Dispersed secure data storage and retrieval

• US 8,751,829 B2
• Filed: 07/18/2011
• Issued: 06/10/2014
• Est. Priority Date: 02/05/2009
• Status: Active Grant

• Current Assignee: WwPass Corp.
• Original Assignee: WwPass Corp.
• Inventors: Vysogorets, Mikhail, Shablygin, Eugene
• Primary Examiner(s): Yalew, Fikremariam A
• Application Number:
  US13/184,884
• Publication Number:
  US 20120066517A1
• Time in Patent Office: 1,058 Days
• US Class Current: 713/193
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2107 File encryption

Abstract

A computer-implemented method that includes secure storage and retrieval of data is described herein.

Claims

1. A computer-implemented method comprising:

receiving data;

generating, by a computer system, multiple data segments using calculations based on portions of the data, such that the data can be recreated based on at least some of the data segments;

generating a data container identifier including generating a one way permutation using data related to a user and data related to a service provider, where the one way permutation is a function in which the data related to the user and the data related to the service provider cannot be determined by knowing the data container identifier;

determining storage locations based on the data container identifier;

storing the data segments in different storage locations in multiple, different storage zones, with each of the storage zones storing less than a number of data segments required to recreate the data, and such that the data can be recreated based on the data segments retrieved from less than all of the storage locations;

identifying a particular set of storage locations based on the data container identifier by regenerating the data container identifier by regenerating the one way permutation using the data related to the user and the data related to the service provider;

retrieving the data segments from the particular set of storage locations; and

manipulating the retrieved data segments to recreate the data.

2. The method of claim 1, further comprising preventing recreation of the data from data segments retrieved from a single storage zone.

3. The method of claim 1, further comprising preventing recreation of the data from data segments retrieved from a less than a specified number of the storage zones.

4. The method of claim 1, wherein storing the data segments in different storage locations comprises storing the data segments on storage media dispersed across multiple networked computers.

5. The method of claim 1, wherein:

receiving the data comprises receiving encrypted data with the encrypted data being encrypted using an encryption key and encryption algorithm associated with the user, the encryption key and identification of the encryption algorithm being stored on one or more tokens associated with the user;

recreating the data comprises recreating the encrypted data; and

the method further comprises decrypting the recreated encrypted data using the encryption key and encryption algorithm associated with the user.

6. The method of claim 1, wherein different storage locations comprise different networked storage nodes with each storage node including one or more networked computers and their associated data storage media.

7. The method of claim 1, wherein each of the multiple storage zones is located in a geographical area that is different from the geographical area of the other ones of the multiple storage zones.

8. The method of claim 1, wherein each of the multiple storage zones exists under a set of legal jurisdictions that is different from set legal jurisdictions of the other ones of the multiple storage zones.

9. The method of claim 1, wherein storing the data segments in different storage locations comprises storing each data segment at a point within a storage location specified by a combination of data related to the user and data related to the service provider.

10. The method of claim 9, further comprising authenticating the user and the service provider before storing or recreating the data.

11. The method of claim 1, wherein generating the data container identifier comprises performing a one-way function based on a user ID, a service provider ID, and one or more additional inputs.

12. The method of claim 1, wherein generating multiple data segments using calculations involving portions of the data comprises generating multiple data segments with each segment including a portion of less than all of the data with some portions of the data being included in multiple, different data segments.

13. The method of claim 1, wherein generating multiple data segments using calculations involving portions of the data comprises generating multiple data segments where some of the data segments include identical portions of the data.