Secure data parser method and system

• US 20070160198A1
• Filed: 11/20/2006
• Published: 07/12/2007
• Est. Priority Date: 11/18/2005
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Davenport, Roger, O'Hare, Mark, Orsini, Rick, Winick, Steven
• Granted Patent: US 8,009,830 B2
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.

Claims

1. A method for securing a transmission of data blocks in a data stream, the method comprising:

encrypting each data block in the data stream with an encryption key;

distributing portions of the encryption key into at least two share headers;

distributing data units from the encrypted data blocks into at least two data shares, wherein each of the at least two data shares respectfully contains a substantially random distribution of a respective subset of the data units; and

transmitting the at least two data shares and the at least two share headers to a remote location over at least one communications path, whereby the data stream is restorable from at least two data shares of the at least two data shares and from at least two share headers of the at least two share headers.

2. The method of claim 1 further comprising:

generating integrity information for each encrypted data block in the data stream; and

transmitting the integrity information to the remote location.

3. The method of claim 2 wherein the integrity information is transmitted with the at least two data shares.

4. The method of claim 2 wherein the integrity information is selected from the group consisting of a hash, a MAC signature, and a digital signature.

5. The method of claim 1 wherein distributing portions of the encryption key comprises distributing portions of the encryption key using a secret sharing algorithm.

6. The method of claim 5 wherein the secret sharing algorithm is selected from the group consisting of Shamir and Blakely.

7. The method of claim 1 wherein transmitting the at least two data shares and the at least two share headers comprises transmitting the at least two data shares and the at least two share headers on a single communications path in a serial transmission.

8. The method of claim 1 wherein transmitting the at least two data shares and the at least two share headers comprises transmitting the at least two data shares and the at least two share headers over multiple communications paths in parallel.

9. The method of claim 1 wherein the transmitting is performed using a file-sharing application.

10. The method of claim 1 wherein the transmitting is performed using a voting or polling application.

11. The method of claim 1 wherein the transmitting is performed using a voice over IP (VoIP) application.

12. The method of claim 1 wherein the data blocks are selected from the group consisting of network data packets, network voice packets, and file system data blocks.

13. The method of claim 1 further comprising:

appending redundancy information to the at least two data shares; and

transmitting the redundancy information to the remote location.

14. The method of claim 1 further comprising encrypting the encryption key with a workgroup key before distributing the encryption key.

15. The method of claim 14 wherein encrypting the encryption key with the workgroup key comprises encrypting the encryption key using an AES key wrap function.