SECURE DATA PARSER METHOD AND SYSTEM

• US 20130283065A1
• Filed: 06/11/2013
• Published: 10/24/2013
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Orsini, Rick L., O'Hare, Mark S., Davenport, Roger S., Winick, Steven
• Granted Patent: US 9,871,770 B2
• Time in Patent Office: Days
• US Class Current: 713/193
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.

Claims

1. (canceled)

2. A method for securing a data set, the method comprising:

encrypting the data set using an encryption key;

generating at least two portions of data from the encrypted data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the encrypted data set;

generating encryption key information that is capable of being used to generate the encryption key, wherein the encryption key information is distributed among the at least two portions of data;

storing each of the at least two portions of data separately; and

restoring the encrypted data set from at least a subset of the at least two portions of data.

3. The method of claim 2 further comprising:

restoring the encryption key from the encryption key information from at least a subset of the at least two portions of data; and

restoring the data set from the encrypted data set and the encryption key.

4. The method of claim 2 wherein the encryption key information is generated according to a Shamir algorithm.

5. A method for securing a data set, the method comprising:

generating at least two portions of data from the data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the data set;

encrypting the at least two portions of data using the encryption key;

generating encryption key information that is capable of being used to generate the encryption key, wherein the encryption key information is distributed among the at least two portions of data;

storing the at least two encrypted portions of data separately from each other; and

restoring the data set using a subset of the at least two encrypted portion of data.

6. The method of claim 5 wherein restoring the data set comprises restoring the encryption key from the encryption key information from at least a subset of the at least two portions of data.

7. The method of claim 5 wherein the encryption key information is generated according to a Shamir algorithm.

8. A method for securing a data set, the method comprising:

encrypting the data set using an encryption key;

transforming the encryption key using an All or Nothing Transform into a transformed encryption key;

generating at least two portions of data from the encrypted data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the encrypted data set;

generating transformed encryption key information that is capable of being used to generate the transformed encryption key, wherein the transformed encryption key information is distributed among the at least two portions of data;

storing each of the at least two portions of data separately; and

restoring the encrypted data set from at least a subset of the at least two portions of data.

9. The method of claim 8 further comprising:

restoring the transformed encryption key from at least a subset of the at least two portions of data;

restoring the encryption key from the transformed encryption key; and

decrypting the encrypted data set.

10. A method for securing a data set, the method comprising:

generating at least two portions of data from the data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the data set;

encrypting each of the at least two portions of data using an encryption key into at least two portions of encrypted data;

transforming the encryption key using an All or Nothing Transform into a transformed encryption key;

generating transformed encryption key information that is capable of being used to generate the transformed encryption key, wherein the transformed encryption key information is distributed among the at least two portions of data;

storing each of the at least two portions of encrypted data separately; and

restoring the data set from at least a subset of the at least two portions of data.

11. The method of claim 10 wherein the restoring comprises:

restoring the transformed encryption key from at least a subset of the at least two portions data;

restoring the encryption key from the transformed encryption key; and

decrypting the at least a subset of the at least two portions of data.

12. A method for securing a data set, the method comprising:

generating, using a splitting key, at least two portions of data from the data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the data set;

transforming the splitting key using an All or Nothing Transform into a transformed splitting key;

generating transformed splitting key information that is capable of being used to generate the transformed splitting key, wherein the transformed splitting key information is distributed among the at least two portions of data;

storing each of the at least two portions of data separately; and

restoring the data set from at least a subset of the at least two portions of data.

13. The method of claim 12 wherein the restoring comprises:

restoring the transformed splitting key from at least a subset of the at least two portions of data; and

restoring the splitting key from the transformed splitting key.

14. A method for securing a data set, the method comprising:

encrypting the data set using an encryption key into an encrypted data set;

encrypting the encryption key;

generating at least two portions of data from the encrypted data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the encrypted data set;

storing each of the at least two portions of the encrypted data set separately;

restoring the encrypted data set from at

least a subset of the at least two portions of the

encrypted data set;

decrypting the encryption key; and

decrypting the data set from the encrypted data set using the encryption key.

15. The method of claim 14 wherein the encryption key is encrypted using a workgroup key.

16. A method for securing a data set, the method comprising:

generating at least two portions of data from the data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the data set;

encrypting the at least two portions of data using an encryption key into at least two encrypted portions of data;

encrypting the encryption key;

storing each of the at least two encrypted portions of data separately; and

restoring the data set from at least a subset of the at least two encrypted portions of data, the restoring comprising;

decrypting the encryption key, and

decrypting the at least a subset of the at least two encrypted portions of data using the encryption key.

17. The method of claim 16 wherein the encryption key is encrypted using a workgroup key.

18. A method for securing a data set, the method comprising:

generating, using a splitting key, at least two portions of data from the data set, wherein each of the at least two portions of data respectively contains a substantially random distribution of a respective subset of the data set;

encrypting the splitting key using an encryption key;

storing each of the at least two portions of the data set separately; and

restoring the data set from at least a subset of the at least two portions of the data set, the restoring comprising;

decrypting the splitting key, and

restoring, using the splitting key, the data set from the at least a subset of the at least two portions of data.

19. The method of claim 18 wherein the splitting key is encrypted using a workgroup key.