Key Terminal Storage Access Without Private Key Exposure

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing network storage systems face challenges in managing private keys securely, as they often require transmission and management across various terminals, exposing them to potential unauthorized access.

Innovation Solution

A storage system comprising an upload terminal, download terminal, storage server, and key terminal, where the key terminal secretly records the primary private key, enabling secure management and processing of encrypted files without transmitting the private key to other terminals.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If the private key is transmitted to other terminals for encryption and decryption operations, then the processing capability is improved, but the security of the private key deteriorates

Engineering Contradiction:

Improveprocessing capabilityVSAvoidsecurity of private key

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The private key is extracted from the networked terminals (upload terminal and download terminal) and isolated in a dedicated key terminal that is not connected to the network. This separation allows encryption and decryption operations to be performed remotely while the private key remains securely stored in the isolated key terminal, thus maintaining both processing capability and security.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The key terminal acts as an intermediary between the upload terminal and download terminal. It receives requests for encryption and decryption operations, processes them using the stored private key, and returns results without allowing direct access to the private key. This intermediary role enables secure key management while maintaining system functionality.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If the private key is stored in a dedicated key terminal separately from other terminals, then the security of the private key is improved, but the system complexity increases

Engineering Contradiction:

Improvesecurity of private keyVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The key terminal is designed to perform multiple functions: storing the private key, receiving encryption requests from the upload terminal, receiving decryption requests from the download terminal, and returning processed results. This multi-functionality consolidates what could be separate components into a single versatile device, reducing overall system complexity while maintaining security.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Reliability

If the private key is never transmitted to the network, then the security is improved, but the ability to perform encryption and decryption operations deteriorates

Engineering Contradiction:

Improvesecurity of private keyVSAvoidability to perform encryption and decryption

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The physical transmission of the private key over the network is replaced with cryptographic protocols. The upload terminal and download terminal communicate with the key terminal through standardized encryption and decryption protocols, allowing operations to be performed on encrypted data without exposing the private key itself. This substitution maintains security while enabling operational capability.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20260031985A1Network storage for processing cryptographic files while keeping private key secret in key terminal

Publication Date: 2026.01.29 PASSLOGY CO LTD

AI summary

In a storage system (101), a key terminal (141) secretly records a primary private key included together with a primary public key in a primary key pair. An upload terminal (111) encrypts an object file into an encrypted file with a generated common key, encrypts the common key into a first cipher with the primary public key, and stores the encrypted file and the first cipher in a storage server (131). A download terminal (121) generates a temporary key pair including a temporary public key and a temporary private key, secretly records the temporary private key, transmits the temporary public key to the key terminal (141), and signs in to the storage server (131). Then, the key terminal (141) and the storage server (131) in cooperation with each other generate a second cipher acquired by encrypting the common key with the temporary public key while the common key is kept secret from the storage server (131), and transmit the second cipher to the download terminal (121). The download terminal (121) decrypts the shared key from the second cipher with the temporary private key, and decrypts, with the common key, the object file from the encrypted file acquired from the storage server (131).