Secure data parser method and system

• US 20040049687A1
• Filed: 06/11/2003
• Published: 03/11/2004
• Est. Priority Date: 09/20/1999
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: OʼHare, Mark S., VanZandt, John, Orsini, Rick L., Davenport, Roger S.
• Granted Patent: US 7,391,865 B2
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/68 : Special signature format, e.g. XML format
• CPC Class Codes: H04L 2209/805 : Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present invention provides a method and system for securing sensitive data from unauthorized access or use. The method and system of the present invention is useful in a wide variety of settings, including commercial settings generally available to the public which may be extremely large or small with respect to the number of users. The method and system of the present invention is also useful in a more private setting, such as with a corporation or governmental agency, as well as between corporation, governmental agencies or any other entity.

Claims

1. A method, comprising:

a) encrypting a data set to provide an encrypted data set;

b) separating the encrypted data set into two or more portions of data;

c) encrypting one or more of the portions of data from step b); and

d) storing the encrypted portions of data from step c) at one or more locations on one or more data depositories.

2. The method of claim 1, wherein the separating of step b) separates the encrypted data set into four or more portions of data.

3. The method of claim 2, wherein step b) and step c) are repeated one or more times before the storing of step d), and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm in step a).

4. The method of claim 1, wherein the storing of step d) is on different locations of the same data depository.

5. The method of claim 1, wherein the storing of step d) is on different data depositories.

6. The method of claim 1, wherein the storing of step d) is on different data depositories in different geographic locations.

7. The method of claim 1, wherein the encryption of step c) provides an encryption key, and wherein the encryption key is stored in step d) together with the data encrypted using said encryption key in step c).

8. The method of claim 1, wherein the encryption of step c) provides an encryption key, and wherein the encryption key is stored in step d) separately from the data encrypted using said encryption key in step c).

9. The method of claim 1, wherein the data set of step a) comprises data selected from the group consisting of encryption key data, text, video, audio, images, biometrics, and digital data.

56. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 1.

57. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 1, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

10. A method, comprising:

a) separating a data set into two or more portions of data;

b) encrypting one or more of the portions of data of step a); and

c) storing the one or more encrypted portions of data of step b) on one or more locations on one or more data depository.

11. The method of claim 10, wherein the separating of step a) separates the data set into four or more portions of data.

12. The method of claim 10, wherein step a) and step b) are repeated one or more times before the storing of step c), and, optionally, wherein the encryption of step b) is repeated using a different encryption algorithm.

13. The method of claim 10, wherein the storing of step c) is on different locations of the same data depository.

14. The method of claim 10, wherein the storing of step c) is on different data depositories.

15. The method of claim 10, wherein the storing of step c) is on different data depositories in different geographic locations.

16. The method of claim 10, wherein the encryption of step b) provides an encryption key, and wherein the encryption key is stored in step c) together with the data encrypted using said encryption key in step b).

17. The method of claim 10, wherein the encryption of step b) provides an encryption key, and wherein the encryption key is stored in step c) separately from the data encrypted using said encryption key in step b).

18. The method of claim 10, wherein the data set of step a) comprises data selected from a group consisting of encryption key data, text, video, audio, images, biometrics, and digital data.

19. The method of claim 10, wherein the encryption of step b) is performed using an encryption algorithm selected from a group consisting of RS1, RC4™

, and OTP.

58. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 10.

59. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 10, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

20. A method, comprising:

a) generating an encryption master key and encrypting a data set using the encryption master key;

b) separating each of the encryption master key and the encrypted data set into two or more portions according to one separating pattern and appending an encryption master key portion to an encrypted data set portion;

c) generating one or more encryption keys for the portions of data from step b) and encrypting said portions of data using said encryption key; and

d) storing the encrypted portions of data from step c) and the encryption keys from step c) on at least one data depository.

21. The method of claim 20, wherein the storing of encrypted data portions in step d) is on two or more different locations of one data depository.

22. The method of claim 20, wherein the storing of encrypted data portions in step d) is on two or more data depositories.

23. The method of claim 20, wherein the storing of the encryption keys in step d) is on two or more different locations of one data depository.

24. The method of claim 20, wherein the storing of the encryption keys of step d) is on two or more different data depositories.

25. The method of claim 20, wherein the encryption keys generated in step c) is stored according to step d) with the encrypted data of step c) on different locations on one or more data depository.

26. The method of claim 20, wherein the encryption key generated in step c) is stored according to step d) on a different data depository from the encrypted data of step c) that was encrypted using said encryption key.

27. The method of claim 20, wherein the encrypted data of step b) is separated into four or more portions.

28. The method of claim 20, wherein the encryption master key of step b) is separated into four or more portions.

29. The method of claim 20, wherein step b) and step c) are repeated one or more times, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

60. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 20.

61. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 20, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

30. A method, comprising:

a) generating an encryption master key and encrypting a data set using the encryption master key;

b) separating each of the encryption master key and the encrypted data set into two or more portions according to one separating pattern and storing the encryption master key portions on one or more locations of one or more data depositories;

c) generating one or more encryption keys for the encrypted data set portions of step b) and encrypting said portions of data using said encryption key; and

d) storing the encrypted portions from step c) and the encryption keys from step c) on at least one location of at least one data depository, wherein said data depositories are different from the data depositories of step b).

31. The method of claim 30, wherein the storing of encrypted data portions in step d) is on two or more different locations of one data depository.

32. The method of claim 30, wherein the storing of encrypted data portions in step d) is on two or more data depositories.

33. The method of claim 30, wherein the storing of the encryption keys in step d) is on two or more different locations of one data depository.

34. The method of claim 30, wherein the storing of the encryption keys of step d) is on two or more different data depositories.

35. The method of claim 30, wherein the encryption keys generated in step c) and used to encrypt a data set in step c) is stored according to step d) with the encrypted data set that was encrypted using the encryption key on one or more data depositories.

36. The method of claim 30, wherein the encryption key generated in step c) and used to encrypt a data set in step c) is stored according to step d) in a different location on one or more data depositories from the encrypted data set that was encrypted using the encryption key.

37. The method of claim 30, wherein the encrypted data of step b) is separated into four or more portions.

38. The method of claim 30, wherein the encryption master key of step b) is separated into four or more portions.

39. The method of claim 30, wherein step b) and step c) are repeated one or more times, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

62. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 30.

63. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 30, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

40. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module.

41. The system of claim 40, wherein said data splitting module separates data into two or more portions.

42. The system of claim 40, wherein said cryptographic handling module operates on data prior to of after said data is operated on by the data splitting module, and performs encryption of the data.

43. The system of claim 40, wherein said data assembling module operates on data that has been operated on by the data splitting module or the cryptographic module to restore said data to its original form.

44. A method, comprising:

a) encrypting a data set to provide an encrypted data set;

b) separating the encrypted data set into two or more portions of data according to the contents of a unique key value;

c) encrypting one or more of the portions of data from step b); and

d) storing the encrypted portions of data from step c) at one or more locations on one or more data depositories.

45. The method of claim 44, wherein the separating of step b) separates the encrypted data set into four or more portions of data according to the contents of a unique key value.

46. The method of claim 45, wherein step b) and step c) are repeated one or more times before the storing of step d), and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm in step a).

47. The method of claim 44, wherein the storing of step d) is on different locations of the same data depository.

48. The method of claim 44, wherein the storing of step d) is on different data depositories.

49. The method of claim 44, wherein the storing of step d) is on different data depositories in different geographic locations.

50. The method of claim 44, wherein the encryption of step c) provides an encryption key, and wherein the encryption key is stored in step d) together with the data encrypted using said encryption key in step c).

51. The method of claim 44, wherein the encryption of step c) provides an encryption key, and wherein the encryption key is stored in step d) separately from the data encrypted using said encryption key in step c).

52. The method of claim 44, wherein the data set of step a) comprises data selected from the group consisting of encryption key data, text, video, audio, images, biometrics, and digital data.

53. The method of claim 44 wherein said portions of data comprise one or more bits of data.

64. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 44.

65. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 44, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).

54. A method, comprising:

a) splitting a data set into N number of data units;

b) selecting X number of shares for data unit storage;

c) generating N number of random numbers that correspond to the X number of shares;

d) assigning the random numbers to the data units; and

e) storing the data units and the random number in the share that corresponds to the random number.

55. The method of claim 54, wherein said data units comprise at least one bit.

66. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 54.

67. A system, comprising:

a) a data splitting module;

b) a cryptographic handling module; and

c) a data assembling module,

wherein said system performs the method of claim 54, and optionally, wherein the encrypting of step c) is performed using an encryption algorithm that is different from the encryption algorithm used in step a).