SECURE DATA PARSER METHOD AND SYSTEM

• US 20150286830A1
• Filed: 05/12/2015
• Published: 10/08/2015
• Est. Priority Date: 09/20/1999
• Status: Abandoned Application

• Current Assignee: Security First Corp
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Davenport, Roger S.
• Application Number:
  US14/710,522
• Publication Number:
  US 20150286830A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/68 : Special signature format, e.g. XML format
• CPC Class Codes: H04L 2209/805 : Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present invention provides a method and system for securing sensitive data from unauthorized access or use. The method and system of the present invention is useful in a wide variety of settings, including commercial settings generally available to the public which may be extremely large or small with respect to the number of users. The method and system of the present invention is also useful in a more private setting, such as with a corporation or governmental agency, as well as between corporation, governmental agencies or any other entity.

Claims

1. (canceled)

2. A method performed by a programmed computer system for securing a data set in a computer network, the method comprising:

a. producing a plurality of data shares, wherein each share comprises at least some but less than all of the data set;

b. substantially randomly assigning the data shares to a plurality of available data share receiving locations within the computer network; and

c. storing the data shares in the assigned receiving locations.

3. The method of claim 2, further comprising encrypting the data set to generate an encrypted data set, wherein the at least some of the data set of each data share comprises at least some of the encrypted data set.

4. The method of claim 2, further comprising encrypting the data shares.

5. The method of claim 2, further comprising compressing the data set to generate a compressed data set, wherein the at least some of the data set of each data share comprises at least some of the compressed data set.

6. The method of claim 2, further comprising encrypting and compressing the data set to generate an encrypted compressed data set, wherein the at least some of the data set of each data share comprises at least some of the encrypted compressed data set.

7. The method of claim 2, wherein the computer network comprises an Internet network and the plurality of data share receiving locations comprise a plurality of data storage devices at geographically dispersed locations.

8. The method of claim 2, wherein at least two of the plurality of data shares are stored in respectively different data share receiving locations.

9. The method of claim 2, wherein the substantially randomly assigning is performed by a client computer system coupled to the computer network, and wherein the method further comprises communicating the plurality of data shares from the client computer system to respective assigned receiving locations of the computer network.

10. The method of claim 9, wherein the communicating comprises separately transmitting at least two data shares to their respective assigned receiving locations, and wherein the storing comprises storing the at least two data shares on respective different data storage devices at geographically separated and independent data storage locations.

11. The method of claim 2, wherein the data set is provided by a client computer coupled to the computer network, and the producing and substantially randomly assigning are performed by one or more computers coupled to the computer network that receive the data set from the client computer.

12. A system for securing a data set in a computer network, the system comprising:

one or more hardware processors configured to;

d. produce a plurality of data shares, wherein each share comprises at least some but less than all of the data set;

e. substantially randomly assign the data shares to a plurality of available data share receiving locations within the computer network; and

f. store the data shares in the assigned receiving locations.

13. The system of claim 12, wherein the one or more hardware processors are further configured to encrypt the data set to generate an encrypted data set, wherein the at least some of the data set of each data share comprises at least some of the encrypted data set.

14. The system of claim 12, wherein the one or more hardware processors are further configured to encrypt the data shares.

15. The system of claim 12, wherein the one or more hardware processors are further configured to compress the data set to generate a compressed data set, wherein the at least some of the data set of each data share comprises at least some of the compressed data set.

16. The system of claim 12, wherein the one or more hardware processors are further configured to encrypt and compress the data set to generate an encrypted compressed data set, wherein the at least some of the data set of each data share comprises at least some of the encrypted compressed data set.

17. The system of claim 12, wherein the computer network comprises an Internet network and the plurality of data share receiving locations comprise a plurality of data storage devices at geographically dispersed locations.

18. The system of claim 12, wherein at least two of the plurality of data shares are stored in respectively different data share receiving locations.

19. The system of claim 12, wherein the system comprises a client computer system, and wherein the one or more hardware processors are further configured to communicate the plurality of data shares from the client computer system to respective assigned receiving locations of the computer network.

20. The system of claim 19, wherein the one or more hardware processors are configured to communicate by separately transmitting at least two data shares to their respective assigned receiving locations, and wherein the one or more hardware processors are configured to store by storing the at least two data shares on respective different data storage devices at geographically separated and independent data storage locations.

21. The system of claim 12, wherein the data set is provided by a client computer coupled to the computer network.

22. A non-transitory computer readable medium comprising instructions thereon for securing a data set in a computer network, the instructions comprising:

g. instructions for producing a plurality of data shares, wherein each share comprises at least some but less than all of the data set;

h. instructions for substantially randomly assigning the data shares to a plurality of available data share receiving locations within the computer network; and

i. instructions for storing the data shares in the assigned receiving locations.

23. The non-transitory computer readable medium of claim 22, further comprising instructions for encrypting the data set to generate an encrypted data set, wherein the at least some of the data set of each data share comprises at least some of the encrypted data set.

24. The non-transitory computer readable medium of claim 22, further comprising instructions for encrypting the data shares.

25. The non-transitory computer readable medium of claim 22, further comprising instructions for compressing the data set to generate a compressed data set, wherein the at least some of the data set of each data share comprises at least some of the compressed data set.

26. The non-transitory computer readable medium of claim 22, further comprising instructions for encrypting and compressing the data set to generate an encrypted compressed data set, wherein the at least some of the data set of each data share comprises at least some of the encrypted compressed data set.

27. The non-transitory computer readable medium of claim 22, wherein the computer network comprises an Internet network and the plurality of data share receiving locations comprise a plurality of data storage devices at geographically dispersed locations.

28. The non-transitory computer readable medium of claim 22, wherein at least two of the plurality of data shares are stored in respectively different data share receiving locations.

29. The non-transitory computer readable medium of claim 22, wherein the instructions for substantially randomly assigning are performed by a client computer system coupled to the computer network, and wherein the non-transitory computer readable medium further comprises instructions for communicating the plurality of data shares from the client computer system to respective assigned receiving locations of the computer network.

30. The non-transitory computer readable medium of claim 29, wherein the instructions for communicating comprises instructions for separately transmitting at least two data shares to their respective assigned receiving locations, and wherein the instructions for storing comprises instructions for storing the at least two data shares on respective different data storage devices at geographically separated and independent data storage locations.

31. The non-transitory computer readable medium of claim 22, wherein the data set is provided by a client computer coupled to the computer network, and the instructions for producing and substantially randomly assigning are performed by one or more computers coupled to the computer network that receive the data set from the client computer.