Systems and methods for securing data in motion

• US 10,068,103 B2
• Filed: 04/19/2013
• Issued: 09/04/2018
• Est. Priority Date: 03/31/2010
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L.
• Primary Examiner(s): Desrosiers, Evans
• Application Number:
  US13/866,452
• Publication Number:
  US 20130246807A1
• Time in Patent Office: 1,964 Days
• Field of Search: 713160, 713168-174, 713182-186, 713202, 709206, 709225, 709229, 709249, 709389, 726 2- 8
• CPC Class Codes: G06F 11/1076 Parity data used in redundant arrays of independent storages, e.g. in RAID systems
• CPC Class Codes: G06F 11/182 based on mutual exchange of the output between redundant processing components
• CPC Class Codes: G06F 11/2094 Redundant storage or storage space G06F11/2056 takes precedence
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

The systems and methods of the present invention provide a solution that makes data provably secure and accessible—addressing data security at the bit level—thereby eliminating the need for multiple perimeter hardware and software technologies. Data security is incorporated or weaved directly into the data at the bit level. The systems and methods of the present invention enable enterprise communities of interest to leverage a common enterprise infrastructure. Because security is already woven into the data, this common infrastructure can be used without compromising data security and access control. In some applications, data is authenticated, encrypted, and parsed or split into multiple shares prior to being sent to multiple locations, e.g., a private or public cloud. The data is hidden while in transit to the storage location, and is inaccessible to users who do not have the correct credentials for access.

Claims

1. A method for securing the filename of a file to be split and stored on a storage network, the method comprising:

encrypting, by processing circuitry communicatively coupled to the storage network, the filename of the file using an encryption algorithm;

generating one or more data shares from the file using an information dispersal algorithm, at least one of the one or more data shares having a share name that is associated with the encrypted filename;

storing the generated data shares on one or more data share locations in the storage network; and

regenerating the filename of the file by decrypting the share name of one of the generated data shares.

2. The method of claim 1, wherein the storage network includes one of a private cloud, a public cloud, a hybrid cloud, a removable storage device, and a mass storage device.

3. The method of claim 1, wherein the encryption algorithm is an AES algorithm.

4. The method of claim 1, further comprising appending additional information to the filename of the file prior to the encrypting.

5. The method of claim 4, wherein the additional information includes a number associated with a data share location.

6. The method of claim 1, wherein each of the one or more data shares has a share name which contains at least a portion of the filename of the file.

7. The method of claim 1, further comprising processing the encrypted filename using an authentication algorithm to generate an authentication value.

8. The method of claim 7, wherein the authentication algorithm is an HMAC-SHA256 algorithm.

9. The method of claim 7, further comprising generating share names for the one or more data shares based on the authentication value.

10. The method of claim 9, wherein the authentication value and the generated share names for the one or more data shares are substantially equal.

11. A system for securing the filename of a file to be split and stored on a storage network, the system comprising:

at least one non-transitory computer readable medium storing computer executable instructions; and

processing circuitry communicatively coupled to the at least one non-transitory computer readable medium and operable to execute the computer-readable instructions stored thereon, the processing circuitry configured to;

encrypt the filename of the file using an encryption algorithm;

generate one or more data shares from the file using an information dispersal algorithm, at least one of the one or more data shares having a share name that is associated with the encrypted filename;

store the generated data shares on one or more data share locations in the storage network; and

regenerate the filename of the file by decrypting the share name of one of the generated data shares.

12. The system of claim 11, wherein the storage network includes one of a private cloud, a public cloud, a hybrid cloud, a removable storage device, and a mass storage device.

13. The system of claim 11, wherein the encryption algorithm is an AES algorithm.

14. The system of claim 11, wherein the processing circuitry is further configured to append additional information to the filename of the file prior to the encrypting.

15. The system of claim 14, wherein the additional information includes a number associated with a data share location.

16. The system of claim 11, wherein each of the one or more data shares has a share name which contains at least a portion of the filename of the file.

17. The system of claim 11, wherein the processing circuitry is further configured to process the encrypted filename using an authentication algorithm to generate an authentication value.

18. The system of claim 17, wherein the authentication algorithm is an HMAC-SHA256 algorithm.

19. The system of claim 17, wherein the processing circuitry is further configured to generate share names for the one or more data shares based on the authentication value.

20. The system of claim 19, wherein the authentication value and the generated share names for the one or more data shares are substantially equal.