METHOD FOR KEYLESS PROTECTION OF DATA USING A LOCAL ARRAY OF DISKS

• US 20090161870A1
• Filed: 02/27/2009
• Published: 06/25/2009
• Est. Priority Date: 08/17/2006
• Status: Active Grant

• Current Assignee: University of Miami
• Original Assignee: University of Miami
• Inventors: ROSENBERG, Burton J.
• Granted Patent: US 8,484,263 B2
• Time in Patent Office: Days
• US Class Current: 380/268
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A method secures data in a network. The data includes a data message that has a first bit length. A random number is generated and transformed to create a first pseudo random number. The first pseudo random number is mixed with the data message to create an encrypted message. The encrypted message is transformed into a second pseudo random number. The second pseudo random number is mixed with the random number to produce a key. The encrypted message is placed side-by-side with the key to produce an output message. The output message is dispersed into a plurality of fragments. The plurality of fragments is stored in a plurality of data storage devices

Claims

1. A method for securing data in a network, the data including a data message, the data message having a first bit length, the method comprising:

generating a random number;

transforming the random number to create a first pseudo random number;

mixing the first pseudo random number with the data message to create an encrypted message;

transforming the encrypted message into a second pseudo random number;

mixing the second pseudo random number with the random number to produce a key;

placing the encrypted message side-by-side with the key to produce an output message;

dispersing the output message to a plurality of fragments; and

storing the plurality of fragments in a plurality of data storage devices.

2. The method of claim 1, wherein the first pseudo random number has a bit length equal to the first bit length, transforming the random number comprises passing the random number through a pseudo random number generator.

3. The method of claim 1, wherein the first pseudo random number has a bit length equal to the first bit length, transforming the random number comprises:

creating a hash value using the random number and the data message, the hash value having a bit length less than the first bit length; and

passing the hash value through a pseudo random number generator.

4. The method of claim 1, wherein dispersing the output message comprises:

dividing the output message into a plurality of data segments, the plurality of data segments having a total amount of data segments equal to k; and

dispersing the plurality of data segments into a plurality of fragments, each fragment containing 1/k of the output message such that any k fragments of the plurality of fragments can be used to recreate the encrypted message in its entirety.

5. The method of claim 4, wherein the dispersing the plurality of data segments is performed using one of a polynomial evaluation and a vector construction.

6. The method of claim 4, wherein k is less than a total amount of the plurality of fragments.

7. The method of claim 4, wherein a threshold number of fragments are needed to decrypt any portion of the data message.

8. The method of claim 7, wherein none of the data message is decipherable from less than the threshold number of fragments and the entire data message is decipherable from at least the threshold number of fragments.

9. The method of claim 7, wherein the threshold number of fragments is equal to k.

10. The method of claim 1, wherein the at least one random number has a bit length less than or equal to the first length.

11. The method of claim 1, further comprising:

transporting at least a first portion of the plurality of fragments along a first communication path of the network; and

transporting at least a second portion of the plurality of fragments along a second communication path of the network.

12. The method of claim 1, wherein the plurality of data storage devices have different locations.

14. The method of claim 10, wherein k is less than a total amount of the plurality of fragments.

13. A method for securing data in a network, the method comprising:

generating at least one random number, the at least one random number having a first bit length;

dividing a data message into a plurality of data segments, the plurality of data segments having a total amount of data segments equal to k, each data segment having a bit length equal to the first bit length;

dispersing the plurality of data segments and the at least one random number into a plurality of fragments, each fragment containing 1/k of the encrypted message such that any k fragments of the plurality of fragments can be used to recreate the encrypted message in its entirety; and

storing the plurality of fragments in a plurality of data storage devices.

15. A data security system comprising:

a data encryptor operating to;

generate a random number;

transform the random number to create a first pseudo random number;

mix the first pseudo random number with a data message to create an encrypted message;

transform the encrypted message into a second pseudo random number;

mix the second pseudo random number with the random number to produce a key; and

place the encrypted message side-by-side with the key to produce an output message; and

an information disperser communicatively coupled to the data encryptor, the information disperser operating to disperse the output message to a plurality of fragments.

16. The data security system of claim 15, further comprising a plurality of data storage devices communicatively coupled to the information disperser, the plurality of data storage devices operating to store the plurality of fragments.

17. The data security system of claim 16, wherein the first pseudo random number and the data message each have a bit length equal to a first bit length, the data security system further comprising a pseudo random number generator, the data encryptor transforms the random number by passing the random number through the pseudo random number generator.

18. The data security system of claim 16, wherein the first pseudo random number and the data message each have a bit length equal to a first bit length, the data security system further comprising a pseudo random number generator, the data encryptor transforms the random number by:

creating a hash value using the random number and the data message, the hash value having a bit length less than the first bit length; and

passing the hash value through a pseudo random number generator.

19. The data security system of claim 16, wherein the information disperser disperses the output message by:

dividing the output message into a plurality of data segments, the plurality of data segments having a total amount of data segments equal to k; and

dispersing the plurality of data segments into a plurality of fragments, each fragment containing 1/k of the output message such that any k fragments of the plurality of fragments can be used to recreate the encrypted message in its entirety.

20. The data security system of claim 16, further comprising:

a first communication path communicatively coupled to the information disperser and a first portion of the plurality of storage devices, the first communication path transporting at least a first portion of the fragments to the first portion of the plurality of storage devices; and

a second communication path communicatively coupled to the information disperser and a second portion of the plurality of storage devices, the second communication path transporting at least a second portion of the fragments to the second portion of the plurality of storage devices.