Secure Archive Storage Using One-Way Link Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In computer networks handling sensitive data, existing systems lack secure mechanisms to prevent unauthorized access and malicious code introduction during data archiving, as they rely on centralized storage with potential vulnerabilities in data transmission and storage.

Innovation Solution

A secure storage system is implemented where data from computers is encrypted by an encryption processor using an unshared key and transmitted over a one-way link to a memory, with a monitoring processor connected via another one-way link to monitor and report on storage status without receiving commands from computers, ensuring only encrypted data is written and stored, and decrypted in a controlled environment to neutralize malicious code.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If centralized storage is used for archiving data, then data accessibility and storage capacity are improved, but security vulnerabilities and unauthorized access risks increase

Engineering Contradiction:

Improvedata accessibilityVSAvoidunauthorized access and malicious code introduction

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system segments the storage architecture into distributed storage nodes with independent encryption processors, eliminating centralized storage vulnerability. Each storage node operates autonomously with its own encryption key, allowing data to be stored securely across multiple locations while preventing single point of failure and unauthorized access.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An encryption processor acts as an intermediary between data sources and storage memory. This intermediary encrypts all data before storage and decrypts only in controlled environments, preventing unauthorized access while maintaining data accessibility. The encryption processor serves as a security gateway that mediates between network computers and storage systems.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If data is transmitted over network links, then data communication capability is improved, but risk of malicious code introduction and data breaches increases

Engineering Contradiction:

Improvedata communication capabilityVSAvoidmalicious code introduction

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The system extracts the encryption function from the network transmission layer and implements it at the storage layer. Encryption occurs locally at each storage node before data is written to memory, separating the encryption process from network communication. This allows data to be transmitted over networks without exposing encryption keys or creating vulnerabilities in the transmission path.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system converts the potential harm of network transmission vulnerabilities into a benefit by implementing encryption at the storage layer. Malicious code introduced over networks is encrypted during storage, transforming the attack vector from network transmission to storage access, which is then prevented by the encryption mechanism and one-way link architecture.

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

3Object-affected harmful factors

If one-way link is used for data transmission, then data security is improved, but system complexity and configuration difficulty increases

Engineering Contradiction:

Improvedata securityVSAvoidsystem complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The encryption processor serves multiple functions: it encrypts data for storage, decrypts data in controlled environments, and manages encryption keys. This multi-functionality consolidates security operations into a single device, reducing overall system complexity while maintaining strong security through the one-way link architecture.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system implements self-service security mechanisms where encryption processors automatically encrypt data upon storage and decryption occurs only in predetermined controlled environments. The one-way link architecture provides automatic directionality without requiring complex authentication or permission management, simplifying the system while maintaining security.

Inventive Principle:

Principle #25Self-service

4Object-affected harmful factors

If encryption processor is used to encrypt data before storage, then data integrity and security are improved, but processing time and system performance overhead increases

Engineering Contradiction:

Improvedata integrityVSAvoidprocessing time

Core Design Contradiction:

Object-affected harmful factorsVSLoss of time

Solution Approach 1:

The encryption processor performs encryption as a preliminary action immediately before data is written to storage memory. This ensures data is encrypted at the point of entry, preventing any subsequent unauthorized access or modification. The preliminary encryption occurs in parallel with data preparation, minimizing impact on overall system performance.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentEP2104892B1Secure archive

Publication Date: 2019.08.07 WATERFALL SECURITY SOLUTIONS LTD

Figure 1

AI summary

Storage apparatus (20) includes a memory (30) and an encryption processor (28), which is configured to receive and encrypt data transmitted from one or more computers (24) for storage in the memory. A one-way link (32) couples the encryption processor to the memory so as to enable the encryption processor to write the encrypted data to the memory but not to read from the memory.