# US 12,603,869 B2 · Privacy solution for images locally generated and stored in edge servers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,869 B2
- Document ID: US12603869B2
- Status: Granted
- Kind: B2
- Application number: 18/401,161
- Filed: 2023-12-29
- Published: 2025-07-03
- Granted: 2026-04-14
- Earliest claimed: 2023-12-29
- Assignees: Datalogic IP Tech S.R.L.
- Applicants: Datalogic IP Tech S.R.L.
- Inventors: Francesco D'Ercoli
- Web page: https://patentgrep.com/patent/US12603869B2

## CPC

- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0822: {using key encryption key}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method of securing data, such as images, may include receiving, by an edge server operating on a local area network (LAN) and communicatively coupled to a cloud-based server, encrypted data captured and/or generated by a first device operating on the LAN. The edge server may store the encrypted data in a data repository, the encrypted data being stored as encrypted data. Responsive to a second device operating on the LAN requesting the encrypted data, the edge server may communicate the encrypted data to the second device executing a customer application configured to decrypt and display the encrypted data.

## Claims

### Claim 1

A method of securing data, said method comprising:
receiving, by an edge server operating on a local area network (LAN) and communicatively coupled to a cloud-based server, encrypted data captured and/or generated by a first device operating on the LAN;
storing, by the edge server, the encrypted data in a data repository, the encrypted data being stored as encrypted data; and
responsive to a second device operating on the LAN requesting the encrypted data, communicating, by the edge server, the encrypted data to the second device executing a customer application configured to decrypt and display the encrypted data,
wherein receiving the encrypted data includes:
receiving a plain text source payload (Ps) defined by a ciphertext (X) concatenated with a cryptographic hash function (H) of the ciphertext (X) concatenated with a first private signature (s_dev) of the first device; and
wherein the ciphertext (X) is defined by an encryption of the data (IMG) concatenated with a private edge signature (s_edg) of the edge server using a private symmetric encryption key (k_app) of the customer application.

### Claim 2 (depends on 1)

The method according to claim 1, further comprising:
receiving, by the edge server, a secure communication request from the second device; and
in response to receiving the secure communication request, requesting, by the edge server, the secure communication request to the first device to enable the private symmetric encryption key (k_app) to be communicated from the second device to the first device via the edge server.

### Claim 3 (depends on 2)

The method according to claim 2, further comprising generating, by the customer application, the private symmetric encryption key (k_app) by using a public asymmetric encryption key of the first device.

### Claim 4 (depends on 2)

The method according to claim 2, further comprising:
generating, by the edge server, the private edge signature (s_edg); and
communicating, by the edge server, the private edge signature (s_edg) to the first and second devices, thereby availing the first device and the customer application of the private edge signature (s_edg).

### Claim 5 (depends on 4)

The method according to claim 4, further comprising:
receiving, by the edge server, the first private signature (s_dev) of the first device; and
storing, by the edge server, the first private signature (s_dev) of the first device.

### Claim 6 (depends on 5)

The method according to claim 5, further comprising generating, by the first device, the first private signature (s_dev).

### Claim 7 (depends on 5)

The method according to claim 5, further comprising:
receiving, by the edge server, a second private signature of the customer application; and
storing, by the edge server, the second private signature of the customer application.

### Claim 8 (depends on 7)

The method according to claim 7, further comprising generating, by the customer application, the second private signature.

### Claim 9 (depends on 1)

The method according to claim 1, wherein communicating the encrypted data includes:
communicating a plain text received payload (Pr) defined by the ciphertext (X) concatenated with a cryptographic hash function (H) of the ciphertext (X) concatenated with the second private signature (s_app) of the customer application; and
wherein the ciphertext (X) is defined by an encryption of the data (IMG) concatenated with the private edge signature (s_edg) of the edge server using the private symmetric encryption key (k_app) of the customer application.

### Claim 10 (depends on 1)

The method according to claim 1, wherein storing the encrypted data by the edge server includes storing the encrypted data in a manner in which the edge server is unable to decrypt the encrypted data, and wherein the encrypted data is an encrypted image.

### Claim 11

A system for securing data, said system comprising:
an edge server operating on a local area network (LAN) and communicatively coupled to a cloud-based server, the edge server including at least one processor and storage device configured to store encrypted data, the at least one processor configured to execute software instructions that, when executed, cause the at least one processor to:
receive encrypted data captured and/or generated by a first device operating on the LAN;
store the encrypted data in a data repository being stored by the storage device, the encrypted data being stored in an encrypted data format; and
responsive to receiving a request for the encrypted data from a second device operating on the LAN, communicate the encrypted data to the second device executing a customer application configured to decrypt and display the encrypted data; and
in receiving the encrypted data, the at least one processor is further configured to:
receive a plain text source payload (Ps) defined by a ciphertext (X) concatenated with a cryptographic hash function (H) of the ciphertext (X) concatenated with a first private signature (s_dev) of the first device; and
wherein the ciphertext (X) is defined by an encryption of the data (IMG) concatenated with the private edge signature (s_edg) of the edge server using the private symmetric encryption key (k_app) of the customer application.

### Claim 12 (depends on 11)

The system according to claim 11, wherein the at least one processor is further configured to:
receive a secure communication request from the second device; and
request, in response to receiving the secure communication request, the secure communication request to the first device to enable a private symmetric encryption key to be communicated from the first device to the second device.

### Claim 13 (depends on 12)

The system according to claim 12, wherein the at least one processor is further configured to:
generate the private edge signature (s_edg); and
communicate the private edge signature (s_edg) to the first and second devices, thereby availing the first device and the customer application of the private edge signature (s_edg).

### Claim 14 (depends on 13)

The system according to claim 13, wherein the at least one processor is further configured to:
receive the first private signature (s_dev) of the first device; and
store the first private signature (s_dev) of the first device.

### Claim 15 (depends on 14)

The system according to claim 14, wherein the first device is configured to generate the first private signature (s_dev).

### Claim 16 (depends on 14)

The system according to claim 14, wherein the at least one processor is further configured to:
receive a second private signature of the customer application; and
store the second private signature of the customer application.

### Claim 17 (depends on 16)

The system according to claim 16, wherein the customer application is configured to generate the second private signature.

### Claim 18 (depends on 11)

The system according to claim 11, wherein the at least one processor, in communicating the encrypted data, is further configured to:
communicate a plain text received payload (Pr) defined by the ciphertext (X) concatenated with a cryptographic hash function (H) of the ciphertext (X) concatenated with the second private signature (s_app) of the customer application; and
wherein the ciphertext (X) is defined by an encryption of the data (IMG) concatenated with the private edge signature (s_edg) of the edge server using the private symmetric encryption key (k_app) of the customer application.