Encryption Key Management for Information Processing Apparatus

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional information processing apparatuses face security and availability issues when the encryption key stored outside the apparatus is not accessible, as they lack sufficient measures to securely acquire the key in such scenarios.

Innovation Solution

An information processing apparatus with a first storage memory, a second storage memory for the encryption key, and a communicator that connects to a server device to acquire the encryption key, either by decrypting using the server-provided key or requesting authentication to access the local backup key when the server key is unavailable.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the encryption key is stored in a non-secure storage device outside the apparatus for easy access, then the availability of decryption is improved, but the security of the encryption key is worsened when the apparatus is stolen

Engineering Contradiction:

Improveavailability of decryptionVSAvoidsecurity risk when apparatus is stolen

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The encryption key management is segmented into multiple components: a secure memory inside the apparatus storing a first encryption key, and a non-secure storage device outside the apparatus storing a second encryption key. This segmentation allows the system to balance security and availability by using different storage locations with different security levels for different purposes.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A backup key acquisition unit is introduced as an intermediary mechanism that mediates between the secure memory and the non-secure storage device. This unit can acquire the first encryption key from secure memory and store it in the non-secure storage device as a backup, enabling key recovery while maintaining security through controlled access procedures.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Object-affected harmful factors

If the encryption key is stored only inside the apparatus in secure memory, then the security of the encryption key is improved, but the availability of decryption is worsened when the first encryption key is not usable

Engineering Contradiction:

Improvesecurity of encryption keyVSAvoidavailability of decryption

Core Design Contradiction:

Object-affected harmful factorsVSReliability

Solution Approach 1:

The system performs preliminary action by creating a backup of the first encryption key from secure memory to the non-secure storage device before the key is potentially needed for recovery. This backup process ensures that if the first encryption key becomes unusable, decryption can still be performed using the backup key, thus improving availability while maintaining security through the controlled backup acquisition process.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system provides beforehand cushioning by preparing a backup encryption key in advance and establishing a key recovery mechanism. This cushioning measure ensures that if the primary encryption key in secure memory becomes unavailable or unusable, the system can still decrypt data using the backup key, thereby cushioning against potential failures and maintaining operational reliability.

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

3Object-affected harmful factors

If password input is required to use the backup key, then the security of the encryption key is improved, but the ease of operation is worsened

Engineering Contradiction:

Improvesecurity of backup key usageVSAvoidconvenience of key access

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The system applies preliminary anti-action by requiring password input as a protective measure before allowing access to the backup encryption key. This password requirement acts as a preliminary countermeasure against unauthorized access, ensuring that even though the backup key is stored in a non-secure location, its usage remains protected. The password barrier prevents malicious use while allowing legitimate users to access the backup key when needed.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS12192350B2Information processing apparatus and control method

Publication Date: 2025.01.07 SHARP KK

AI summary

An information processing apparatus includes: a first storage memory that stores data; a second storage memory that stores an encryption key; a controller that encrypts the first storage memory with the encryption key; and a communicator that communicates with a server device that stores the encryption key, wherein when the encryption key is acquirable from the server device via the communicator, the controller uses the encryption key acquired from the server device to decrypt the first storage memory, and when the encryption key is not acquirable from the server device via the communicator, the controller requests authentication and, after the authentication is performed, acquires the encryption key from the second storage memory and decrypts the first storage memory.