SECURE DATA PARSER METHOD AND SYSTEM

• US 20120159197A1
• Filed: 02/10/2012
• Published: 06/21/2012
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Orsini, Rick L., O'Hare, Mark S., Davenport, Roger, Winick, Steven
• Granted Patent: US 9,935,923 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.

Claims

1. A method for securing a data set, the method steps implemented by a programmed computer system, the method steps comprising:

encrypting the data set based on an encryption key to produce an encrypted data set;

transforming the encryption key using an all or nothing transform to produce a transformed encryption key;

generating data splitting information, wherein the data splitting information is usable to determine into which of a plurality of shares of data a unit of data of the encrypted data set will be placed;

separating the encrypted data set into the plurality of shares based on the data splitting information;

including in the plurality of shares data indicative of the transformed encryption key; and

causing the plurality of shares to be stored in respective separate storage locations;

wherein the data set is restorable by accessing less than all, but at least a threshold number of, the plurality of shares.

2. The method of claim 1, wherein the step of separating the encrypted data set comprises using a deterministic technique.

3. The method of claim 1, wherein the step of separating the encrypted data set comprises using a substantially random technique.

4. The method of claim 1 wherein the step of separating the encrypted data into the plurality of shares comprises causing a plurality of data units in each of the shares to be rearranged relative to one another.

5. The method of claim 1, wherein the step of storing the shares in respective separate storage locations comprises storing the shares on at least two separate storage devices.

6. The method of claim 1, further comprising the steps of:

creating integrity information based on the data set; and

including in the plurality of shares data indicative of the integrity information.

7. The method of claim 1, further comprising the steps of:

creating hash information based on a hash operation using the data set; and

including in the plurality of shares data indicative of the hash information.

8. The method of claim 1, wherein the step of including data indicative of the encryption key comprises:

encrypting the encryption key with a second key; and

including in the plurality of shares data indicative of the encrypted encryption key.

9. The method of claim 8 further comprising the method step of storing the second key outside of the plurality of shares, wherein the data set is restorable by accessing less than all, but at least a threshold number of, the plurality of shares, and the second key.

10. The method of claim 1 wherein the all or nothing transform is a full package transform.

11. A non-transitory computer readable medium storing computer executable instructions that, when executed by at least one processor, cause a computer system to carry out a method for securing a data set, the method comprising the steps:

encrypting the data set based on an encryption key to produce an encrypted data set;

transforming the encryption key using an all or nothing transform to produce a transformed encryption key;

generating data splitting information, wherein the data splitting information is usable to determine into which of a plurality of shares of data a unit of data of the encrypted data set will be placed;

separating the encrypted data set into the plurality of shares based on the data splitting information;

including in the plurality of shares data indicative of the transformed encryption key; and

causing the plurality of shares to be stored in respective separate storage locations;

wherein the data set is restorable by accessing less than all, but at least a threshold number of, the plurality of shares.

12. The non-transitory computer readable medium of claim 11, wherein the step of separating the encrypted data set comprises using a deterministic technique.

13. The non-transitory computer readable medium of claim 11, wherein the step of separating the encrypted data set comprises using a substantially random technique.

14. The non-transitory computer readable medium of claim 11, wherein the step of separating the encrypted data into the plurality of shares comprises causing a plurality of data units of the encrypted data set to be rearranged relative to one another.

15. The non-transitory computer readable medium of claim 11, wherein the step of storing the shares in respective separate storage locations comprises storing the shares on at least two separate storage devices.

16. The non-transitory computer readable medium of claim 11, wherein the method further comprises the steps of:

creating integrity information based on the data set; and

including in the plurality of shares data indicative of the integrity information.

17. The non-transitory computer readable medium of claim 11, wherein the method further comprises the steps of:

creating hash information based on a hash operation using the data set; and

including in the plurality of shares data indicative of the hash information.

18. The non-transitory computer readable medium of claim 11, wherein the step of including data indicative of the encryption key comprises:

encrypting the encryption key with a second key; and

including in the plurality of shares data indicative of the encrypted encryption key.

19. The non-transitory computer readable medium of claim 18 further comprising the method step of storing the second key outside of the plurality of shares, wherein the data set is restorable by accessing less than all, but at least a threshold number of, the plurality of shares, and the second key.

20. The non-transitory computer readable medium of claim 11 wherein the all or nothing transform is a full package transform.

21. A computer system for securing a data set, the system comprising:

at least one processor;

a non-transitory computer readable medium storing computer executable instructions that, when executed by the at least one processor, cause the computer system to carry out a method for securing a data set, the method comprising the steps of;

encrypting the data set based on an encryption key to produce an encrypted data set;

transforming the encryption key using an all or nothing transform to produce a transformed encryption key;

generating data splitting information, wherein the data splitting information is usable to determine into which of a plurality of shares of data a unit of data of the encrypted data set will be placed;

separating the encrypted data set into the plurality of shares based on the data splitting information;

including in the plurality of shares data indicative of the transformed encryption key; and

causing the plurality of shares to be stored in respective separate storage locations;

wherein the data set is restorable by accessing less than all, but at least a threshold number of, the plurality of shares.

22. The system of claim 21, wherein the step of separating the encrypted data set comprises generating data splitting information using a deterministic technique.

23. The system of claim 21, wherein the step of separating the encrypted data set comprises generating data splitting information using a substantially random technique.

24. The system of claim 21, wherein the step of separating the encrypted data into the plurality of shares comprises causing a plurality of data units of the encrypted data set to be rearranged relative to one another.

25. The system of claim 21, wherein the separate storage locations are located on at least two separate storage devices.

26. The system of claim 21, wherein the method further comprises the steps of:

creating integrity information based on the data set; and

including in the plurality of shares data indicative of the integrity information.

27. The system of claim 21, wherein the method further comprises the steps of:

creating hash information based on a hash operation using the data set; and

including in the plurality of shares data indicative of the hash information.

28. The system of claim 21, wherein the step of including data indicative of the encryption key comprises:

encrypting the encryption key with a second key; and

including in the plurality of shares data indicative of the encrypted encryption key.

29. The system of claim 28 wherein the method further comprises the step of storing the second key outside of the plurality of shares, wherein the data set is restorable by accessing less than all, but at least a threshold number of, the plurality of shares, and the second key.

30. The system of claim 21 wherein the all or nothing transform is a full package transform.