DATA SECURITY FOR DIGITAL DATA STORAGE

• US 20120233454A1
• Filed: 05/25/2012
• Published: 09/13/2012
• Est. Priority Date: 03/27/2001
• Status: Active Grant

• Current Assignee: Doug L. Rollins
• Original Assignee: Doug L. Rollins
• Inventors: Rollins, Doug L.
• Granted Patent: US 9,003,177 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]

Abstract

A computing system includes data encryption in the data path between a data source and data storage devices. The data storage devices may be local or they may be network resident. The data encryption may utilize a key which is derived at least in part from an identification code stored in a non-volatile memory. The key may also be derived at least in part from user input to the computer. In a LAN embodiment, public encryption keys may be automatically transferred to a network server for file encryption prior to file transfer to a client system.

Claims

1-18. -18. (canceled)

19. Apparatus configured to store data, the apparatus comprising:

apparatus configured to receive an encryption key generated by a first computer, the encryption key uniquely associated at least in part with a user of the first computer;

apparatus configured to obtain encrypted data via the first computer, the encrypted data having been generated using the encryption key;

apparatus configured to receive a file attribute to be stored, the file attribute in association with the encrypted data denoting the data as encrypted, and further indicating a source of the encryption key;

apparatus configured to cause an indication of the source of the encrypted data to be stored; and

logic configured to;

when a request is received from a requestor for the encrypted data, and the requestor is the source of the encrypted data, forward the encrypted data to the requestor; and

when a request is received from a requestor for non-encrypted data, encrypt the non-encrypted data with the encryption key associated with the requestor and forward the encrypted data to the requestor.

20. The apparatus of claim 19, wherein the logic is further configured to, when the requestor is not a source of the encrypted data, send the requestor a message indicating that the encrypted data is not associated with the requestor.

21. The apparatus of claim 19, further comprising apparatus configured to automatically obtain the encryption key from the first computer to encrypt the non-encrypted data.

22. The apparatus of claim 19, further comprising apparatus configured to process a request to retrieve data, wherein the processing comprises checking the file attribute prior to providing the data back to the first computer.

23. The apparatus of claim 19, further comprising apparatus configured to cheek the file attribute to determine whether data is in unencrypted form prior to encryption thereof.

24. The apparatus of claim 19, wherein the encryption key comprises at least one of a private encryption key and a public encryption key.

25. The apparatus of claim 24, wherein public key is obtained by the apparatus from the first computer.

26. The apparatus of claim 24, wherein the apparatus is configured to store the public encryption key and the encrypted data.

27. A computerized storage system, comprising:

a storage device;

a processor in data communication with the storage device, the processor configured to execute at least one computer program comprising a plurality of instructions configured to, when executed by the processor;

receive a user-specific encryption key;

receive user-specific information enabling an authorized entity to access first data based at least in part on an association of the user-specific information and the first data;

encrypt the first data upon a determination that the first data has not been previously encrypted as a first encrypted data, using at least the user-specific encryption key so as to produce the first encrypted data;

store the first encrypted data and the user-specific information on the storage device;

receive a request for access to the first encrypted data;

determine, based at least in part on the stored user-specific information, whether the request is received from the authorized entity; and

when it is determined that the request is received from the authorized entity, provide the requested first encrypted data thereto.

28. The computer storage system of claim 27, wherein the plurality of instructions are further configured to, when executed:

determine that a requesting entity is not to be the authorized entity of the encrypted data; and

cause transmission of a message indicating that the encrypted data is not associated with the requesting entity.

29. The computer storage system of claim 27, wherein the computerized storage system is configured to obtain the user-specific encryption key from the authorized entity to enable said encryption of the non-encrypted data.

30. The computer storage system of claim 27, wherein the computerized storage system is configured to check the association of the user-specific information and the first data to at least determine that the first data is in unencrypted form prior to encrypting.

31. The computer storage system of claim 27, wherein the authorized entity comprises a specific user.

32. A method of storing data in a computerized storage system, comprising:

generating an encryption key using a first computer, the encryption key being uniquely associated at least in part with a user;

encrypting data using the generated key and first computer to generate first encrypted data;

causing the first encrypted data to be stored on a computerized storage device, the computerized storage device connected via a network to the first computer; and

providing an attribute to be stored on the storage device, the attribute in association with the first encrypted data (i) designating the data as encrypted, and (ii) indicating the association between the user and the encryption key;

wherein the attribute is configured to cause requested data that has not been previously encrypted to be encrypted using the encryption key to generate second encrypted data, the second encrypted data to be provided to a source of the request.

33. The method of claim 32, further comprising decrypting the first encrypted data by the first computer using at least the encryption key.

34. The method of claim 32, further comprising decrypting at least a portion of the second encrypted data by the first computer using at least the encryption key.

35. The method of claim 32, wherein the encryption key associated with the user comprises at least one of a private encryption key and a public encryption key.

36. The method of claim 32, wherein the act of generating the encryption key is based at least in part on receiving a unique identifier from a storage location within the first computer.