SECURE DATA PARSER METHOD AND SYSTEM

• US 20120222134A1
• Filed: 05/10/2012
• Published: 08/30/2012
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Orsini, Rick L., O'Hare, Mark S., Davenport, Roger, Winick, Steven
• Granted Patent: US 8,769,699 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths.

Claims

1. A method of managing access to data in a secure data storage network, the method comprising:

associating a storage resource with a group of users, the group of users associated with a workgroup key providing access to a virtual disk, the virtual disk allowing access to a volume comprising a plurality of shares stored on a plurality of physical storage devices;

upon determining a user of a client device is a member of the group of users, providing access to the storage resource to the user; and

whereby the storage resource is associated with the workgroup key.

2. The method of claim 1, further comprising determining a user of a client device is a member of the group of users by assessing user credentials at a secure storage appliance.

3. The method of claim 2, further comprising receiving the user credentials at the secure storage appliance from an application on the client device.

4. The method of claim 1, wherein the workgroup key is stored on a remote key server.

5. The method of claim 1, wherein the storage resource is a share stored on a physical storage device.

6. The method of claim 1, wherein associating the storage resource with the group of users occurs on a secure storage appliance.

7. The method of claim 1, wherein the storage resource is configured to allow access to the workgroup key to members of the group of users.

8. The method claim 1, wherein the plurality of shares store a plurality of secondary data blocks, and wherein the plurality of secondary data blocks are cryptographically split from a primary data block.

9. A secure storage appliance comprising:

a programmable circuit configured to execute program instructions which, when executed, cause the secure storage appliance to;

provide access to a plurality of storage resources to a client device;

associate a storage resource from among the plurality of storage resources with a group of users, the group of users associated with a workgroup key providing access to a virtual disk, the virtual disk allowing access to a volume comprising a plurality of shares stored on a plurality of physical storage devices;

upon determining a user of the client device is a member of the group of users, provide access to the storage resource to the user, thereby associating the storage resource with the workgroup key.

10. The secure storage appliance of claim 9, wherein the programmable circuit is further programmed to determine a user of a client device is a member of the group of users by assessing user credentials.

11. The secure storage appliance of claim 10, wherein the programmable circuit is further programmed to receive the user credentials from an application on the client device.

12. The secure storage appliance of claim 9, wherein the storage resource is a share stored on a physical storage device.

13. The secure storage appliance of claim 9, wherein the workgroup key is stored on a key server separate from the secure storage appliance.

14. The secure storage appliance of claim 9, wherein the plurality of shares store a plurality of secondary data blocks, and wherein the plurality of secondary data blocks are cryptographically split from a primary data block.

15. A secure data storage network comprising:

a client device;

a plurality of physical storage devices;

a secure storage appliance connected to the client device and the plurality of physical storage devices, the secure storage appliance including a programmable circuit configured to execute program instructions which, when executed, cause the secure storage appliance to;

provide access to a plurality of storage resources to the client device;

associate a storage resource from among a plurality of storage resources with a group of users, the group of users associated with a workgroup key providing access to a virtual disk, the virtual disk allowing access to a volume comprising a plurality of shares stored on the plurality of physical storage devices;

upon determining a user of the client device is a member of the group of users, provide access to the storage resource to the user, thereby associating the storage resource with the workgroup key.

16. The secure data storage network of claim 15, wherein the programmable circuit is further programmed to determine a user of a client device is a member of the group of users by assessing user credentials.

17. The secure data storage network of claim 16, wherein the programmable circuit is further programmed to receive the user credentials from an application on the client device.

18. The secure data storage network of claim 15, wherein the workgroup key is stored on a key server separate from the secure storage appliance.

19. The secure data storage network of claim 15, wherein the plurality of shares store a plurality of secondary data blocks, and wherein the plurality of secondary data blocks are cryptographically split from a primary data block.