Meta-complete data storage

• US 20080082834A1
• Filed: 09/27/2007
• Published: 04/03/2008
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf
• Granted Patent: US 8,661,263 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

The invention described herein generally relates to systems and methods of securely storing data so that the data contains information about the data and/or the encryption of the data, systems and methods of providing secure access to real world data through data transformations, and systems and methods of managing security parameters for data.

Claims

1. A method for securely storing data comprising:

encrypting a clear-text datum;

storing the encrypted datum; and

storing metadata about the encrypted datum.

3. The method of claim 1, wherein the encrypted datum and the metadata are stored in the same element.

4. The method of claim 1, wherein the data is encrypted using an initialization vector and the metadata comprises the initialization vector.

5. The method of claim 1, the method further comprising:

computing an integrity value for the unencrypted datum, wherein the metadata comprises the integrity value.

6. The method of claim 5, wherein the integrity value comprises at least one selected from the group consisting of:

checksums, parity bits, check digits, redundancy checks, longitudinal redundancy checks, vertical redundancy checks, cyclic redundancy checks, hash functions, and cryptographic hash functions.

7. The method of claim 1, wherein the data is encrypted using an encryption key and the metadata comprises a key identifier for the encryption key.

8. The method of claim 1, wherein the metadata comprises recovery information.

2. The method of claim 2, wherein the combined length of the encrypted datum and the metadata being equal to or less than the length of the clear-text datum.

9. A method for providing selective access to a string of characters comprising:

encrypting a first subset of the string of characters; and

combining the first subset of characters with an unencrypted subset of the string of characters to produce a partially encrypted string.

10. The method of claim 9 further comprising:

encrypting a second subset of the string of characters; and

combining the second subset of the string of characters with the unencrypted subset of characters.

11. The method of claim 9 further comprising:

storing the partially encrypted string in a fully encrypted file.

12. The method of claim 9 further comprising:

storing the partially encrypted string in a fully encrypted database.

13. A method of secure, error-resistant data storage, the method comprising:

encrypting at least one datum using an initialization value;

storing a recovery value for the initialization value; and

storing an integrity value for one or more of the at least one datum.

14. The method of claim 13, wherein the recovery value and the integrity value are stored in a single data element.

15. The method of claim 13 further comprising:

storing a security policy for at least one datum.

16. The method of claim 13, wherein the integrity value comprises at least one selected from the group consisting of:

checksums, parity bits, check digits, redundancy checks, longitudinal redundancy checks, vertical redundancy checks, cyclic redundancy checks, hash functions, and cryptographic hash functions.

17. A data management user interface for a data field comprising:

a GUI element for selecting a data policy option for each character in the data field.

18. The interface of claim 17, wherein the GUI element is a radio button.

19. The interface of claim 17, wherein the GUI element is at least one selected from the group consisting of:

a button, a combo box, a combutcon, a context menu, a check box, a dialog box, a drop-down list, an icon, a list box, a menu, a pie menu, a slider, a spinner, a tab, a text box, and a widget.

20. The interface of claim 17, wherein the data policy option is at least one selected from the group consisting of:

clear text, masked text, data type preserving encryption, advanced encryption standard, and triple data encryption standard.

21. The interface of claim 18 further comprising:

a GUI element for designating one or more characters as an intialization value.

22. The interface of claim 17 further comprising:

a GUI element for designating one or more characters as a key ID.

23. A method of data storage comprising:

encrypting one or more characters of a datum;

storing the encrypted characters with one or more clear text characters of the datum;

searching on the clear text characters to produce a subset of records; and

searching on the encrypted characters of the subset of records.

24. The method of claim 23 wherein searching on the clear text comprises pattern matching.

25. The method of claim 23 wherein searching on the encrypted characters comprises decrypting the encrypted characters.