SECURE DATA PARSER METHOD AND SYSTEM

• US 20120255035A1
• Filed: 05/10/2012
• Published: 10/04/2012
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Orsini, Rick L., O'Hare, Mark S., Davenport, Roger, Winick, Steven
• Granted Patent: US 9,009,848 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths.

Claims

1. A method of presenting data in a secure data storage network, the method comprising:

defining a group of users capable of accessing data stored in a secure data storage network, the group of users including a plurality of users desiring access to a common set of data;

associating the group of users with a workgroup key; and

upon identification of a client device as associated with a user from among the plurality of users in the group of users, presenting a virtual disk to the client device, the virtual disk associated with the workgroup key and a volume containing the common set of data, the volume including a plurality of shares stored on a plurality of physical storage devices.

2. The method of claim 1, wherein the virtual disk is presented to the client device as a unitary storage device.

3. The method of claim 1, further comprising presenting data stored in the volume to the client device, the data cryptographically split and stored across the plurality of shares.

4. The method of claim 1, further comprising receiving the workgroup key from a remote key server.

5. The method of claim 1, further comprising a plurality of groups of users, wherein each of the plurality of groups of users is associated with a different workgroup key.

6. The method of claim 5, wherein each of the users within the each of group of users has a common set of security rights.

7. A secure storage appliance comprising:

a data conversion module configured to split a block of data received from a client device and associated with a volume, the volume including a plurality of shares stored on a plurality of physical storage devices, the client device associated with a user included within a group of users including a plurality of users desiring access to a common set of data;

a presentation module configured to present a virtual disk to the client device, the virtual disk providing access to the volume via a workgroup key, the virtual disk providing access to the volume based on the user.

8. The secure storage appliance of claim 7, wherein the virtual disk is presented to the client device as a unitary storage device.

9. The secure storage appliance of claim 7, wherein the data conversion module is configured to cryptographically split the block of data into a plurality of secondary data blocks, each of the secondary data blocks mapped to one of the plurality of shares.

10. The secure storage appliance of claim 7, wherein the presentation module receives the workgroup key from a key server remote from the secure storage appliance.

11. The secure storage appliance of claim 7, further comprising a plurality of groups of users, wherein each of the plurality of groups of users is associated with a different workgroup key.

12. The secure storage appliance of claim 11, wherein each of the users within the each of group of users has a common set of security rights.

13. A secure data storage network comprising:

a plurality of client devices;

a plurality of storage systems managing a plurality of physical storage devices;

a secure storage appliance communicatively connected to the plurality of client devices and the plurality of storage systems, the secure storage appliance configured to execute program instructions to;

define a group of users capable of accessing data stored in a secure data storage network, the group of users including a plurality of users desiring access to a common set of data;

associate the group of users with a workgroup key; and

upon identification of a client device as associated with a user from among the plurality of users in the group of users from among the plurality of client devices, present a virtual disk to the client device, the virtual disk associated with the workgroup key and a volume containing the common set of data, the volume including a plurality of shares stored on the plurality of physical storage devices.

14. The secure data storage network of claim 13, further comprising a key server configured to manage the workgroup key.

15. The secure data storage network of claim 13, wherein the virtual disk is presented to the client device as a unitary storage device.

16. The secure data storage network of claim 13, wherein the secure storage appliance is further configured to cryptographically split data into a plurality of secondary data blocks, each of the secondary data blocks associated with one of the plurality of shares.

17. The secure data storage network of claim 13, further comprising a plurality of groups of users, wherein each of the plurality of groups of users is associated with a different workgroup key.

18. The secure data storage network of claim 17, wherein each of the users within the each of group of users has a common set of security rights.