Secure data parser method and system

• US 20080244277A1
• Filed: 04/18/2008
• Published: 10/02/2008
• Est. Priority Date: 09/20/1999
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: VanZandt, John, Orsini, Rick L., Davenport, Roger S., O'Hare, Mark S.
• Granted Patent: US 9,449,180 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/68 : Special signature format, e.g. XML format
• CPC Class Codes: H04L 2209/805 : Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present invention provides a method and system for securing sensitive data from unauthorized access or use. The method and system of the present invention is useful in a wide variety of settings, including commercial settings generally available to the public which may be extremely large or small with respect to the number of users. The method and system of the present invention is also useful in a more private setting, such as with a corporation or governmental agency, as well as between corporation, governmental agencies or any other entity.

Claims

1. A method for securing data, comprising:

a) encrypting a data set to provide an encrypted data set;

b) generating two or more portions of data from the encrypted data set, wherein the two or more portions of data each contain a substantially randomized distribution of the encrypted data set;

c) encrypting one or more of the portions of data from step

b); and

d) storing the two or more portions of data from step c) at one or more locations on one or more data depositories, whereby the data set is restorable from at least two of the two or more portions of data from step b), wherein restoring the data set comprises;

decrypting the one or more portions of data from step c),

reconstituting the encrypted data set by recombining data from the at least two of the two or more portions of data that was substantially randomly distributed in step b), and

decrypting the encrypted data set into the data set.

2. The method of claim 1, wherein generating two or more portions of data from the encrypted data set comprises generating at least four portions of data.

3. The method of claim 1, wherein step b) and step c) are repeated one or more times before the storing of step d), and wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm in step a).

4. The method of claim 1, wherein storing the two or more portions of data comprises storing the two or more portions of data on different locations of the same data depository.

5. The method of claim 1, wherein storing the two or more portions of data comprises storing the two or more portions of data on different data depositories.

6. The method of claim 1, wherein storing the two or more portions of data comprises storing the two or more portions of data on different data depositories in different geographic locations.

7. The method of claim 1, wherein the encryption of step c) provides an encryption key, and wherein the encryption key is stored in step d) together with the data encrypted using said encryption key in step c).

8. The method of claim 1, wherein the encryption of step c) provides an encryption key, and wherein the encryption key is stored in step d) separately from the data encrypted using said encryption key in step c).

9. The method of claim 1, wherein the data set of step a) comprises data selected from the group consisting of encryption key data, text, video, audio, images, biometrics, and digital data.

10. A method for securing data, comprising:

a) generating two or more portions of data from a data set, wherein the two or more portions of data each contain a substantially random distribution of the data set;

b) encrypting one or more of the portions of data of step a); and

c) storing the two or more portions of data on one or more locations on one or more data depositories, whereby the data set is restorable from at least two of the two or more portions of data, wherein restoring the data set comprises;

decrypting the one or more portions of data from step b), and

reconstituting the data set by recombining data from the at least two of the two or more portions of data that was substantially randomly distributed in step a).

11. The method of claim 10, wherein generating two or more portions of data from the data set comprises generating at least four portions of data.

12. The method of claim 10, wherein step a) and step b) are repeated one or more times before the storing of step c), and wherein the encryption of step b) is repeated using a different encryption algorithm.

13. The method of claim 10, wherein storing the two or more portions of data comprises storing the two or more portions of data on different locations of the same data depository.

14. The method of claim 10, wherein storing the two or more portions of data comprises storing the two or more portions of data on different data depositories.

15. The method of claim 10, wherein storing the two or more portions of data comprises storing the two or more portions of data on different data depositories in different geographic locations.

16. The method of claim 10, wherein the encryption of step b) provides an encryption key, and wherein the encryption key is stored in step c) together with the data encrypted using said encryption key in step b).

17. The method of claim 10, wherein the encryption of step b) provides an encryption key, and wherein the encryption key is stored in step c) separately from the data encrypted using said encryption key in step b).

18. The method of claim 10, wherein the data set of step a) comprises data selected from a group consisting of encryption key data, text, video, audio, images, biometrics, and digital data.

19. The method of claim 10, wherein the encryption of step b) is performed using an encryption algorithm selected from a group consisting of RS1, RC4™

, and OTP.

20. A method for securing data, comprising:

a) generating an encryption master key and encrypting a data set using the encryption master key;

b) generating two or more portions of data from the encrypted data set and the encryption master key according to one separating pattern and appending an encryption master key portion to an encrypted data set portion, wherein the two or more portions comprise a substantially random distribution of data from the encrypted data set;

c) generating one or more encryption keys for the portions of data from step b) and encrypting said portions of data using said one or more encryption keys; and

d) storing the encrypted portions of data from step c) and the encryption keys from step c) on at least one data depository, whereby the data set is restorable from at least two portions of the two or more portions of data, wherein restoring the data set comprises;

decrypting the encrypted portions of data,

reconstituting the encrypted data set by recombining data from the at least two portions of the two or more portions of data that was substantially randomly distributed in step b), and

decrypting the encrypted data set into the data set.

21. A method for securing data, comprising:

a) generating an encryption master key and encrypting a data set using the encryption master key;

b) generating two or more portions of data from the encrypted data set and the encryption master key according to one separating pattern and storing encryption master key portions on one or more locations of one or more data depositories, wherein the two or more portions comprise a substantially random distribution of data from the encrypted data set;

c) generating one or more encryption keys for the encrypted data set portions of step b) and encrypting said portions of data using said encryption key; and

d) storing the encrypted portions from step c) and the encryption keys from step c) on at least one location of at least one data depository, wherein said data depositories are different from the data depositories of step b), whereby the data set is restorable from at least two portions of the two or more portions of data, wherein restoring the data set comprises;

decrypting the encrypted portions from step c),

reconstituting the encrypted data set by recombining data from the at least two portions of the two or more portions of data that was substantially randomly distributed in step b), and

decrypting the encrypted data set into the data set.

22. The method of claim 21, wherein the storing of encrypted data portions in step d) is on two or more different locations of one data depository.

23. The method of claim 21, wherein the storing of encrypted data portions in step d) is on two or more data depositories.

24. The method of claim 21, wherein the storing of the encryption keys in step d) is on two or more different locations of one data depository.

25. The method of claim 21, wherein the storing of the encryption keys of step d) is on two or more different data depositories.

26. The method of claim 21, wherein the encryption keys generated in step c) and used to encrypt a data set in step c) is stored according to step d) with the encrypted data set that was encrypted using the encryption key on one or more data depositories.

27. The method of claim 21, wherein the encryption key generated in step c) and used to encrypt a data set in step c) is stored according to step d) in a different location on one or more data depositories from the encrypted data set that was encrypted using the encryption key.

28. The method of claim 21, wherein the encrypted data of step b) is separated into four or more portions.

29. The method of claim 21, wherein the encryption master key of step b) is separated into four or more portions.

30. The method of claim 21, wherein step b) and step c) are repeated one or more times, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

31. A system for securing data, comprising:

a) a data apportioning module for apportioning data from a data set into at least two data portions, wherein the data is apportioned into the at least two data portions in a substantially random way;

b) a cryptographic handling module for encrypting the data set; and

c) a data assembling module for assembling the data set from the at least two data portions, wherein the data assembling module is configured to;

reconstitute the encrypted data set by recombining data from the at least two data portions that was substantially randomly apportioned,

decrypt the encrypted data set into the data set, and

store the decrypted data set.

32. The system of claim 31, wherein said cryptographic handling module encrypts the at least two data portions.

33. A method for securing data, comprising:

a) encrypting a data set to provide an encrypted data set;

b) generating two or more portions of data from the encrypted data set according to the contents of a unique key value, wherein the encrypted data set is substantially randomly distributed among the two or more portions of data;

c) encrypting one or more of the portions of data from step b); and

d) storing the encrypted portions of data from step c) at one or more locations on one or more data depositories, whereby the data set is restorable from at least a subset of the portions of data, wherein restoring the data set comprises;

decrypting the one or more portions of data from step c),

reconstituting the encrypted data set by recombining data from the at least two of the two or more portions of data that was substantially randomly distributed in step b), and

decrypting the encrypted data set into the data set.

34. The method of claim 33, wherein the generating of step b) generates four or more portions of data according to the contents of a unique key value.

35. The method of claim 33, wherein said portions of data comprise one or more bits of data.

36. A method for securing data, comprising:

a) splitting a data set into N number of data units;

b) selecting X number of shares for data unit storage;

c) generating N number of substantially random numbers that correspond to the X number of shares;

d) assigning the random numbers to the data units; and

e) storing, using electronic storage, the data units and the random number in the share that corresponds to the random number, whereby the data set is restorable from at least a subset of the X number of shares, wherein restoring the data set comprises reconstituting the data set by recombining the data units from the at least a subset of the X number of shares according to the substantially random numbers.

37. The method of claim 36, wherein said data units comprise at least one bit.

38. A method for securing a data set, comprising:

generating at least two portions of data from the data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the data set; and

storing the at least two portions of data in at least one location on at least one data depository, whereby the data set is restorable from at least two portions of the at least two portions of data by recombining data from the at least two portions of the at least two portions of data that was substantially randomly distributed.

39. The method of claim 38 wherein generating the at least two portions of data comprises generating the at least two portions of data from the data set, wherein the at least two portions of data each contain a substantially randomized distribution of bits of data from the data set.

40. The method of claim 38 wherein generating the at least two portions of data comprises generating the at least two portions of data from the data set, wherein the at least two portions of data each contain a substantially randomized distribution of bytes of data from the data set.

41. The method of claim 38 wherein generating the at least two portions of data comprises generating the at least two portions of data from the data set, wherein the at least two portions of data each contain a substantially randomized distribution of blocks of data from the data set.

42. The method of claim 38 wherein generating the at least two portions of data comprises generating the at least two portions of data from the data set using redundancy.

43. A method for securing a data set, the method comprising:

substantially randomly selecting a first group of data units from the data set;

substantially randomly selecting a second group of data units from the data set, wherein each of the first group of the data units and the second group of the data units contains less than all of the data units in the data set; and

storing the first group of data units and the second group of data units separately, whereby the data set is restorable from at least a portion of the first group of data units and at least a portion of the second group of data units.

44. The method of claim 43 wherein storing the first group of data units and the second group of data units separately comprises storing the first group of data units and the second group of data units on different locations of the same data depository.

45. The method of claim 43 wherein storing the first group of data units and the second group of data units separately comprises storing the first group of data units and the second group of data units on different data depositories.

46. The method of claim 43 wherein storing the first group of data units and the second group of data units separately comprises storing the first group of data units and the second group of data units on different data depositories in different geographic locations.