Guo Jingyu: New prospects for China's data security

Editor's note: China recently unveiled a draft of its 15th Five-Year Plan to guide the development of its key economic and social sectors. CGTN invites industry insiders and experts to interpret the policy implications in the field of science and technology – a major growth engine for the nation. In this episode, we are joined by Guo Jingyu, CEO of Fisherman Info and recipient of the National Cryptography Science and Technology Progress Award, who explains how the 15th Five-Year Plan drives China's data security industry, its commercial breakthroughs and global competitive edge.

Policy guidance: The 15th Five-Year Plan boosts data security capabilities and industry ecosystem

The upcoming 15th Five-Year Plan establishes a coordinated mechanism of "strategic guidance, investment inclination, market-driven traction and institutional guarantee" for key areas like cryptography and data security. It aims to enhance national security capabilities in the data domain and build an independent, secure and reliable data security industrial chain through strengthened strategic guidance, increased R&D investment, market cultivation and standardized system development.

Policy-wise, the plan explicitly calls for "strengthening national security capabilities in emerging fields such as data" and "safe development of the digital economy," shifting the industry from "passive compliance" to "proactive empowerment." 

Key infrastructure sectors – including energy, finance and government affairs – are required to improve data security protection, creating large-scale application scenarios for data security technologies and facilitating the conversion of technological achievements into commercial value.

In terms of standardization, China is shifting from reliance on foreign standards toward establish its own independent framework centered on national cryptographic algorithms (SM algorithms). 

For instance, Fisherman Info, as a member of the National Cryptography Standardization Technical Committee, participates in formulating key standards such as Technical Requirements for Quantum Key Distribution Systems and Guidelines for Post-Quantum Cryptographic Algorithm Application. 

These standards integrate NIST-approved PQC algorithms (e.g., CRYSTALS-Kyber, CRYSTALS-Dilithium) with SM2/SM4 algorithms, forming a dual-algorithm system that supports smooth migration to post-quantum security and avoids industrial fragmentation.

The plan also promotes industry-academia-research collaboration by breaking down barriers between R&D, commercialization and application. It encourages joint R&D platforms and shared participation in standard-setting, ensuring technological innovations align with market needs and accelerating the industrialization of cutting-edge technologies like PQC.

Technological iteration: Commercial breakthroughs in data security for the quantum era

Quantum computing poses two major threats to traditional cryptography: algorithmic vulnerability and "harvest now, decrypt later" attacks. 

Traditional algorithms like RSA and ECDSA rely on mathematical problems solvable by quantum computers in hours, while even symmetric algorithms like AES/SM4 require doubled key lengths (burdening system performance) to resist quantum attacks. Malicious actors can also intercept and store encrypted data now to decrypt later when mature quantum computers are available – endangering critical data in energy, finance and government sectors.

To address these risks, PQC has evolved from a forward-looking layout to an industrial necessity, advancing through two core paths: post-quantum cryptography (PQC) with quantum-resistant mathematical foundations (e.g., lattice-based cryptography) and quantum key distribution (QKD), leveraging quantum physics principles for unconditionally secure key transmission. 

For instance, Fisherman Info adopts an integrated "PQC + QKD" technical route. The quantum cryptography machines it produces not only support the Crystals-Kyber algorithm but also obtain physically secure keys via QKD, forming a dual-protection system of "algorithmic security + physical security." This full-stack integrated solution provides an effective means to address the "cracking + retention" risks of traditional cryptography, making it a must-have option for upgrades across various industries.

PQC is seeing wide application across key sectors:

Energy: Quantum encryption modules integrated into power system devices ensure secure transmission of dispatch instructions and operational data. A major hydropower station uses dynamic key management to eliminate static key risks, with such solutions expected to cover over 80 percent of national energy bases in five years.

Government affairs: "National cryptography + zero trust + quantum encryption" solutions enable "data usable without being visible" in provincial government data platforms, facilitating cross-department collaboration (e.g., public security and civil affairs) while protecting privacy.

These "China solutions" offer three core advantages: independent and controllable technology (free from foreign dependencies), strong scenario adaptability (tailored to industry-specific needs like high real-time performance in energy), and cost-effectiveness (reduced deployment costs via fiber coexistence and non-intrusive upgrades), making them attractive to partners in Southeast Asia, the Middle East and other Belt and Road regions.

Industrial landscape: Commercial features and global competitiveness

China's data security industry benefits from a robust independent industrial foundation, encompassing self-developed hardware (e.g., Loongson/Phytium chips), operating systems (e.g., Kylin/UOS) and databases (e.g., Kingbase/Dameng) within the ITIA ecosystem. This shifts data security from an "add-on" to "native" capability, lowering application barriers.

The industry has also achieved a balance between compliance and commercial value through two business models: scenario-specific solutions integrating security with business operations, and Cryptography-as-a-Service (CaaS) subscriptions that make high-end cryptographic capabilities accessible to small and medium-sized enterprises (SMEs) at low costs.

Future outlook: Opportunities during the 15th Five-Year Plan period

The upcoming 15th Five-Year Plan will usher in a golden age for data security, driven by accelerated technological iteration, expanded market scale and improved policies. The primary opportunity lies in large-scale PQC replacement – the domestic market for upgrading critical information infrastructure is estimated to reach hundreds of billions of yuan. Policy improvements (e.g., classified data protection, cross-border data security assessments) and technological innovations (e.g., "quantum + AI," "privacy computing + blockchain") will further expand application boundaries.

Guided by the 15th Five-Year Plan, China's data security industry is experiencing unprecedented growth through policy support, technological breakthroughs and industrial upgrading. With the commercialization of PQC and improved data security systems, China is contributing "Chinese wisdom" to global digital security with its independent, scenario-adaptable and open cooperation-focused approach. 

As it advances toward self-reliance in science and technology, China is poised to become a global hub for data security innovation, fostering a safer and more inclusive digital economic ecosystem.

(Cover via VCG)