarters office LAN
Sales section
VLAN

Planning section
VLAN

Development
section VLAN

Quarantine network
Intra-office usage

Remote access usage
Home

Desk
Local IP network
Conference
room

Authentication
VLAN
Intra-office
wireless LAN
Intra-office
wired LAN

Branch officeHot-spot
wireless LAN

Hotel, station,etc.

mopera or ISP
PHS ormobile phone

Internet cafe,etc.

ISP: Internet service provider
mopera: mobile operation radio assistant. NTT Docomo’s
PHS: personal handy-phone service
Internet connection service for mobile terminals.
Access lines (WAN): fixed phone, mobile phone, hot-spot wireless LAN, ADSL, and HTTP
Networks (LANs): wired LAN (authentication VLAN) and wireless LAN (IEEE802.11b, 802.1x)
Protocols: PPP, PPPoE, IPsec, 802.1x (EAP-TTLS, EAP-TLS)
Note: combinations are available, e.g., 802.1x/PPPoE/IPsec for a hot-spot wireless LAN or PPPoE/IPsec for ADSL

Fig. 2. Overview of the secure enterprise network access control system (SENACS).

Group companies. They promote cooperation
between Group companies and the division of
responsibilities with regard to the construction of
the requisite time authentication and time delivery
infrastructure by using technologies developed by
NTT Laboratories.
Pattern (2): Organizing security technology andknow-how from the community andimplementing them within the Group
Pattern (2-1) Systematizing knowledge about information leakage countermeasures
The Personal Information Protection Law, whichcame into effect in April 2005, enforces a course ofactions on companies, municipalities, and in particular divisions within the NTT Group. These organizations need to review their management and security systems, for example those concerning customer data, homeowner data, and employee data,and strengthen measures to prevent the leakage ofsuch information.
Along with the spread of the Internet and personVol. 3 No. 5 May 2005

al computers, technologies intended to protect
against information leakage have become widespread such as user authentication, encryption ofcommunications, and firewalls. Nevertheless, as
new technologies appeared, such as wireless LANs
and P2P file sharing software, new risks became
visible. Consequently, products and services thatprovide the technical expertise to deal with theseissues have appeared. Recently, these issues havebeen viewed from a more human perspective, suchas the need to monitor terminal operation logs to
guard against input errors and unauthorized operation (Table 1).
As the complexity and sophistication of measuresagainst information leakage increase, it is growing
more and more difficult to make decisions such as
which technology or product to use for a specificorganization and to what extent protective measures should be implemented. Based on the insightsof the NTT Laboratories, security producers haveworked to systematize knowledge about the commercialized information security solutions, the lat19

Special Feature

Table 1. Transition of information security management.
*1

Period1995–1999

2000–2002

Major events,social trend-Information security-Virus infections
risks of IT*2 became
drastically increased.
-Security risks ofapparent.
wireless LAN became-Web pageinterpolations increased. apparent.

2003–2004

2005–(projected)-Incident response
know-how becomesgeneralized.
-IPR*5 leakage risks
become apparent.
-The E-Document
Law takes effect.

-Personal Information
Protection Law took
partial effect.
-Phishing damage
increased.
-P2P software risks
became apparent.

Risk
#

Risk

1

Tapping over network-email encryption-countermeasuresagainst wireless LAN

2

Spoofing over network-periodical renewal of
IDs & passwords-biometrics-one-time passwords

3

Illegal transfer/address
error/wrong address
over network-document security
management-training employees-email monitoring-P2P software monitoring-URL access monitoring -providing security policy -illegal operation
monitoring-network forensics

4

Software weakness of
network nodes, servers,
and PCs-countermeasuresagainst Web application -desktop management
weakness
system-firewall-IDS*3, IPS*4-electronic certificate-single sign on-document originality
assurance-information lifecycle
management-computer forensics-privacy protection-quarantine system

5

Virus infection of network
nodes, servers, and PCs-access log monitoring

6

Inappropriate copying of
information over mobile
PCs or external memory
devices-document security
management-training employees-providing security policy -illegal operation
monitoring

7

Electromagnetic leakage-cable shielding

8

Careless printing or
taking pictures-document security-training employees-providing security policy management

9

Physical intrusion-biometrics

10

Inappropriate incident
responses (increase thedamage)-thin client-information lifecycle
management-TEMPEST (transient
electromagnetic pulse
surveillance technology)-network forensics-information lifecycle
management-document originality
assurance-information lifecycle
management-computer forensics

Countermeasures against leakage through outside intrusion
Countermeasures against leakage by insiders*1 “Period” indicates the approximate time of media attention to each countermeasure, not necessarily when they became widely used inenterprises.
*2 IT: information technology*3 IDS: intrusion detection system*4 IPS: intrusion protection system*5 IPR: intellectual property rights

est technologies, and the rules and organizational
structures for corporate compliance (Table 2). Thisknowledge base is being used to inspect andstrengthen the information management systems of
the NTT Group and also as a way to recommend
tools to customers. Based on the results of these
activities, efforts are also being made to develop
20

educational programs, inspection check sheets andother resources to strengthen the information security infrastructure within the NTT Group.
Pattern (2-2) Creating encryption usage guidelines
Encryption is now used frequently by Internet
users. For example, SSL (secure socket layer) connections are used to protect personal information
NTT Technical Review

Special Feature

Table 2. Knowledge base of information security management.
Title

Target readers

Content

Volume 1:
Solution map of information
security management, 2004

Commercial products andtechnologies are systematizedcomprehensively in this map.

1) Sales staff of enterprise security
solution business2) Intra-company security managers

Volume 2:
Technology guidebook of
information security management

Technical know-how of current
countermeasures for information
security management is systematized.

1) System designers and operators
2) Sales staff of enterprise security
solution business

Volume 3:
Guidebook for providing personal
information protection rules

Things to be done before the
Personal Information Protection Law
takes effect are systematized.

1) Staff with the mission of providing
intra-company rules2) Intra-company inspectors
3) Consultants who propose intracompany security management

Safety of encryption techniques degrades steadily when their specifications and assessments are open to the public.
Radical degradation of safety is possible when they are not open to the public.

The more assessment results
an encryption method has,the less radically its safety
tends to degrade.

Safe zone

Safe

Countermeasures
are studied

Dangerous zone

Countermeasures
are provided

Breakable zone

Usage stops

SafetyWarning zone

Time

Fig. 3. Degradation of safety of encryption and digital signature.

when making online transactions or when encrypting electronic documents. NTT Laboratories started research into encryption algorithms a long timeago. And algorithms proposed by NTT such as
Camellia and PSEC-KEM have been selected forJapan’s e-government recommended encryption
algorithm list. They have also been designated as
selected encryption algorithms in Europe’s
NESSIE project (new European schemes for signatures, integrity and encryption).
However, improvements in computing performance and the appearance of new decryption technologies may sometimes make it possible to breakencryption schemes. In that case, to prolong thesafety of products and services, system designers
must replace the encryption algorithm or systemwith a more advanced or secure one (Fig. 3). For
Vol. 3 No. 5 May 2005

example, the DES algorithm, which is well known
for its use over many years, is not among those on
Japan’s e-government recommended encryption
algorithm list.
To deal with this challenge, security producers
have developed comprehensive guidelines basedon the insights of the NTT Laboratories specifying
procedures for the selection of appropriate encryption algorithms. By referring to these guidelines, alltechnologists in the NTT Group using encryption
technology and related products can accurately
understand the safety level of their system andproperly select and use encryption technology. At
the same time, these guidelines help security managers anticipate how current encryption methods
could endanger a service on offer and implement
protective measures before failures occur (Fig. 4).
21

Special Feature

Problems

Approaches

Countermeasures

Monitor and announce
safety assessment
Safety of encryption algorithms
has become degraded.

Validity of cryptogram anddigital signatures is suspect.

Judge the need to replace
the encryption algorithm

Maintain the capability of concealment
and signature verification

Provide alternative encryption
algorithms
Convert to safer encryption
algorithm
Hedge bets
(countermeasures other than encryption)

Fig. 4. Countermeasures against endangered encryption and digital signature techniques.

Pattern (3): Promoting measures concerning
security topics common to NTT Group businesses
Pattern (3-1) Countering DDoS attacks
To counter the damage caused by distributed
denial of service (DDoS) attacks, NTT Laboratories developed a technology for detecting andblocking them called MovingFirewall [1]. Whenthe system detects an attack, it traces the attack
back up the Internet to multiple sources and intercepts the attacking packets at points in the network
close to the sources. In order to expand the use ofthis technology, security producers must negotiatewith domestic and overseas vendors of the routersand switches that make up the Internet so that thekey technology will be built into these devices andin this way operate globally to further improve thereliability and safety of the network.
Pattern (3-2) Countering spam and other undesired
email
These days massive volumes of unsolicited commercial email are being sent to end users and various illegal scams are being conducted via email. In
response, NTT Laboratories developed the privango mail system [2], which allows only the receipt ofemail that meets certain conditions such as sendername and expiry date. To promote its use, security
producers conducted a live demonstration of its
safety and convenience. Opinions and feedback
from users are currently being examined and will
be incorporated into future products to promote theuse of safer and securer electronic mail systems.

22

3. Sociological approach toward security
Security is a problem that arises from the interaction between social structures and people. In thissense, focusing on social structures and the humanbeings that form them, analyzing their modes ofactivity, and considering the potential effects on themof newly introduced technologies and services are all
critical to the development of a healthy networked
society of the future. This section reviews the state of
responses to various issues related to security producer activities from this perspective.
3.1 FY2004 & 2005 activities
In FY2004, emphasis was placed on social structures and their relation to human beings and studies
were performed to understand phenomena that may
effect security. Advice was sought from university
professors and various Internet experts concerning a
number of perspectives: 1) the trustworthiness of
information on the Internet, 2) community and wellordered networks, 3) educational issues related toadaptation to network society, 4) legal systems, 5) thebalance between regulations and voluntary management, and 6) trends in technical measures and related
points. Several discussions of these issues were heldin the course of this research.
For FY2005, two general goals have been planned
based on the results of the previous year’s work. The
first goal is to analyze the functionality, structure, andsystems necessary to build a stable social infrastructure given the vulnerability and frailness of IP networks through a comparison with the history of theautomobile from its introduction on up to the current
NTT Technical Review

Special Feature

automobile-based society. Our automobile-basedsociety experiences approximately 10,000 vehiclerelated fatalities per year and many times that numberof injuries; nevertheless, the automobile is regarded
as being necessary and various safety-related technologies, organizational structures, and systems having sprung up around it. Research on IP networks will
be conducted based on this analogy in order to compile necessary preventive measures.
The second goal is to survey the state of security in
the U.S. and Europe and grasp the situation facing
Japan. If security is a reflection of society, then its
implementation ought to differ depending on local
cultural differences. For example, a great deal ofdamage due to DDoS attacks and spam mail is known
to have occurred in the English-speaking world. It isthought that by studying how the environmental conditions (such as the state of security, opinions about it,
and social structures) differ from region to region
based on historical and current examples, it should bepossible to hypothesize the risks that Japan will facein the future. In addition, by clarifying the differencesin the security and legal measures found necessary in
different regions, it should be possible to find pointers indicating the level of security that NTT Groupshould attain as a global corporation.
3.2 Three important issues
Based on the sociological research approach initiated in the latter half of FY2004, the following threeissues are thought to be most important ones among
those found to date concerning security of information communication technology (ICT).
1. Guaranteeing the integrity and completeness ofdata and the disclosure/display of this information: What measures should be implemented
toward use of the latest ICT concerning antisocial acts and breaches of trust such as the falsi-Vol. 3 No. 5 May 2005

fication or concealment of information insideand outside a company? What kind of ICT
should exist and how should it be operated inorder to prevent wrongdoing?
2. Guaranteeing the continuity of social infrastructure functions: How should the infrastructure be protected and functionality be maintained in the event of natural disasters such as
earthquakes and typhoons and man-made disasters such as terrorist attacks?
3. Preventing information from spreading overtime and space: Looking towards the future digital society, what kinds of preparations are necessary so that the usability of information will
be not degraded, even as systems or applications change from one region to another or
evolve from one era to the next?
To tackle these issues, we must always react sensitively to changes in the world at large and we intend
to continue this work in the future.
4. Conclusion
The activities of security producers take into
account the results of research conducted from asociological approach, designate technical goals forthe future, and promote R&D activities to support
these initiatives. Through these activities, security
producers will contribute to the business of the NTT
Group by proposing and promoting all security measures.
References[1][2]

N. Wada, “Ushering in a New Networked Society,” NTT Technical
Review, Vol. 2, No. 4, pp. 6-13, 2004.
K. Takahashi, T. Abe, and M. Kawashima, “Stopping Junk Email byUsing Conditional ID Technology: privango,” NTT Technical
Review, Vol. 3, No. 3, pp. 52-56, 2005.

23

Special Feature

Yoshitaka Kagei

Takeshi Tachi

Senior Manager, Chief Producer, Cyber Security Project, NTT Department III (R&D Strategy
Department).
He received the B.E. degree in electrical engineering from Yokohama National University,
Yokohama, Kanagawa in 1978. In 1978, hejoined Nippon Telegraph and Telephone Public
Corporation (now NTT), Tokyo, Japan andengaged in the development of digital data transmission and switching systems. After that, hemoved to NTT DATA Corporation and engaged
in the development of products and systems
applying security technologies at R&D Headquarters and in the development of new businesses at Corporate Strategy Division. In 2003,
he moved to his present post in NTT.

Senior Research Engineer, Supervisor, Cyber
Security Project, NTT Department III (R&D
Strategy Department).
He received the B.E. and M.E. degrees in electrical engineering from Osaka University, Suita,
Osaka in 1987 and 1989, respectively. In 1989,
he joined NTT Telecommunication Networks
Laboratories. In 1997, he received the M.S.
degree in industrial engineering and operations
research from the University of California,
Berkeley. He has been engaged in the development of IP network systems and banking systems
and the planning of R&D strategy in the field of
information sharing platforms. In 2004, hemoved to his present post in NTT.

Kazuyuki Nakagawa
Senior Manager, Cyber Security Project, NTT
Department III (R&D Strategy Department).
He received the B.E. and M.E. degrees in electro-communications engineering from the University of Electro-Communications, Chofu,
Tokyo in 1980 and 1982, respectively. In 1982,
he joined the Yokosuka Electrical Communication Laboratories, Nippon Telegraph and Telephone Public Corporation (now NTT). He has
been engaged in the development of integrated
business communication systems and intelligent
transport systems and the planning of R&D strategy in the field of information sharing platforms.
In 2003, he moved to his present post in NTT. He
is a member of the Institute of Electronics, Information and Communication Engineers (IEICE)of Japan.

Masao Takeda
Producer, Cyber Security Project, NTT
Department III (R&D Strategy Department).
He received the B.E. and M.E. degrees in electrical engineering from Yamagata University,
Yonezawa, Yamagata in 1993 and 1995, respectively. In 1995, he joined NTT Tohoku Branch
Office. He has been engaged in the planning ofmultimedia services, the development ofadvanced intelligent network systems, and theplanning of R&D strategy for information sharing platforms. In 2003, he moved to his present
post in NTT.

Tetsuya Nakagawa
Senior Research Engineer, Supervisor, Planning Section, NTT Information Sharing Platform
Laboratories.
He received the B.E. and M.E. degrees in electrical engineering from Waseda University,
Tokyo in 1986 and 1988, respectively. In 1988,
he joined NTT Transmission System Laboratories. He has been engaged in system development for Internet service providers and Internet
portal services and the planning of R&D strategy
in NTT Information Sharing Platform Laboratories. In 2003, he moved to his present post in
NTT.

24

NTT Technical Review