Secure storage and retrieval of confidential information

• US 8,488,785 B2
• Filed: 04/06/2011
• Issued: 07/16/2013
• Est. Priority Date: 04/08/2010
• Status: Active Grant

• Current Assignee: Mulligan Holdings Trust
• Original Assignee: Oceansblue Systems, LLC
• Inventors: Patawaran, Rogel, Chapman, Greg
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US13/080,951
• Publication Number:
  US 20110252480A1
• Time in Patent Office: 832 Days
• Field of Search: 380/46, 713193-194, 726 26- 30, 705/50, 705/64, 705/70, 705 75- 79
• US Class Current: 380/46
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A secure information storage management system may securely manage the storage of confidential information. A randomizer module may randomly generate a schema that specifies a random number of pieces, a random size for each piece, a random sequence for the pieces, and/or a random location where each piece is to be stored. The randomizer module may divide the confidential information into pieces that collectively constitute the confidential information in conformance with the schema. A storage management module may cause each piece of confidential information to be stored at a different, non-contiguous storage location. When present, the storage management module may cause each piece to be stored at the location for it that is specified in the schema.

Claims

1. A secure information storage management system for securely managing the storage of confidential information comprising:

a randomizer module that includes a processor, the randomizer module being configured to;

randomly generate a schema that specifies a random number of pieces, a random size for each piece, and/or a random sequence for the pieces; and

divide the confidential information into pieces that collectively constitute the confidential information in conformance with the schema; and

a storage management module that includes a processor, the storage management module being configured to cause each piece of confidential information to be stored at a different, non-contiguous storage location,

wherein the randomly-generated schema specifies a random number of pieces.

4. The secure information storage management system of claim 1, 2, or 3 wherein:

the randomly-generated schema also specifies a random location where each piece is to be stored; and

the storage management module is configured to cause each piece to be stored at the location for it that is specified in the schema.

5. The secure information storage management system of claim 1, 2, or 3 wherein the randomly-generated schema specifies at least two of the following:

a random number of pieces, a random size for each piece, and/or a random sequence for the pieces.

6. The secure information storage management system of claim 1, 2, or 3 wherein the randomly-generated schema specifies a random number of pieces, a random size for each piece, and a random sequence for the pieces.

7. The secure information storage management system of claim 1, 2, or 3 wherein the randomizer module is configured to randomly generate the schema by randomly selecting one of a stored set of different schemas, each stored schema being indicative of a number of pieces, a size for each piece, and/or a sequence for the pieces.

8. The secure information storage management system of claim 1, 2, or 3 further comprising a key generation module configured to generate a unique reconstruction key that is indicative of the schema and that is unique for each different instance of confidential information that is managed by the secure information storage management system.

9. The secure information storage management system of claim 1, 2, or 3 wherein the storage management module is configured to cause each piece of the confidential information to be stored in a different one of a cluster of computers.

10. The secure information storage management system of claim 1, 2, or 3 wherein the confidential information includes credit or debit card information, including a credit or debit card number.

11. The secure information storage management system of claim 10 wherein the randomizer module is configured to divide the credit or debit card number into pieces that collectively constitute the credit card or debit card number in conformance with the randomly-generated schema.

12. The secure information storage management system of claim 1, 2, or 3 further comprising:

a retrieval management module configured to cause the pieces of information that collectively constitute the confidential information to be retrieved from the different, non-contiguous storage locations; and

an assembler module configured to assemble the retrieved pieces into the confidential information in conformance with a unique reconstruction key that is unique for each different instance of confidential information and that is indicates the schema that specifies the number of pieces, the size for each piece, and/or the sequence of the pieces.

2. A secure information storage management system for securely managing the storage of confidential information comprising:

a randomizer module that includes a processor, the randomizer module being configured to;

randomly generate a schema that specifies a random number of pieces, a random size for each piece, and/or a random sequence for the pieces; and

divide the confidential information into pieces that collectively constitute the confidential information in conformance with the schema; and

a storage management module that includes a processor, the storage management module being configured to cause each piece of confidential information to be stored at a different, non-contiguous storage location,

wherein the randomly-generated schema specifies a random size for each piece.

3. A secure information storage management system for securely managing the storage of confidential information comprising:

a randomizer module that includes a processor, the randomizer module being configured to;

randomly generate a schema that specifies a random number of pieces, a random size for each piece, and/or a random sequence for the pieces; and

divide the confidential information into pieces that collectively constitute the confidential information in conformance with the schema; and

a storage management module that includes a processor, the storage management module being configured to cause each piece of confidential information to be stored at a different, non-contiguous storage location,

wherein the randomly-generated schema specifies a random sequence for the pieces.

13. A secure information retrieval management system for securely managing the retrieval of confidential information comprising:

a retrieval management module that includes a processor, the retrieval module being configured to cause pieces of information that collectively constitute the confidential information to be retrieved from different, non-contiguous storage locations; and

an assembler module that includes a processor, the assembler module being configured to assemble the retrieved pieces into the confidential information in conformance with a unique reconstruction key that is unique for each different instance of confidential information and that is indicative of a schema that specifies the number of pieces, the size of each piece, and/or the sequence for the pieces.

14. The secure information retrieval management system of claim 13 wherein the schema specifies the number of pieces.

15. The secure information retrieval management system of claim 13 wherein the schema specifies the size of each piece.

16. The secure information retrieval management system of claim 13 wherein the schema specifies the sequence of the pieces.

17. The secure information retrieval management system of claim 13 wherein:

the schema also specifies the location where each piece is stored; and

the retrieval management module is configured to cause each piece of confidential information to be retrieved from the location for it that is specified in the schema.

18. The secure information retrieval management system of claim 13 wherein the schema specifies at least two of the following:

the number of pieces, the size of each piece, and/or the sequence of the pieces.

19. The secure information retrieval management system of claim 13 wherein the schema specifies the number of pieces, the size of each piece, and the sequence of the pieces.

20. The secure information retrieval management system of claim 13 wherein the retrieval management module is configured to cause each piece of the confidential information to be retrieved from a different one of a cluster of computers.

21. The secure information retrieval management system of claim 13 wherein the confidential information includes credit or debit card information, including a credit or debit card number.

22. The secure information retrieval management system of claim 21 wherein the assembler module is configured to assemble the retrieved pieces of confidential information into the credit card or debit card number in conformance with the schema.