NTT Research unveils quantum-ready data suite with ABE controls

NTT Research has introduced a Zero Trust Data Security (ZTDS) Suite, offering data-level protection through attribute-based encryption (ABE) that is designed to remain effective in the face of anticipated quantum computing advances. The company has also announced that CRADSEC will license its ABE software to support enhanced security in virtual environments.

Data-centric protection

The ZTDS Suite utilises ABE to enforce access policies based on attributes such as user role, organisational affiliation, or content characteristics.

NTT Research claims the suite offers applications for scenarios including documentation protection, secure management of sovereign video, and data protection within AI environments. Additional applications are said to be in development in response to evolving market requirements.

NTT Research's solution incorporates recent advances in ABE, making it suitable for deployment even against quantum-enabled threats.

This approach is geared towards supporting organisations preparing for new international cybersecurity standards.

"With the exponential development of quantum technologies, governments and security standards bodies are calling on organisations to migrate to a quantum-ready cybersecurity strategy. In anticipation of the quantum computing era, NTT Research's ZTDS Suite ensures critical data will remain secure after quantum capabilities become practical. After the decades-long study and development of ABE, NTT Research is now offering a proactive security solution that outlines a clear migration strategy for a post-quantum world that builds confidence and reinforces commitments to data protection," said Kazu Gomi, President and CEO, NTT Research.

Attribute-based controls

ABE, conceived by Dr. Brent Waters, now Director of the NTT Research Cryptography & Information Security Lab, allows for refined access management. Access can be dictated by content, user roles, or by the involvement of multiple credential authorities.

For example, organisations can configure policies to restrict data access to certain users or only specific data attributes depending on the user's credentials and context.

In multi-authority environments, different institutions can independently issue secret keys tied to specific user credentials. Access to encrypted content then requires the presence of multiple qualifying attributes, such as location or organisational affiliation.

Quantum-safe encryption

Traditionally, practical implementation of ABE for post-quantum cryptography faced performance obstacles. NTT Research reports its scientists have addressed these limitations, allowing for real-world ABE deployments that meet current regulatory and compliance expectations. The company's new PQC-ABE methods enable the use of decentralisation and scalability across large, complex environments and are based on standard cryptographic assumptions.

"Organisations conventionally rely on zero trust architectures to protect their system and network infrastructure. While these defences currently excel at maintaining a strong perimeter against attackers, once the data file itself is leaked, the security is breached. ZTDS provides comprehensive solutions to this scenario by maintaining access controls to the files even if the file is copied, i.e. the file leaks out from the perimeter. Also, quantum computing poses an existential threat to the conventional public key encryption. This new PQC-ABE provides peace of mind for this threat," said Bennett Indart, Senior Vice President of Technology Development and Product Incubation Hub, NTT Research.

NTT Research also provides Crypto Agility software within the suite, allowing businesses to migrate from traditional ABE algorithms to post-quantum cryptographic models without disrupting existing applications or systems.

CRADSEC implementation

CRADSEC, an organisation focused on research into secure computer systems in Japan, is adopting NTT Research's ABE technology for Trusted Execution Environment (TEE) settings. TEEs isolate processing activities, ensuring cryptographic operations remain protected from threats outside the secured environment.

"Enabling ABE capabilities within a TEE makes it possible to perform highly secure, value-added cryptographic operations such as revocation. From the hardware perspective, we will provide highly versatile TEE primitives. Using these primitives, system software will be able to flexibly configure protection domains," said Yutaka Ishikawa, Director and Project Professor, CRADSEC.