Encryption Key Backup via Nested Key Storage

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing data encryption methods face challenges in securely managing and backing up encryption keys, leading to potential loss or unauthorized access, especially when hardware components fail or are replaced.

Innovation Solution

An information processing apparatus with a storage unit and an encryption processing unit, where a first key for decrypting data is encrypted using a second key set in the encryption processing unit, allowing secure backup and restoration while maintaining robust security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the encryption key is stored inside the encryption processing unit to prevent extraction, then security is improved, but the key cannot be backed up and will be lost if the hardware fails

Engineering Contradiction:

ImprovesecurityVSAvoidbackup capability

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The encryption key is extracted from the encryption processing unit and stored in a separate storage device. This allows the key to be backed up independently of the encryption hardware while maintaining security through controlled access mechanisms.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

A key management system acts as an intermediary between the encryption processing unit and the storage device. This mediator controls key access, enabling secure backup and restoration operations without exposing the key to unauthorized extraction.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If the encryption key is backed up in a usable state, then backup capability is improved, but security deteriorates if the key is leaked

Engineering Contradiction:

Improvebackup capabilityVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary security measures by encrypting the backup key with a master key before storage. This pre-protection ensures that even if the backup is compromised, the actual encryption key remains secure due to the additional encryption layer.

Inventive Principle:

Principle #9Preliminary anti-action

Solution Approach 2:

The key is transformed from a usable plaintext state to an encrypted protected state before backup. This parameter change in the key's form (from plaintext to ciphertext) maintains security while enabling backup functionality.

Inventive Principle:

Principle #35Parameter changes

3Reliability

If the encryption processing unit is replaced due to hardware failure, then device reliability is improved, but the encryption key is lost

Engineering Contradiction:

Improvedevice reliabilityVSAvoidencryption key

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The encryption key is backed up in advance to a separate storage device before any hardware failure occurs. This preliminary action ensures that the key is preserved and can be restored to a replacement encryption processing unit, preventing data loss.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

A backup copy of the encryption key is created and stored securely beforehand, acting as a cushion or safety net. This ensures that if the primary hardware fails, the key information is protected and can be recovered to maintain system functionality.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

Data Source

PatentUS10038556B2Information processing apparatus, encryption apparatus, and control method

Publication Date: 2018.07.31 CANON KK

AI summary

An information processing apparatus includes a storage unit, an encryption processing unit that encrypts data to be stored in the storage unit, and a control unit that stores a first key in a unit different from the encryption processing unit, wherein the first key, which is used to decrypt data encrypted by the encryption processing unit and stored in the storage unit, is encrypted using a second key set in the encryption processing unit.