Data security system and method

• US 7,721,345 B2
• Filed: 08/17/2006
• Issued: 05/18/2010
• Est. Priority Date: 11/13/2000
• Status: Active Grant

• Current Assignee: DigitalDoors, Inc.
• Original Assignee: DigitalDoors, Inc.
• Inventors: Nemzow, Martin A., Redlich, Ron M.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US11/465,388
• Publication Number:
  US 20070101436A1
• Time in Patent Office: 1,370 Days
• Field of Search: 726/27, 713/166, 713/193, 715/255
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2147 Locking files

Abstract

The method for securing data in a distributed computer system for security sensitive content includes granularly extracting sensitive content, per security level, from remainder data. The security sensitive content is classified into security levels, each having a security clearance. The extracted data is remotely stored in extract stores. The controlled release of extracted data occurs with the appropriate security clearances. Maps of storage sites and filters for repetitive extraction may be employed, stored and then sometimes destroyed. The data input, extracted data and remainder data may be deleted from the originating source. Encryption, unique to each security level, enhances security (preferably during transfers, storage and retrieval). Full or partial reconstruction of the data is permitted with security clearances. An information processing system is encompassed.

Claims

1. A method of securing data in a distributed computer system having security sensitive content represented by one or more security sensitive words, characters, images, data elements or data objects therein, said security sensitive content having a plurality of security levels, each security level having an associated security clearance, said distributed computer system having a plurality of computers therein and a plurality of extract data stores for respective ones of said plurality of security levels operatively coupled over a communications network comprising:

granularly extracting said security sensitive content from a data input to obtain extracted data for each corresponding security level and remainder data;

storing said extracted data for each corresponding security level in the respective extract store and storing said remainder data in said distributed computer system;

controlling release of corresponding extracted data from said respective extract stores with said associated security clearances for corresponding security levels; and

,

fully or partially reconstructing all or part of said data input with said corresponding extracted data and remainder data after the controlling release thereof.

2. A method as claimed in claim 1 wherein granularly extracting said security sensitive content includes extracting other granular aspects of the data input and storing said other granular aspects with said extracted data for each corresponding security level.

3. A method as claimed in claim 2 wherein said other granular aspects of the data input include additional words, characters, images, data elements or data objects identified with said security sensitive content and the identification thereof.

4. A method as claimed in claim 1 wherein storing includes transmission of said extracted data over said communications network.

5. A method as claimed in claim 4 including encrypting said extracted data during the transmission corresponding to the respective security level of said extracted data.

6. A method as claimed in claim 5 including encrypting said corresponding extracted data during the controlled release thereof, the controlled release encryption corresponding to the respective security level of said corresponding extracted data.

7. A method as claimed in claim 6 including requesting input of one or more security clearances for one or more of said plurality of security levels during one or more of said granular extracting, storing, controlled release, and full or partial reconstructing.

8. A method as claimed in claim 1 including requesting input of one or more security clearances for one or more of said plurality of security levels during one or more of said granular extracting, storing, controlled release, and full or partial reconstructing.

9. A method as claimed in claim 7 including requesting input of one or more security clearances for one or more of said plurality of security levels during one or more of said granular extracting, storing, controlled release, and full or partial reconstructing.

10. A method as claimed in claim 1 including error checking said extracted data during one or more of said storing, controlled release, and full or partial reconstructing.

11. A method as claimed in claim 9 including error checking said extracted data during one or more of said storing, controlled release, and full or partial reconstructing.

12. A method as claimed in claim 1 wherein the distributed computer system includes a remainder data store and wherein storing of said remainder data occurs thereat.

13. A method as claimed in claim 11 wherein the distributed computer system includes a remainder data store and wherein storing of said remainder data occurs thereat.

14. A method as claimed in claim 1 wherein said storing is a physically decentralized storing of said extracted data.

15. A method as claimed in claim 1 wherein said granular extracting occurs in real time with respect to operations on said data input.

16. A method as claimed in claim 13 wherein said granular extracting occurs in real time with respect to operations on said data input.

17. A method as claimed in claim 16 wherein said data input is a data packet and the granular extracting occurs in real time with respect to said data packet.

18. A method as claimed in claim 1 wherein said granular extracting includes an analysis of content within said data input for said security sensitive content.

19. A method as claimed in claim 17 wherein said granular extracting includes an analysis of content within said data input for said security sensitive content.

20. A method as claimed in claim 1 including compiling one of an audit log, timestamp indicator and access permission indicator for said controlled release of extracted data.

21. A method as claimed in claim 19 including compiling one of an audit log, timestamp indicator and access permission indicator for said controlled release of extracted data.

22. A method as claimed in claim 1 wherein said granular extracting, storing, controlled release, and full or partial reconstructing is automated with a risk management system part of said distributed computer system.

23. A method as claimed in claim 1 wherein said granular extracting includes parsing said extracted data corresponding to the respective security level.

24. A method as claimed in claim 21 wherein said granular extracting includes parsing said extracted data corresponding to the respective security level.

25. A method as claimed in claim 1 including permitting manual extracting, automatic extracting or a combination of manual and automatic extracting of said security sensitive content.

26. A method as claimed in claim 24 including permitting manual extracting, automatic extracting or a combination of manual and automatic extracting of said security sensitive content.

27. A method as claimed in claim 1 including controlling release of extracted data to defined parties at defined times within defined modes.

28. A method as claimed in claim 26 including controlling release of extracted data to defined parties at defined times within defined modes.

29. A method as claimed in claim 26 wherein storing of said remainder data on one of a fixed memory and a removable memory.

30. A method as claimed in claim 1 including storing a map or locating data for said respective extract stores.

31. A method as claimed in claim 30 wherein the storing of said map or locating data occurs on one of a fixed memory and a removable memory.

32. A method as claimed in claim 26 including storing a map or locating data for said respective extract stores on one of a fixed memory and a removable memory.

33. A method as claimed in claim 32 including

establishing a plurality of filters corresponding to groups of security sensitive content for respective ones of said plurality of security levels and using a respective filter during the extraction of security sensitive content for said each corresponding security level;

storing said plurality of filters in said distributed computer system in one of fixed memory and removable memory;

encrypting and decrypting said plurality of filters for respective ones of said plurality of security levels; and

one of destroying or storing the filter after extraction.

34. A method as claimed in claim 33 including deleting said data input after storing.

35. A method as claimed in claim 34 including deleting said map after full reconstruction.

36. An information processing system for securing data in a data input having security sensitive content represented by one or more security sensitive words, characters, images, data elements or data objects therein, said security sensitive content having a plurality of security levels, each security level having an associated security clearance, the information processing system for securing data deployed in a distributed computer system with a plurality of computers and a plurality of extract data stores for respective ones of said plurality of security levels operatively coupled over a communications network comprising:

a granular filter processing said data input and separating therefrom said security sensitive content as extracted data for each corresponding security level, leaving remainder data;

means for storing said extracted data for each corresponding security level in the respective extract store and storing said remainder data in said distributed computer system;

an access controller for permitting controlled release of said respective extract data from said corresponding extract stores for respective security levels with said associated security clearances; and

,

a compiler, coupled to said access controller, for permitting full or partial reconstruction of said data via said respective extract stores and remainder data.

37. An information processing system as claimed in claim 36 including means for extracting, with sad filter, other granular aspects of the data input and storing, with said means for storing, said other granular aspects with said extracted data.

38. An information processing system as claimed in claim 37 wherein said other granular aspects include additional words, characters, images, data elements or data objects.

39. An information processing system as claimed in claim 38 including a data transfer device with an encryptor coupled to said means for storing enabling encryption for said extracted data corresponding to said respective ones of said plurality of security levels.

40. An information processing system as claimed in claim 39 including a further data transfer device with a further encryptor coupled to said access controller for enabling encryption during access to said extracted data, said further encryptor enabling encryption corresponding to said respective ones of said plurality of security levels.

41. An information processing system as claimed in claim 40 wherein means for storing directs storage of said remainder data at one of said plurality of computers in said computer system on one of a fixed memory and a removable memory at said client computer.

42. An information processing system as claimed in claim 36 including a data error checker, coupled to one or both of said means for storing and said access controller, for checking data storage and retrieval.

43. An information processing system as claimed in claim 41 including a data error checker, coupled to one or both of said means for storing and said access controller, for checking data storage and retrieval.

44. An information processing system as claimed in claim 36 including a auditor, coupled to said access controller, for logging access to said extract stores.

45. An information processing system as claimed in claim 37 including a auditor, coupled to said access controller, for logging access to said extract stores.