Apparatus and method for storing data

• US 5,606,610 A
• Filed: 06/28/1996
• Issued: 02/25/1997
• Est. Priority Date: 11/30/1993
• Status: Expired due to Term

• Current Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Original Assignee: Anonymity Protection In Sweden AB
• Inventors: Johansson, Jan
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US08/464,891
• Time in Patent Office: 242 Days
• Field of Search: 380/4, 380/33, 380/45
• US Class Current: 713/193
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 16/10 File systems; File servers
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A method and apparatus for storing data comprising an original identity(OID) and associated descriptive information(DI) are disclosed. By means of a first algorithm(ALG1), the original identity(OID) is encrypted to an update identity(UID) which, by means of a reversible algorithm(ALG2), is encrypted to a storage identity(SID) which is stored as a record(P) on a storage medium along with associated descriptive information(DI). At the times when storage identities(SID) of selected records(P) are to be replaced with new storage identities(SID'"'"'), the storage identities(SID) are decrypted in order to recreate the corresponding update identities(UID), which then are encrypted, by means of a new altered reversible algorithm(ALG2'"'"'), to new storage identities(SID'"'"') intended to replace the previous storage identities (SID).

Claims

1. An apparatus for storing data comprising an original identity (OID) and associated descriptive information (DI), characterised by

a first encrypting means (50) which is arranged, by means of a first algorithm (ALG1), to encrypt the original identity (OID) to an update identity (UID),

a second encrypting means (50) which is arranged, by means of a reversible algorithm (ALG2), to encrypt the update identity (UID) to a storage identity (SID), which is to be stored along with associated descriptive information (DI) as a record (P) on a storage medium (30, 40), and

a decrypting means (50) which is arranged, at times when the storage identities (SID) of selected stored records (P) are to be replaced with new storage identities (SID'"'"'), to decrypt these storage identities (SID) in order to recreate the corresponding update identities (UID),

the second encrypting means (50) being arranged, at said times and by means of an altered reversible algorithm (ALG2'"'"'), to encrypt the recreated update identities (UID) to new storage identities (SID'"'"'), which are to replace the previous storage identities (SID).

2. An apparatus as set forth in claim 1, characterised by a means arranged to randomly establish said times when the storage identities (SID) of the selected records (P) are to be replaced with new storage identities (SID'"'"').

3. An apparatus as set forth in claim 1, characterised by the first algorithm (ALG1) for creating the update identity (UID) being a non-reversible algorithm.

4. An apparatus as set forth in claim 1, characterised by the first and the second encrypting means and the decrypting means being implemented as a hardware component (50).

5. An apparatus as set forth in claim 4, characterised by the hardware component (50) comprising a processor of its own, which is adapted to act as a distributed processor in a computer.

6. An apparatus as set forth in claim 4, characterised by the hardware component (50) being adapted to create variable algorithms and comprising a means for storing the algorithms last created.

7. An apparatus as set forth in claim 2, characterized by the first algorithm (ALG1) for creating the update identify (UID) being a non-reversible algorithm.

8. An apparatus as set forth in claim 2, characterized by the first and second encrypting means and the decrypting means being implemented as a hardware component (50).

9. An apparatus as set forth in claim 3, characterized by the first and second encrypting means and the decrypting means being implemented as a hardware component (50).

10. An apparatus as set forth in claim 5, characterized by the hardware component (50) being adapted to create variable algorithms and comprising a means for storing the algorithms last created.

16. A method as set forth in claim 8, characterized in that the step of replacing the storage identities (SID) of the selected records (P) with the new storage identities (SID'"'"') is carried out in a batch, so that the storage identities (SID) of the selected records (P) are altered essentially simultaneously on the storage medium (30, 40).

17. A method as set forth in claim 8, characterized in that the step of replacing the storage identities (SID) of the selected records (P) with new storage identities (SID'"'"') also comprises moving the selected records (P) to new physical locations on the storage medium (30, 40).

18. A method as set forth in claim 9, characterized in that the step of replacing the storage identities (SID) of the selected records (P) with new storage identities (SID'"'"') also comprises moving the selected records ()P) to new physical locations on the storage medium (30, 40).

19. A method as set forth in claim 8, characterized by the step of encrypting also the descriptive information before this is stored on the storage medium in the respective records (P).

20. A method as set forth in claim 9, characterized by the step of encrypting also the descriptive information (DI) before this is stored on the storage medium in the respective records (P).

21. A method as set forth in claim 10, characterized by the step of encrypting also the descriptive information (DI) before this is stored on the storage medium in the respective records (P).

11. A method for storing data comprising an original identity (OID) and associated descriptive information (DI), characterised by the steps of

encrypting the original identity (OID) to an update identity (UID) by means of a first algorithm (ALG1),

encrypting the update identity (UID) to a storage identity (SID) by means of a reversible algorithm (ALG2),

storing the storage identity (SID) and the descriptive information (DI) as a record (P) on a storage medium (30, 40), and

performing the following substeps at times when the storage identities (SID) of selected stored records (P) are to be replaced with new storage identities (SID'"'"'):

decrypting the storage identities (SID) of the selected records (P) in order to recreate the corresponding update identities (UID),

altering the reversible algorithm (ALG2) and encrypting, by means of the altered reversible algorithm (ALG2'"'"'), the recreated update identities (UID) to new storage identities (SID'"'"'), and

replacing the storage identities (SID) of the selected records (P) with the new storage identities (SID'"'"').

12. A method as set forth in claim 11, characterised by the step of selecting, as said selected records (P), all the records (P) stored on the storage medium (30, 40).

13. A method as set forth in claim 11, characterised in that the step of replacing the storage identities (SID) of the selected records (P) with the new storage identities (SID'"'"') is carried out in a batch, so that the storage identities (SID) of the selected records (P) are altered essentially simultaneously on the storage medium (30, 40).

14. A method as set forth in claim 11, characterised in that the step of replacing the storage identities (SID) of the selected records (P) with new storage identities (SID'"'"') also comprises moving the selected records (P) to new physical locations on the storage medium (30, 40).

15. A method as set forth in claim 11, characterised by the step of encrypting also the descriptive information (DI) before this is stored on the storage medium in the respective records (P).