Secure high speed data storage, access, recovery, and transmission

• US 10,657,284 B2
• Filed: 05/21/2018
• Issued: 05/19/2020
• Est. Priority Date: 09/23/2014
• Status: Active Grant

• Current Assignee: UBIQ Security Incorporated
• Original Assignee: UBIQ Security Incorporated
• Inventors: Eigner, Linda, Eigner, William, Iasi, Anthony, Kahle, Charles, Schneir, Gary, Tobias, Eric
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Farooqui, Quazi
• Application Number:
  US15/984,688
• Publication Number:
  US 20180276407A1
• Time in Patent Office: 729 Days
• Field of Search: 713168, 713193, 726 9, 726 10, 709217, 709236
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Systems and methods for retrieving a data object. An example method includes: receiving a query comprising a field identifier and a field value related to the field identifier; determining the field identifier corresponds to an entry of a data map, the data map comprising a plurality of entries generated in part based on a plurality of field identifiers; in response to the determination, obfuscating at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator; identifying one or more encrypted values within the data map based on the record locator, wherein the one or more encrypted values is associated with the entry having an corresponding record locator that matches the generated record locator; and decrypting and forwarding the one or more encrypted values as a response to the query.

Claims

1. A method for retrieving a data object, the method comprising:

receiving a query comprising a field identifier and a field value related to the field identifier;

determining the field identifier corresponds to an entry of a data map, the data map comprising a plurality of entries generated in part based on a plurality of field identifiers;

in response to the determination, obfuscating at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator;

identifying one or more encrypted values within the data map based on the record locator, wherein the one or more encrypted values is associated with the entry having an corresponding record locator that matches the generated record locator; and

decrypting and forwarding the one or more encrypted values as a response to the query.

2. The method of claim 1, further comprising, if the field identifier does not correspond to any of the plurality of entries, performing a reverse decomposition of the data object, wherein the data object is previously stored using a decomposition function based in part on one or more variable storage parameters.

3. The method of claim 2, wherein the one or more variable storage parameters includes at least one of a username, a user passphrase, a current security model, a type of the data object, a size of the data object, one or more security requirements, and one or more performance requirements.

4. The method of claim 2, wherein the data object is stored using a decomposed function based, in part, on one or more variable storage parameters including at least a type of the data object.

5. The method of claim 2, wherein performing reverse decomposition of the data object determines a field value corresponding to the field identifier, wherein a new entry for the data map is generated based, in part, on the field identifier and field value.

6. The method of claim 5, wherein a record locator corresponding to the new entry is generated by obfuscating at least the field identifier.

7. The method of claim 1, wherein the data object is previously stored, in a plurality of storage locations, using a decomposed function based in part on one or more variable storage parameters, and wherein the data map is stored in a storage location separate from the plurality of storage locations.

8. The method of claim 7, wherein identifying one or more encrypted values within the data map comprises locating the data object stored in the plurality of storage locations.

9. The method of claim 1, wherein the query comprises a single field value and corresponding field identifier.

10. The method of claim 9, wherein obfuscating at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator comprises applying an obfuscation function to the field identifier based, in part, on the corresponding field value.

11. The method of claim 10, wherein the existing record locator matches the record locater of the obfuscated field identifier that is obfuscated based, in part, on the field value.

12. The method of claim 9, wherein the decrypted and forwarded one or more encrypted values comprises a single value responsive to the query.

13. The method of claim 1, wherein the query comprises a range of field values, wherein the field identifier corresponds to the range of field values.

14. The method of claim 13, wherein obfuscating at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator comprises applying an obfuscation function to the field identifier based, in part, on the corresponding field value.

15. The method of claim 14, wherein the existing record locator was generated based on applying an obfuscation function to a field identifier of the entry independent of a field value of the entry.

16. The method of claim 14, wherein the identified one or more encrypted values comprise a range of field values corresponding to the existing record locator.

17. A system for retrieving a data object, the system comprising:

a plurality of data storage locations;

a secure platform comprising one or more processors coupled to at least one memory, the secure platform configured to;

receive a query comprising a field identifier and a field value related to the field identifier;

determine the field identifier corresponds to an entry of a data map, the data map comprising a plurality of entries generated in part based on a plurality of field identifiers;

in response to the determination, obfuscate at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator;

identify one or more encrypted values within the data map based on the record locator, wherein the one or more encrypted values is associated with the entry having an existing record locator that matches the record locator; and

decrypt and forwarding the one or more encrypted values as a response to the query.

18. The system of claim 17, further comprising, if the field identifier does not correspond to any of the plurality of entries, performing a reverse decomposition of the data object, wherein the data object is previously stored using a decomposition function based in part on one or more variable storage parameters.

19. The system of claim 18, wherein the data object is stored using a decomposed function based, in part, on one or more variable storage parameters including at least a type of the data object.

20. The system of claim 18, wherein performing reverse decomposition of the data object determines a field value corresponding to the field identifier, wherein a new entry for the data map is generated based, in part, on the field identifier and field value.

21. The system of claim 18, wherein the data object is previously stored, in a plurality of storage locations, using a decomposed function based in part on one or more variable storage parameters, and wherein the data map is stored in a storage location separate from the plurality of storage locations.

22. The system of claim 18, wherein the query comprises a single field value and corresponding field identifier, and wherein the decrypted and forwarded one or more encrypted values comprises a single value responsive to the query.

23. The system of claim 22, wherein obfuscating at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator comprises applying an obfuscation function to the field identifier based, in part, on the corresponding field value.

24. The system of claim 18, wherein the query comprises a range of field values, wherein the field identifier corresponds to the range of field values, and wherein the identified one or more encrypted values comprise a range of field values corresponding to the existing record locator.

25. The method of claim 24, wherein obfuscating at least one of the field identifier, field value, and both the field identifier and the field value to generate a record locator comprises applying an obfuscation function to the field identifier based, in part, on the corresponding field value.