Distribution of encrypted information in multiple locations

• US 9,679,161 B2
• Filed: 04/09/2014
• Issued: 06/13/2017
• Est. Priority Date: 04/25/2013
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: GlobalFoundries, Inc.
• Inventors: Della Corte, Gianluca, Sgro, Antonio M., Donatelli, Alessandro
• Primary Examiner(s): Bayou, Yonas
• Application Number:
  US14/248,814
• Publication Number:
  US 20140325212A1
• Time in Patent Office: 1,161 Days
• CPC Class Codes: G06F 21/6272 by registering files or documents with a third party
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0618 Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation
• CPC Class Codes: H04L 9/0637 Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method, system, and/or computer program product stores information in a distributed data-processing environment. The method comprises: encrypting, by one or more processors, a piece of information; splitting, by one or more processors, the encrypted piece of information into at least one first encrypted block and at least one second encrypted block, at least part of said at least one first encrypted block being required for decrypting said at least one second encrypted block; distributing, by one or more processors, said at least one first encrypted block for storing in at least one first location; and distributing, by one or more processors, said at least one second encrypted block for storing in at least one second location.

Claims

1. A method for storing information in a distributed data-processing environment, the method comprising:

encrypting, by one or more processors, a piece of information;

splitting, by one or more processors, the encrypted piece of information into at least one first encrypted block and at least one second encrypted block, at least part of said at least one first encrypted block being required for decrypting said at least one second encrypted block;

distributing, by one or more processors, said at least one first encrypted block for storing in at least one first location;

distributing, by one or more processors, said at least one second encrypted block for storing in at least one second location;

retrieving, by one or more processors, said at least one first encrypted block and said least one second encrypted block from said at least one first location and from said at least one second location, respectively;

reconstructing, by one or more processors, the encrypted piece of information from said at least one first encrypted block and said at least one second encrypted block;

decrypting, by one or more processors, the encrypted piece of information to restore the piece of information; and

intercepting, by one or more processors, a retrieve command for retrieving the piece of information, wherein said retrieving, reconstructing and decrypting are performed in response to the interception of the retrieve command.

2. The method according to claim 1, wherein said encrypting a piece of information comprises:

applying, by one or more processors, a block cipher to the piece of information by;

splitting the piece of information into a sequence of a plurality of fixed-length further blocks, and

encrypting each further block with a common encryption key by applying an encryption to a first one of the further blocks in the sequence being updated according to an initialization vector and to each next one of the further blocks in the sequence, different from the first further block, being updated according to a previous one of the further blocks in the sequence.

3. The method according to claim 2, wherein said encrypting a piece of information comprises:

applying, by one or more processors, a Propagating Cipher-encrypted Block Chaining (PCBC) cipher to the piece of information.

4. The method according to claim 2, wherein said at least one first encrypted block is an encrypted version of said first further block.

5. The method according to claim 1, wherein said distributing said at least one first encrypted block and said distributing said at least one second encrypted block comprises:

distributing, by one or more processors, said at least one first encrypted block for storing locally in a private environment; and

distributing, by one or more processors, said at least one second encrypted block for storing remotely by at least one service provider.

6. The method according to claim 5, wherein said distributing said at least one second encrypted block comprises:

uploading, by one or more processors, said at least one second encrypted block onto a cloud infrastructure.

7. The method according to claim 1, wherein said encrypting and splitting are executed on a computing machine of a user, and wherein said storing said at least one first encrypted block in at least one first location comprises:

writing, by one or more processors, said at least one first encrypted block into a mass-memory of the computing machine.

8. The method according to claim 1, further comprising:

intercepting, by one or more processors, a store command for storing the piece of information, wherein said encrypting, splitting, distributing said at least one first encrypted block, and distributing said at least one second encrypted block are performed in response to the interception of the store command.

9. The method according to claim 1, wherein said at least one second encrypted block is a plurality of encrypted blocks, where said distributing said at least one second encrypted block comprises:

distributing, by one or more processors, the encrypted blocks from the second encrypted block to a plurality of locations.

10. The method according to claim 9, further comprising:

receiving, by one or more processors, a security parameter; and

determining, by one or more processors, a number of the second locations, ranging from 1 to a total number of the second locations being available, according to the security parameter.

11. The method of claim 1, wherein the at least on one first encrypted block is a first cipher block of a sequence of cipher blocks.

12. The method of claim 1, wherein the at least on one first encrypted block is a first cipher block of a sequence of cipher blocks, and wherein the method includes storing by the one or more processors, the at least one first encrypted block in a location having a higher level of security than a location for storing the at least one second encrypted block.

13. A computer program product for storing information in a distributed data-processing environment, the computer program product comprising a computer readable storage device having program code embodied therewith, the program code readable and executable by a processor to perform a method comprising:

encrypting a piece of information;

splitting the encrypted piece of information into at least one first encrypted block and at least one second encrypted block, at least part of said at least one first encrypted block being required for decrypting said at least one second encrypted block;

distributing said at least one first encrypted block for storing in at least one first location; and

distributing said at least one second encrypted block for storing in at least one second location;

retrieving said at least one first encrypted block and said least one second encrypted block from said at least one first location and from said at least one second location, respectively;

reconstructing the encrypted piece of information from said at least one first encrypted block and said at least one second encrypted block;

decrypting the encrypted piece of information to restore the piece of information; and

intercepting a retrieve command for retrieving the piece of information, wherein said retrieving, reconstructing and decrypting are performed in response to the interception of the retrieve command.

14. The computer program product according to claim 13, wherein said encrypting a piece of information comprises:

applying a block cipher to the piece of information by;

splitting the piece of information into a sequence of a plurality of fixed-length further blocks, and

encrypting each further block with a common encryption key by applying an encryption to a first one of the further blocks in the sequence being updated according to an initialization vector and to each next one of the further blocks in the sequence, different from the first further block, being updated according to a previous one of the further blocks in the sequence.

15. The computer program product according to claim 14, wherein said encrypting a piece of information comprises:

applying a Propagating Cipher-encrypted Block Chaining (PCBC) cipher to the piece of information.

16. The computer program product according to claim 14, wherein said at least one first encrypted block is an encrypted version of said first further block.

17. A computer system comprising:

a processor, a computer readable memory, and a computer readable storage medium;

first program instructions to encrypt a piece of information;

second program instructions to split the encrypted piece of information into at least one first encrypted block and at least one second encrypted block, at least part of said at least one first encrypted block being required for decrypting said at least one second encrypted block;

third program instructions to distribute said at least one first encrypted block for storing in at least one first location; and

fourth program instructions to distribute said at least one second encrypted block for storing in at least one second location;

fifth program instructions to retrieve said at least one first encrypted block and said least one second encrypted block from said at least one first location and from said at least one second location, respectively;

sixth program instructions to reconstruct the encrypted piece of information from said at least one first encrypted block and said at least one second encrypted block;

seventh program instructions to decrypt the encrypted piece of information to restore the piece of information; and

eighth program instructions to intercept a retrieve command for retrieving the piece of information, wherein said retrieving, reconstructing and decrypting are performed in response to the interception of the retrieve command; and

wherein

the first, second, third, fourth, fifth, sixth, seventh and eighth program instructions are stored on the computer readable storage medium and executed by the processor via the computer readable memory.

18. The computer system according to claim 17, further comprising:

ninth program instructions to apply a block cipher to the piece of information by;

splitting the piece of information into a sequence of a plurality of fixed-length further blocks, and

encrypting each further block with a common encryption key by applying an encryption to a first one of the further blocks in the sequence being updated according to an initialization vector and to each next one of the further blocks in the sequence, different from the first further block, being updated according to a previous one of the further blocks in the sequence; and

wherein the ninth program instructions are stored on the computer readable storage medium and executed by the processor via the computer readable memory.