Secure data parser method and system

• US 9,177,159 B2
• Filed: 06/11/2013
• Issued: 11/03/2015
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Davenport, Roger S., Winick, Steven
• Primary Examiner(s): CHAO, MICHAEL W
• Application Number:
  US13/915,518
• Publication Number:
  US 20130275768A1
• Time in Patent Office: 875 Days
• Field of Search: 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.

Claims

1. A method for securing a data set, the method comprising:

determining a number of data portions into which to distribute the data set;

distributing, using a hardware processor, substantially equal shares of data from the data set into each of the data portions according to a splitting key, such that at least one of the data portions contains a different number of shares than a remainder of the data portions;

appending redundancy data to each of the data portions;

storing each of the data portions separately; and

restoring the data set from a subset of the data portions.

2. The method of claim 1 wherein distributing substantially equal shares of data from the data set comprises distributing the data set, one bit at a time, into each of the data portions, respectively, in a round-robin manner until all bits of the data set have been distributed.

3. The method of claim 1 wherein the redundancy data comprises data from one or more of the other data portions.

4. The method of claim 1 wherein restoring the data set requires at least a minimum number that is less than all of the data portions.

5. The method of claim 1 wherein at least one data portion is required in order to restore the data set.

6. The method of claim 5 wherein the at least one data portion comprises an authentication key.

7. The method of claim 5 wherein the at least one data portion is stored on a physical token device.

8. The method of claim 1 wherein the at least one data portion is encrypted with a workgroup key.

9. The method of claim 1 further comprising encrypting the data portions using at least one encryption key.

10. The method of claim 9 wherein the encryption key is a public key, and wherein the data portions may be decrypted using a private key.

11. The method of claim 9 wherein at least one of the data portions is encrypted with a first encryption key and at least one other data portion is encrypted using a second encryption key.

12. The method of claim 9 wherein restoring the data set comprises restoring an encrypted data set from a subset of the encrypted data portions and decrypting the encrypted data set.

13. A system for securing a data set, the system comprising:

a hardware processor configured to;

determine a number of data portions into which to distribute the data set;

distribute substantially equal shares of data from the data set into each of the data portions according to a splitting key such that at least one of the data portions contains a different number of shares than a remainder of the data portions;

append redundancy data to each of the data portions;

restore the data set from a subset of the data portions; and

two or more memories configured to store each of the data portions separately.

14. The system of claim 13 wherein distributing substantially equal shares of data from the data set comprises distributing the data set, one bit at a time, into each of the data portions, respectively, in a round-robin manner until all bits of the data set have been distributed.

15. The system of claim 13 wherein the redundancy data comprises data from one or more of the other data portions.

16. The system of claim 13 wherein restoring the data set requires at least a minimum number that is less than all of data portions.

17. The system of claim 13 wherein at least one data portion is required in order to restore the data set.

18. The system of claim 17 wherein the at least one data portion comprises an authentication key.

19. The system of claim 17 wherein the at least one data portion is stored on a physical token device.

20. The system of claim 17 wherein the at least one data portion is encrypted with a workgroup key.

21. The system of claim 13 wherein the processor is further configured to encrypt the data portions using at least one encryption key.

22. The system of claim 21 wherein the encryption key is a public key, and wherein the data portions may be decrypted using a private key.

23. The system of claim 21 wherein at least one of the data portions is encrypted with a first encryption key and at least one other data portion is encrypted using a second encryption key.

24. The system of claim 21 wherein restoring the data set comprises restoring an encrypted data set from a subset of the encrypted data portions and decrypting the encrypted data set.