Changes in the Environment Surrounding Security R&D and NTT Social Informatics Laboratories’ Challenges

2.1 Limitations of addressing vulnerabilities

With the evolution of software development technology, more and more software is being produced. Naturally, software vulnerabilities (security flaws) disclosed in the National Vulnerability Database (NVD) [1], which is operated by the National Institute of Standards and Technology (NIST) in the United States, are also increasing at an accelerated pace, reaching a level that is no longer easy to deal with.

2.2 AI/LLM abuse and safety

Along with the development and spread of AI, cyber-attacks using AI have become apparent, such as the discovery of traces of LLM use to develop attack codes [2]. As AI is incorporated into the basis of various systems, concerns about the safety of AI are rapidly spreading.

2.3 Human cognition exposed to attacks

Convenient search services and social media can also be a means to efficiently and accurately investigate target people and organizations online. It has thus become possible to efficiently generate and spread sophisticated misinformation and disinformation that affects people’s cognition, and this has become a factor in fraud and social confusion.

2.4 Interest in and expectations for a decentralized society

While the development of cloud services has contributed to society moving online, the risks posed by centralized data management have been highlighted. The European Union is actively working to strengthen individual privacy rights and data sovereignty, and there is growing international interest and expectations for individuals to independently manage and control personal information.

2.5 Advent of quantum computers

Quantum computers [3] bring new risks, such as decryption of data, as well as diverse applications. Conventional cryptographic methods are widely used and deeply embedded in important systems that support society, and it is not easy to respond to decryption risks without omission.

2.6 Threats and risks at the national level

All these threats and risks are spreading not only to individuals and companies but also to national politics, economy, and security, as well as to supply chains across countries.

2.7 Weak security personnel structure

The above situation may further increase the responsibility and importance of security personnel, and their mental and physical burden and tension may exceed the appeal of security work. It may thus become difficult to attract new personnel, making it difficult to maintain the security system.

In response to any of these trends, it is necessary to mobilize all efforts not only from the technical side but also from a variety of other aspects to cope with risks. We believe that it is vital to research and develop security technologies from the perspective of creating a better future, rather than focusing solely on reducing such risks.

3.1 Security R&D to protect society

As mentioned earlier, with the progress in digitalization of society, opportunities for cyber-attacks are increasing, and the damage caused by such attacks is becoming serious. We expect this situation to continue to intensify. To develop even more advanced cyber-attack countermeasures, we are researching innovative cybersecurity technologies that will bring about a game change through collaboration between people and AI (Fig. 3).

Fig. 3. Security R&D to protect society.

3.1.1 AI security enhancement technology

This technology enables AI systems to respond to evolving threats. A method for adjusting the AI system (AI model) (alignment) and a method for blocking and controlling inappropriate input/output during the operation of the AI system (guardrail) are effectively combined starting from the safety inspection to enable continuous and timely response.

3.1.2 Vulnerability risk reduction technology

This technology aims to eliminate the damage caused by exploiting vulnerabilities, from the upstream process of system development to operation. Vulnerability is also a factor in supply chain attacks, and vulnerability countermeasures have become an important issue at the national level since such attacks can bring critical infrastructure to a halt.

3.1.3 Human-centric cybersecurity technology

This is a technology that evolves security activities from the perspective of the people involved in such activities, centering on collaboration between people and AI. We will create new countermeasure technologies based on the basic premise that both security personnel and end users exposed to threats are people with a mind, which will not only improve security but also improve the experience of security activities.

We believe that 20 years of accumulated knowledge and data in the field of cybersecurity will greatly contribute to this research.

3.2 Security R&D for social development

In digital transformation, which is expected to be further accelerated due to the evolution of AI, it is important for the owners of diverse digital data in people, organizations, and society to ensure safe distribution and effective use while mutually confirming trust.

We are conducting research on digital trust enhancement technologies that enable people to truly rely on information distribution systems and AI. These include technology to control the distribution of digital data throughout its life cycle (generation, distribution, accumulation, utilization, disposal, etc.) on the basis of the wishes of the owners of the digital data and technology to reduce the risk of data leakage and privacy infringement in data processing by enabling different owners of digital data to combine and process them while keeping them encrypted (Fig. 4).

Fig. 4. Security R&D for social development.

3.2.1 Person-oriented digital trust assurance technology

In the era of Web3, decentralized identifier/verifiable credential, and AI agents, this technology is a data utilization and protection technology oriented toward individuals that balances business and privacy. Specifically, we grant credentials to people, AI, goods, and data to guarantee and distribute trust. We aim to create technologies that contribute to the foundation of next-generation digital trust in a world where many chains and legacy webs exist.

3.2.2 Privacy data utilization and protection technology

This technology supports the proper protection and active use of privacy data throughout its creation, use, and destruction, in response to the current situation in which a large amount of privacy data is created daily through various economic and social activities. Even in situations where privacy data spans various organizations, countries, and entities, this technology enables robust data protection and flexible distribution and utilization by creating a virtually integrated end-to-end encryption space on IOWN.

3.2.3 Digital value distribution and protection technology

This technology distributes digital value such as electronic cash and value information. Like the cash we use offline, we aim to distribute new electronic value without the need for a central server.

We are also engaged in R&D in the humanities and social sciences, such as legal systems and privacy. We are thus working to deliver our R&D results to society through both technological development and institutional development.

3.3 Security R&D to underpin next-generation technologies

We are also engaged in theoretical research that will underpin next-generation technologies 10 to 20 years from now with the aim of continuously creating world-class basic information security technologies. We have world-leading achievements in that a number of our research results have been continuously adopted in prestigious international conferences and journals. We serve as a center of excellence in theoretical research on cryptography and security.

3.3.1 Post-quantum cryptography

We will drive the safety and security of society by investigating cryptography that cannot be broken by quantum computers (post-quantum cryptography (PQC)). In addition to analyzing the safety and ease of implementation of specific parameters, we aim to establish a cryptographic theory that can achieve both efficiency and composition on the basis of simpler safety assumptions.

3.3.2 Quantum information processing security technology

By fusing cryptography and quantum information processing, we will promote the creation of pioneering security technologies that can only be created by quantum information processing using physical phenomena unique to quantum environments.

3.3.3 Cryptographic primitive protocol construction theory

On the basis of cryptographic theory that enables universal and efficient configuration, we will contribute to the timely provision of safe, convenient, and efficient services by providing cryptographic primitive protocols that are optimal for services in socially important and promising fields.

3.3.4 PQC migration

We are researching and developing technologies to enable us to appropriately and efficiently implement the transition from conventional cryptography to PQC so that people and society will not suffer disadvantages toward the practical application of quantum computers that we will face in 2030. We are also working to standardize the technologies we have created, with the aim of expanding NTT cryptography worldwide.