Systems and methods for providing file level security

• US 10,452,857 B2
• Filed: 11/09/2015
• Issued: 10/22/2019
• Est. Priority Date: 11/07/2014
• Status: Active Grant

• Current Assignee: Cyber Reliant Corporation
• Original Assignee: Cyber Reliant Corporation
• Inventors: Taldo, Michael D., Suit, John Michael
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Farooqui, Quazi
• Application Number:
  US14/935,834
• Publication Number:
  US 20160148013A1
• Time in Patent Office: 1,443 Days
• Field of Search: 713165, 713150, 713166, 713167
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Storage end points, whether they are local, remote, network, or cloud, such as DROPBOX and APPLE, present security issues for the general public and corporate consumers. These storage end points are not always encrypted. Even when the end user does perform encryption, the drawback to normal implementations is that the entirety of the file, the file key, and the key store are encrypted and stored in a single location. Computers can be hacked and encryption can be broken when given access and time. Disclosed is a system and method that enhances file level security by shredding the file, file pointers, and key store into parts, allowing the parts to be stored in different storage end points specified by the user.

Claims

1. A computer-implemented method of providing file level security, the method comprising:

providing a network-based file storage and retrieval system comprising a server computer having at least one processor and memory storing instructions;

providing at said server computer access to a plurality of data storage locations in data communication with said server computer, said data storage locations comprising at least two of cloud data storage, local data storage, network data storage, and removable data storage;

receiving at said server computer as input a user instruction designating a number of file shreds into which a data file is to be shredded, wherein said number of file shreds is selected by said user;

receiving at said server computer as input a user instruction designating a plurality of said data storage locations to which said designated number of shreds are to be copied, wherein said data storage locations are selected by said user;

receiving at said server computer as input a user selection of a target upload file;

causing said processor to shred said target upload file into said user designated number of file shreds;

causing said processor to add non-operational bits of data to each said file shred;

causing said processor to encrypt each said file shred; and

causing said processor to copy said encrypted file shreds from said server computer to said user designated plurality of said data storage locations, and to maintain said encrypted file shreds in said user designated plurality of said data storage locations until receipt at said server computer as input a user instruction to download said encrypted file shreds to reform said data file.

2. The method of claim 1, further comprising:

receiving at said server computer as input a user selection of a target download file that is stored as encrypted file shreds in said plurality of said data storage locations;

receiving at said server computer said encrypted file shreds of said target download file;

causing said processor to decrypt said encrypted file shreds of said target download file;

causing said processor to remove non-operational bits of data from each file shred of said target download file;

causing said processor to reform said target download file from said file shreds of said target download file; and

causing said processor to present said reformed target download file to a user.

3. The method of claim 2, further comprising the step of causing said processor to identify a collection of data storage locations among said plurality of data storage locations that together contain sufficient file shreds that may be combined to form a functional reconstructed file, and causing said processor to establish data communication with each of said data storage locations within said collection.

4. The method of claim 2, wherein said step of causing said processor to reform said target download file further comprises appending each decrypted shred of said target download file to previously downloaded shreds of said target download file.

5. The method of claim 4, further comprising the step of causing said processor to place a reformed target download file into a working directory accessible by said user.

6. The method of claim 2, further comprising:

receiving at said server computer as input a user selection of a target share file and a target share device;

causing said processor to download said target share file into a working directory accessible by said user;

causing said processor to re-encrypt said target share file with a shared key associated with said target share device; and

uploading from said server computer said target share file.

7. The method of claim 6, further comprising:

causing said processor to confirm that said user selection of a target share device identifies a device that is contained on a list of approved devices maintained by said system.

8. The method of claim 6, further comprising:

causing said processor to confirm that said user selection of a target share file identifies a file that has previously been uploaded.

9. The method of claim 6, further comprising:

prior to receiving a user selection of a target share file and a target share device, causing said processor to present a list of devices available for secure file sharing to said user.

10. The method of claim 6, further comprising:

causing said server computer to update a relying party trust with information relating to said uploaded target share file.

11. The method of claim 1, wherein said step of causing said processor to encrypt each file shred further comprises applying an encryption process to each said file shred that is particularly selected on the basis of the data storage location to which said file shred is to be uploaded.

12. The method of claim 1, wherein said step of causing said processor to copy said encrypted file shreds further comprises:

causing said processor to establish data communication with said user designated plurality of data storage locations; and

causing said processor to copy at least some of said encrypted file shreds among said user designated plurality of data storage locations.

13. The method of claim 12, wherein said step of causing said processor to copy at least some of said encrypted file shreds further comprises copying at least as many encrypted file shreds as are necessary to enable subsequent file reconstruction to form a usable file.

14. The method of claim 12, wherein said step of causing said processor to copy at least some of said encrypted file shreds further comprises storing said at least some of said encrypted file shreds in more than one independent data storage location.

15. The method of claim 1, further comprising:

causing said processor to establish data communication with a relying party trust;

receiving at said server computer from a user data store keystore and configuration file shreds;

causing said processor to decrypt and recombine said keystore and configuration file shreds; and

causing said processor to generate a display of (i) file and share information available in user-defined locations, and (ii) available application functions.

16. The method of claim 15, wherein said available application functions further comprise uploading a file, downloading a file, sharing a file, opening a file, and deleting a file.