Secure data parser method and system

• US 9,317,705 B2
• Filed: 12/19/2013
• Issued: 04/19/2016
• Est. Priority Date: 11/18/2005
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Davenport, Roger S., Winick, Steven
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/133,903
• Publication Number:
  US 20140108807A1
• Time in Patent Office: 852 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.

Claims

1. A method for securing data, the method comprising:

generating original secret information;

obtaining a plurality of public keys from unique certificate authorities;

dispersing the secret information into shares; and

encrypting the shares based, at least in part, on a plurality of encryption keys, at least one of the encryption keys being from the plurality of public keys, wherein the shares are restorable from at least a subset of the shares by recombining at least a threshold number of the shares.

2. The method of claim 1, further comprising:

recombining the at least a threshold number of the shares; and

transmitting data based on the recombined shares.

3. The method of claim 1, wherein encrypting the shares comprises encrypting each of the shares using a different one of the plurality of public keys.

4. The method of claim 1, further comprising encrypting each one of the shares of secret information based on a keywrap.

5. The method of claim 4, wherein the keywrap is based on a workgroup key.

6. The method of claim 1, wherein dispersing the secret information into shares comprises performing a cryptographic operation on the secret information and distributing the secret information in the shares.

7. The method of claim 1, wherein the shares comprise a substantially random distribution of the secret information.

8. The method of claim 1, wherein the shares comprise data units from the secret information that have been shuffled.

9. The method of claim 1 further comprising storing the shares at two or more different locations.

10. The method of claim 1 further comprising storing the shares on two or more different devices.

11. A system for securing data, the system comprising processing circuitry configured to:

generate original secret information;

obtain a plurality of public keys from unique certificate authorities;

disperse the secret information into shares; and

encrypt the shares based, at least in part, on a plurality of encryption keys, at least one of the encryption keys being from the plurality of public keys, wherein the shares are restorable from at least a subset of the shares by recombining at least a threshold number of the shares.

12. The system of claim 11, further comprising a second device comprising second processing circuitry configured to:

recombine the at least a threshold number of the shares; and

transmit data based on the recombined shares.

13. The system of claim 11, wherein the processing circuitry is configured to encrypt the shares by encrypting each of the shares using a different one of the plurality of public keys.

14. The system of claim 11, wherein the processing circuitry is further configured to encrypt each one of the shares of secret information based on a keywrap.

15. The system of claim 14, wherein the keywrap is based on a workgroup key.

16. The system of claim 11, wherein the processing circuitry is configured to disperse the secret information into shares by performing a cryptographic operation on the secret information and distributing the secret information in the shares.

17. The system of claim 11, wherein the shares comprise a substantially random distribution of the secret information.

18. The system of claim 11, wherein the shares comprise data units from the secret information that have been shuffled.

19. The system of claim 11, wherein the processing circuitry is further configured to store the shares at two or more different locations.

20. The system of claim 11, wherein the processing circuitry is further configured to store the shares on two or more different devices.