Secure data parser method and system

• US 9,338,140 B2
• Filed: 05/10/2012
• Issued: 05/10/2016
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Davenport, Roger S., Winick, Steven
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/468,383
• Publication Number:
  US 20120226904A1
• Time in Patent Office: 1,461 Days
• Field of Search: 713/167, 713/193, 713/153, 713/168, 726 5- 7, 726/28, 380/28, 380277-278, 72 5- 7
• US Class Current: 1/1
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths.

Claims

1. A secure storage network comprising:

a plurality of physical storage devices storing thereon a plurality of shares, the plurality of shares being associated with at least one session key used to secure a dataset; and

a secure storage system configured to;

present to a client device a virtual disk, the virtual disk comprising a directory mapped to the plurality of physical storage devices such that physical locations of the shares are hidden from the client device;

generate the plurality of shares for storage on the plurality of physical storage devices by performing a securing operation on the dataset received from the client device and distributing the dataset in the shares;

include with each of the plurality of shares data indicative of the at least one session key used to secure the dataset; and

reconstitute the dataset from at least a portion of the plurality of shares stored on the physical storage devices in response to a request from the client device for information in the dataset.

2. The secure storage network of claim 1, wherein the secure storage system is further configured to generate the plurality of shares by performing a cryptographic operation on the dataset.

3. The secure storage network of claim 1, further comprising a key management server configured to store workgroup keys.

4. The secure storage network of claim 1, wherein the secure storage system is further configured to provide access to the reconstituted dataset.

5. The secure storage network of claim 1, wherein the secure storage system is further configured to establish a secure connection between the client device and the secure storage system.

6. The secure storage network of claim 1, wherein the shares contain a substantially random distribution of the received dataset.

7. The secure storage network of claim 1, wherein the secure storage system is configured to reconstitute the received dataset from fewer than all of the shares.

8. The secure storage network of claim 1, wherein the secure storage system is configured to secure the dataset by encrypting the dataset using the at least one session key.

9. The secure storage network of claim 1, wherein the secure storage system is configured to secure the dataset by splitting the dataset using the at least one session key.

10. The secure storage network of claim 1, wherein the data indicative of the at least one session key comprises:

a portion of the at least one session key or data indicative of a portion of the at least one session key.

11. A secure storage system comprising:

a programmed hardware processor configured to;

present to a client device a virtual disk, the virtual disk comprising a directory mapped to a plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device;

generate the plurality of shares for storage on the plurality of physical storage devices by performing a securing operation on a dataset received from the client device and distributing the dataset in the shares;

include with each of the plurality of shares data indicative of at least one session key used to secure the dataset; and

reconstitute the dataset from at least a portion of the plurality of shares stored on the physical storage devices in response to a request from the client device for information in the dataset.

12. The secure storage system of claim 11, wherein the programmed hardware processor is further configured to generate the plurality of shares by performing a cryptographic operation on the dataset.

13. The secure storage system of claim 11, wherein the programmed hardware processor is further configured to provide access to the reconstituted dataset.

14. The secure storage system of claim 11, wherein the programmed hardware processor is further configured to establish a secure connection between the client device and the secure storage system.

15. The secure storage system of claim 11, wherein the shares contain a substantially random distribution of the received dataset.

16. The secure storage system of claim 11, wherein the programmed hardware processor is configured to reconstitute the received dataset from fewer than all of the shares.

17. The secure storage system of claim 11, wherein the data indicative of the at least one session key comprises:

a portion of the at least one session key or data indicative of a portion of the at least one session key.