Secure data parser method and system

• US 9,985,932 B2
• Filed: 05/10/2012
• Issued: 05/29/2018
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Davenport, Roger S., Winick, Steven
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/468,428
• Publication Number:
  US 20120221854A1
• Time in Patent Office: 2,210 Days
• Field of Search: 713167, 713168, 713193, 380277
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths.

Claims

1. A secure storage network comprising:

a plurality of physical storage devices storing thereon a plurality of shares; and

a secure storage system configured to;

present to a client device a virtual disk, the virtual disk comprising a directory mapped to the plurality of physical storage devices such that physical locations of the shares are hidden from the client device;

receive a request from the client device via the network to store data to the virtual disk,

receive the data via the network;

encrypt the data and split the data into the plurality of shares, wherein each of the plurality of shares comprises a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares includes data indicative of a key used to secure the data;

store the plurality of shares on the plurality of physical storage devices; and

receive a request from the client device to read second data from the virtual disk via the network, wherein the secure storage system responds by;

reading the second data from the virtual disk by reconstituting the second data from at least a portion of a second plurality of shares on the plurality of physical storage devices; and

sending the second data via the network to the client device.

2. The secure storage network of claim 1, wherein the secure storage system stores the data by distributing the data in the plurality of shares.

3. The secure storage network of claim 1, wherein the secure storage system includes a network attached storage module within an application layer.

4. The secure storage network of claim 3, wherein the network attached storage module communicates with the client device via the network.

5. The secure storage network of claim 3, wherein the virtual disk is presented to the application layer as a local disk.

15. The secure storage network of claim 1, wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

6. A secure storage system, the system comprising:

a memory;

a programmed hardware processor configured to;

present to a client device a virtual disk, the virtual disk comprising a directory mapped to a plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device;

receive a request from the client device via a network to store data to the virtual disk;

receive, in response to receiving the request, the data via the network;

encrypt the data and split the data into the plurality of shares, wherein each of the plurality of shares comprises a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares includes data indicative of a key used to secure the data;

store the plurality of shares on the plurality of physical storage devices;

receive a request from the client device to read second data from the virtual disk via the network, wherein the secure storage responds by;

reading the second data from the virtual disk by reconstituting the second data from at least a portion of a second plurality of shares on the plurality of physical storage devices; and

sending the second data to the client device via the network.

7. The secure storage system of claim 6, wherein:

the secure storage system includes an application layer capable of connecting to the client device using the network; and

the client device communicates with the application layer through the network.

8. The secure storage system of claim 6, wherein:

the programmed hardware processor is configured to store the data by distributing the data in the plurality of shares; and

the programmed hardware processor is further configured to perform a reconstitution operation to reconstitute the data from the plurality of shares.

9. The secure storage system of claim 7, wherein the virtual disk is presented to the application layer as a local disk.

16. The secure storage system of claim 6, wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

10. A method of securely storing data on a network having a client device connected to a secure storage system via a network, the method comprising:

presenting a virtual disk via the network, wherein the virtual disk comprises a directory mapped to a plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device;

receiving a request to write data to the virtual disk via the network; and

writing the data to the virtual disk by encrypting the data and splitting the data into the plurality of shares, wherein each of the plurality of shares comprises a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares include data indicative of a key used to secure the data;

storing the plurality of shares on the plurality of physical storage devices;

receiving a request to read second data from the virtual disk via the network;

reading the second data from the virtual disk by reconstituting the second data from at least a portion of a second plurality of shares; and

sending the second data to the client device via the network.

11. The method of claim 10, wherein splitting the data comprises distributing the data into the plurality of shares.

12. The method of claim 10, wherein data sent across the network is secured by splitting and encrypting operations.

17. The method of claim 10, wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

13. A method of securely accessing data the method comprising:

presenting, by processing circuitry, to a client device a virtual disk via a network, wherein the virtual disk comprises a directory mapped to a plurality of physical storage devices storing thereon a plurality of shares such that physical locations of the plurality of shares are hidden from the client device;

receiving a request from the client device to read data from the virtual disk via the network;

reading the data from the virtual disk by reconstituting the data from at least a portion of the plurality of shares, each of the plurality of shares comprising a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares include data indicative of a key used to secure the data;

receiving a request to write second data to the virtual disk via the network;

encrypting the data and splitting the second data into a second plurality of shares; and

storing the second plurality of shares on the plurality of physical storage devices.

14. The method of claim 13, wherein splitting the data comprises distributing the data into the plurality of shares.

18. The method of claim 13, wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.