Systems and methods for distributing and securing data
First Claim
1. A method for securing data by generating a collection of fragments from the data, the method comprising:
- applying a sharing mechanism of a computational secret sharing scheme to the data to produce a collection of shares;
generating a random or pseudo-random value;
computing a set of committal values and a set of decommittal values from the random or pseudo-random value and the collection of shares;
producing each fragment in the collection of fragments by combining a share, a decommittal value, and at least one committal value of the set of committal values; and
storing each fragment on at least one data repository.
5 Assignments
0 Petitions
Accused Products
Abstract
A robust computational secret sharing scheme that provides for the efficient distribution and subsequent recovery of a private data is disclosed. A cryptographic key may be randomly generated and then shared using a secret sharing algorithm to generate a collection of key shares. The private data may be encrypted using the key, resulting in a ciphertext. The ciphertext may then be broken into ciphertext fragments using an Information Dispersal Algorithm. Each key share and a corresponding ciphertext fragment are provided as input to a committal method of a probabilistic commitment scheme, resulting in a committal value and a decommittal value. The share for the robust computational secret sharing scheme may be obtained by combining the key share, the ciphertext fragment, the decommittal value, and the vector of committal values.
-
Citations
20 Claims
-
1. A method for securing data by generating a collection of fragments from the data, the method comprising:
-
applying a sharing mechanism of a computational secret sharing scheme to the data to produce a collection of shares; generating a random or pseudo-random value; computing a set of committal values and a set of decommittal values from the random or pseudo-random value and the collection of shares; producing each fragment in the collection of fragments by combining a share, a decommittal value, and at least one committal value of the set of committal values; and storing each fragment on at least one data repository. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A method for securing data, the method comprising:
-
applying the sharing mechanism of a computational secret sharing scheme to the data to produce a collection of shares; using a probabilistic commitment scheme to compute a set of committal values and a set of decommittal values from the collection of shares; producing a plurality of fragments, wherein each fragment comprises a share of the collection of shares, a decommittal value of the set of decommittal values, and the set of committal values; and storing each fragment on at least one data repository. - View Dependent Claims (11, 12, 13, 14, 15, 16)
-
-
17. A method for securing data comprising:
-
generating a cryptographic key; encrypting the data with the cryptographic key to create a ciphertext; producing a collection of n key shares by applying a secret sharing scheme to the cryptographic key; producing a collection of n ciphertext chunks by applying an information dispersal algorithm to the ciphertext; computing n committal values and n decommittal values by applying a probabilistic commitment scheme to each of the n key shares and n ciphertext chunks; producing n data fragments, wherein each data fragment is a function of a key share, a ciphertext chunk, a decommittal value, and the committal values; and storing the n data fragments on different logical storage devices, whereby the data is recoverable from a predefined number of the data fragments. - View Dependent Claims (18, 19)
-
-
20. A method for recovering data from a collection of purported shares comprising:
-
receiving a designated purported share of the collection of purported shares, wherein the designated purported share is asserted to be valid; separating each purported share into a content portion and a vector of checksums; using the vector of checksums associated with the designated purported share to classify each share of the collection of purported shares as an actual share or as a bogus share; and applying the recovery algorithm of a computational secret sharing scheme to the shares classified as actual shares to recover the data.
-
Specification