Secure data storage system and method

• US 8,201,261 B2
• Filed: 04/27/2009
• Issued: 06/12/2012
• Est. Priority Date: 04/27/2009
• Status: Active Grant

• Current Assignee: Chase Barfield, Jason Cornell, Jeff Arbour
• Original Assignee: Chase Barfield, Jason Cornell, Jeff Arbour
• Inventors: Barfield, Chase, Cornell, Jason, Arbour, Jeff
• Primary Examiner(s): Reagan, James A
• Application Number:
  US12/430,643
• Publication Number:
  US 20100275005A1
• Time in Patent Office: 1,142 Days
• Field of Search: 705/26
• US Class Current: 726/26
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen
• CPC Class Codes: G06F 2221/2147 Locking files
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A system and method for the secure storage of data in a network. Data stored on a primary server connected to the network is initially encrypted. The IP address of the primary server is sent to a second server, via the network, and a communication is received from the second server indicating pending instructions. If the instructions indicate that theft of the primary server has occurred, then the data stored on the primary server is re-encrypted and the IP address of the primary server is sent to the second server. If attempted unauthorized access of the primary server is determined, and a predetermined number of consecutive unauthorized attempts to access the primary server are made, then the data stored on the primary server is erased.

Claims

1. A method for the secure storage of information in a network comprising:

encrypting data stored on a primary server connected to the network;

sending the IP address of the primary server to a second server, via the network; and

receiving a communication from the second server indicating pending instructions;

if the instructions indicate that theft of the primary server has occurred, then

re-encrypting the data stored on the primary server and

sending the IP address of the primary server to the second server; and

if attempted unauthorized access of the primary server is determined by the primary server, and a predetermined number of consecutive unauthorized attempts to access the primary server are made, then

initiating, by the primary server, erasing of the data stored on the primary server.

2. The method of claim 1, wherein unauthorized access of the primary server is determined by:

receiving a password entered via the primary server;

repeating the step of receiving a password, if the password is not accepted; and

receiving a predetermined number of passwords that are not accepted.

3. The method of claim 2, wherein:

if the predetermined number of passwords are received but not accepted, then disabling access, via the primary server, to the data stored on the primary server and re-encrypting the data stored thereon;

if a predetermined number of additional passwords are received but not accepted, then erasing the data stored on the primary server.

4. The method of claim 1, wherein the IP address of the primary server sent to the second server is used to determine a physical location of the primary server.

5. The method of claim 1, wherein the primary server includes an operating system, and wherein the operating system is erased if a predetermined additional number of passwords are received but not accepted after erasing the data stored on the primary server.

6. A system for secure storage of data in a network comprising:

a computer coupled to the network and to at least one data storage device;

a server, located off of the premises on which the computer is situated, and coupled to the network;

a security key device coupled to the network; and

a second computer coupled to the computer via the network;

wherein;

data stored on the storage device is encrypted; and

if no connectivity is established between the computer and the security key device, then the storage device is disabled;

if connectivity is established, then access to the storage device is enabled; and

the computer checks for a communication from the second computer indicating pending special instructions;

wherein

if special instructions received in the communication indicate that theft of the computer has occurred, then the data stored on the storage device is re-encrypted;

if no special instructions are received in the communication, then if a predetermined number of consecutive unauthorized attempts to access the computer are made, then the data stored on the storage device is erased.

7. The system of claim 6, further including:

receiving a password from a PC connected to the server; and

repeating the receiving step if the password is not accepted;

if a predetermined number of passwords are received but not accepted, then disabling each said data storage device and re-encrypting the data stored thereon; and

if a predetermined number of additional passwords are received but not accepted, then erasing the data stored on each said data storage device.

8. The system of claim 6, wherein, the computer is prevented from accessing the data stored on the storage device when the storage device is disabled.

9. The system of claim 6, wherein the password is entered via the computer.

10. The system of claim 6, wherein:

the IP address of the computer is sent to the server; and

the IP address is used by the server to determine a physical location of the computer.