Meta-complete data storage

• US 9,152,579 B2
• Filed: 01/27/2014
• Issued: 10/06/2015
• Est. Priority Date: 09/29/2006
• Status: Active Grant

• Current Assignee: Protegrity US Holding LLC
• Original Assignee: Protegrity USA, Inc. (Xcelera Inc.)
• Inventors: Mattsson, Ulf
• Primary Examiner(s): TURCHEN, JAMES R
• Application Number:
  US14/164,823
• Publication Number:
  US 20140143556A1
• Time in Patent Office: 617 Days
• Field of Search: 713/190
• US Class Current: 1/1
• CPC Class Codes: G06F 12/1408 by using cryptography for digital transmission H04L9/00
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

The invention described herein generally relates to systems and methods of securely storing data so that the data contains information about the data and/or the encryption of the data, systems and methods of providing secure access to real world data through data transformations, and systems and methods of managing security parameters for data.

Claims

1. A method comprising:

encrypting, for each datum in a plurality of structured clear-text data comprising a first subset of clear-text characters and a second subset of clear-text characters, the first subset of clear-text characters to produce a first subset of encrypted characters, each of a plurality of subsets of encrypted characters comprising metadata describing the encryption of a subset of clear-text characters into the subset of encrypted characters such that a total length of the subset of encrypted characters and the metadata is equal to a length of the subset of clear-text characters;

storing the first subset of encrypted characters adjacent to the second subset of clear text characters within a partially encrypted datum in a database;

searching, by a processor, the second subset of clear text characters of each partially encrypted datum stored in the database with a first portion of a query term to identify a first subset of partially encrypted data, the second subset of clear text characters in each partially encrypted datum in the first subset of partially encrypted data including the first portion of the query term; and

searching, by the processor, the first subset of encrypted characters of each partially encrypted datum in the first subset of partially encrypted data with a second portion of the query term to identify a result set of partially encrypted data, each partially encrypted datum in the result set including the first portion of the query term in the second subset of clear text characters of the partially encrypted datum and the second portion of the query term in the first subset of encrypted characters of the partially encrypted datum.

2. The method of claim 1, wherein searching the second subset of clear text characters of each partially-encrypted datum comprises pattern matching.

3. The method of claim 1 wherein searching the first subset of encrypted characters of each partially encrypted datum comprises:

decrypting the first subset of encrypted characters of the partially encrypted datum to produce a first subset of clear-text characters; and

searching the first subset of clear-text characters.

4. The method of claim 1, wherein for each partially-encrypted datum, the first subset of encrypted characters and the second subset of clear text characters are stored in a single data element in the database.

5. A system comprising:

a database comprising a memory;

an encryption engine configured to, for each datum comprising a first subset of clear-text characters and a second subset of clear-text characters in a plurality of structured clear-text data stored in the database, encrypt the first subset of clear-text characters to produce a first subset of encrypted characters and store the first subset of encrypted characters adjacent to the second subset of clear text characters within a partially encrypted datum in the database, each of a plurality of subsets of encrypted characters comprising metadata describing the encryption of a subset of clear-text characters into the subset of encrypted characters such that a total length of the subset of encrypted characters and the metadata is equal to a length of the subset of clear-text characters; and

a search engine configured to;

search the second subset of clear text characters of each partially encrypted datum stored in the database with a first portion of a query term to identify a first subset of partially encrypted data, the second subset of clear text characters in each partially encrypted datum in the first subset of partially encrypted data including the first portion of the query term; and

search the first subset of encrypted characters of each partially encrypted datum in the first subset of partially encrypted data with a second portion of the query term to identify a result set of partially encrypted data, each partially encrypted datum in the result set including the first portion of the query term in the second subset of clear text characters of the partially encrypted datum and the second portion of the query term in the first subset of encrypted characters of the partially encrypted datum.

6. The system of claim 5, wherein searching the second subset of clear text characters of each partially-encrypted datum comprises pattern matching.

7. The system of claim 5 wherein searching the first subset of encrypted characters of each partially encrypted datum comprises:

decrypting the first subset of encrypted characters of the partially encrypted datum to produce a first subset of clear-text characters; and

searching the first subset of clear-text characters.

8. The system of claim 5, wherein for each partially-encrypted datum, the first subset of encrypted characters and the second subset of clear text characters are stored in a single data element in the database.