SYSTEMS AND METHODS FOR PROVIDING FILE LEVEL SECURITY

• US 20160148013A1
• Filed: 11/09/2015
• Published: 05/26/2016
• Est. Priority Date: 11/07/2014
• Status: Active Grant

• Current Assignee: Cyber Reliant Corporation
• Original Assignee: Cyber Reliant Corporation
• Inventors: Taldo, Michael D., Suit, John Michael
• Granted Patent: US 10,452,857 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Storage end points, whether they are local, remote, network, or cloud, such as DROPBOX and APPLE, present security issues for the general public and corporate consumers. These storage end points are not always encrypted. Even when the end user does perform encryption, the drawback to normal implementations is that the entirety of the file, the file key, and the key store are encrypted and stored in a single location. Computers can be hacked and encryption can be broken when given access and time. Disclosed is a system and method that enhances file level security by shredding the file, file pointers, and key store into parts, allowing the parts to be stored in different storage end points specified by the user.

Claims

1. A computer-implemented method of providing file level security, the method comprising:

at a network-based file storage and retrieval system including at least one processor and memory storing instructions, the at least one processor executing the instructions to perform the operations of;

authenticating a user to said system;

causing said processor to operate in a secure file uploading mode, including;

receiving a user selection of a target upload file;

shredding said target upload file into a plurality of file shreds;

adding non-operational bits of data to each file shred;

encrypting each file shred; and

separately storing said encrypted file shreds in a plurality of data storage locations.

11. The method of claim 1, wherein said step of encrypting each file shred further comprises applying an encryption process to each said file shred that is particularly selected on the basis of the data storage location to which said file shred is to be uploaded.

12. The method of claim 1, wherein said step of separately storing said encrypted file shreds in a plurality of data storage locations further comprises:

establishing data communication with a plurality of data storage locations; and

copying at least some of said encrypted file shreds among said plurality of data storage locations.

13. The method of claim 12, wherein said step of copying at least some of said encrypted file shreds further comprises copying at least as many encrypted file shreds as are necessary to enable subsequent file reconstruction to form a usable file.

14. The method of claim 12, wherein said step of copying at least some of said encrypted file shreds further comprises storing said at least some of said encrypted file shreds in more than one independent data storage location.

15. The method of claim 1, wherein said step of authenticating a user to said system further comprises:

establishing data communication with a relying party trust;

retrieving from a user data store keystore and configuration file shreds;

decrypting and recombining said keystore and configuration file shreds; and

generating a display of (i) file and share information available in user-defined locations, and (ii) available application functions.

16. The method of claim 15, wherein said available application functions further comprise uploading a file, downloading a file, sharing a file, opening a file, and deleting a file.

2. The method of claim 2, further comprising:

causing said processor to operate in a secure file downloading mode, including;

receiving a user selection of a target download file;

establishing data communication with a plurality of data storage locations containing separately stored encrypted file shreds of said target download file;

decrypting said separately stored encrypted file shreds of said target download file;

removing non-operational bits of data from each file shred of said target download file;

reforming said target download file from said file shreds of said target download file; and

presenting said reformed target download file to a user.

3. The method of claim 2, wherein said step of establishing data communication further comprises identifying a collection of data storage locations that together contain sufficient file shreds that may be combined to form a functional reconstructed file, and establishing said data communication with each of said data storage locations within said collection.

4. The method of claim 2, wherein said step of reforming said target download file further comprises appending each decrypted shred of said target download file to previously downloaded shreds of said target download file.

5. The method of claim 4, further comprising the step of placing a reformed target download file into a working directory accessible by said user.

6. The method of claim 2, further comprising:

causing said processor to operate in a secure file sharing mode, including;

receiving a user selection of a target share file and a target share device;

downloading said target share file into a working directory accessible by said user using said secure file downloading mode;

re-encrypting said target share file with a shared key associated with said target share device; and

uploading said target share file using said secure file uploading mode.

7. The method of claim 6, wherein causing said processor to operate in said secure file sharing mode further comprises confirming that said user selection of a target share device identifies a device that is contained on a list of approved devices maintained by said system.

8. The method of claim 6, wherein causing said processor to operate in said secure file sharing mode further comprises confirming that said user selection of a target share file identifies a file that has previously been uploaded using said secure file uploading mode.

9. The method of claim 6, wherein causing said processor to operate in said secure file sharing mode further comprises prior to said step of receiving a user selection of a target share file and a target share device, presenting a list of devices available for secure file sharing to said user.

10. The method of claim 6, wherein causing said processor to operate in said secure file sharing mode further comprises updating a relying party trust with information relating to said uploaded target share file.