Quantum Computing Security Could Solve The Data Sovereignty Challenge

Uploaded on 2024-08-20 in TECHNOLOGY-Key Areas-Quantum Computing, FREE TO VIEW

Following news that Microsoft is unable to guarantee the sovereignty of UK policing data stored on Azure, some commentators have suggested that a quick move away from Microsoft cloud is probably the only option for UK organisations keen to ensure they remain on the right side of British law.

The issue came to light following a FOI request that highlighted how Microsoft could not guarantee that sensitive law-enforcement data, hosted on its public cloud infrastructure, would remain in the UK - a key legal requirement for many organisations.

The disclosure also revealed how data hosted in Microsoft’s public cloud infrastructure is regularly transferred and processed overseas; a process inherent to its public cloud architecture and therefore causing problems for businesses that have regulatory limitations around the offshoring of UK data.

So, what can organisations do to ensure their data processing remains on the right side of the law when it comes to managing data sovereignty?

The Data Infrastructure Challenge

One option is for organisations to move away from Microsoft cloud-based products. Such an approach would undoubtedly open a Pandora’s box of risks though, which may pose more of a threat to data integrity than the good intentions behind the move.

The first challenge lies in the scale of any transformation process. For many organisations, the volume and tailored nature of existing data infrastructures make transfers to new systems inherently risky. Not only do they require a significant investment of time, but reconfiguring aspects of the architecture - taking items out, adding them back in and designing systems to allow for regular updates - all create opportunities to lose files, corrupt key data, and open up vulnerabilities to bad actors.

There are also direct costs when cloud providers charge to pull back data stored on their infrastructure or transfer this to other providers.

Where data is critical to business operations, transferring systems away from existing platforms also creates timing and prioritisation issues. If you want to move away from a particular vendor starting with one department, it is likely to generate a catastrophic set of interoperability problems that create significant risks for the delivery of essential services.

So, if moving away from existing providers is possible but inherently risky, what alternatives are there?

The Quantum-Resistant Solution

To protect against these super computers, new, secure data-storage solutions are being developed. Some of these disaggregate data and disseminates it across multiple storage end points: The disaggregation is at the bit level (digital ones and zeros), the dissemination is random and none of the many end points has all the binary digits for any data asset.

Reassembly of the data assets includes full integrity checks but the approach means the data cannot be decrypted as even a quantum computer working at high speed would not be able to recreate the original information with only part of the story to work from.

The implications of such a solution for data sovereignty laws are exciting.

What Is Data? And What Does That Mean For Data Sovereignty?

Loosely speaking, data sovereignty means that governments have control over data located within their jurisdictions. Information stored in the cloud can be subject to a variety of national laws, depending on where data is stored, processed or transmitted. With huge amounts of data stored outside of national boundaries, it is a critical data- and national-security issue.

But what if that data was disaggregated and disbursed across multiple geographic jurisdictions? If data is broken up at bit level and randomly distributed to multiple locations across multiple cloud endpoints, not only is that ‘data’ securely stored but it should also meet data sovereignty rules, wherever those end points are in the world.

Why? Because data can only exist in complete form.

When you anonymise it and disaggregate it at bit level, it is impossible to retrieve and reconstruct without an ‘algorithm key’. From a security perspective, if elements secured in the cloud were accessed by storage providers, hackers or governments, all that could be retrieved is random fractions of binary digits that are unintelligible on their own. Legally, it would not constitute ‘data’. Therefore, once disaggregated, the concept of jurisdiction is removed.

The Way Forward

Adopting such cloud-protection ‘gateways’ allows organisations to keep existing data storage architecture - such as Microsoft Azure - in place and hone it in their own time. They can be installed on-premises, protecting data at source and allowing organisations to comply quickly with national regulations on data protection without risking data loss or architecture breakdown.

Once a multi-cloud environment has been created, organisations can rebalance what data is held where across multiple providers. This not only dilutes the risk by spreading storage across multiple endpoints but, the more data is managed in this way, the more obfuscated - and therefore secure - it becomes.

The approach also reduces continuity risks. The design of the platform means that, in the event of loss of connectivity to the end points’, or data corruption, the algorithm (accessed only by keyholders) can recalculate the missing digits stored in the corrupted endpoint, restoring the original information to data owners quickly and efficiently.

It is a secure and resilient solution that not only reduces security risks but also simplifies the storage regime while meeting data sovereignty requirements.

Moving away from existing architecture may well be a risky hammer to crack a nut when there are simpler, less risky and more cost effective options out there.

Getting it right is key to building a more secure, reliable data infrastructure for all.

Adrian Fern is Chief Technology Officer at Prizsm Technologies

Image: Vitalii Gulenok

You Might Also Read:

The Key To Future-Proof Encryption:

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.