Systems and methods for securing data in the cloud

• US 8,654,971 B2
• Filed: 05/19/2010
• Issued: 02/18/2014
• Est. Priority Date: 05/19/2009
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Martin, Don, Orsini, Rick L
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US12/783,276
• Publication Number:
  US 20100299313A1
• Time in Patent Office: 1,371 Days
• Field of Search: 380/33, 709/228, 370/208, 705/7
• US Class Current: 380/33
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing data in and communicating data with cloud computing resources. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security.

Claims

1. A method for securing data using a cloud computing storage network, the method comprising:

generating at a first system at least two portions of data from a data set;

communicating the at least two portions of data from the first system over a communications network to the cloud computing storage network, wherein the cloud computing storage network includes at least two respectively remote storage devices; and

storing the at least two portions of data within the cloud computing storage network on the at least two networked storage devices, whereby the data set is restorable from at least a subset of the at least two portions of data by recombining data from the subset of the at least two portions of data.

2. The method of claim 1, wherein generating the at least two portions of data and communicating the at least two portions of data to the cloud computing network is substantially transparent to the first system.

3. The method of claim 1, wherein the communications network comprises an unsecured public network.

4. The method of claim 1, wherein the data set is accessible at the first system.

5. The method of claim 1, wherein the data set is accessible by any system within a community of interest associated with the first system.

6. The method of claim 1, further comprising generating a virtual machine image, whereby the virtual machine image is operable to access the data set within the cloud computing storage network.

7. The method of claim 6, further comprising transmitting the virtual machine image to a second system, wherein the second system is operable to access the data set within the cloud computing storage network.

8. The method of claim 1, wherein the data set comprises a data service and wherein secure access to the data service is provided over the cloud computing storage network.

9. The method of claim 1, wherein the cloud computing storage network further comprises at least one resilient networked storage device.

10. The method of claim 9, wherein a data portion stored on the at least one resilient networked storage device is regenerated from other networked storage devices.

11. A method for securing data using an orthogonal frequency-division multiplexing (OFDM) network, the method comprising:

generating, by a processor at a first location, at least two portions of data from a data set; and

communicating from the first location to a second location the at least two portions of data over at least two OFDM channels, wherein different portions of data are communicated over different OFDM channels, whereby the data set is restorable at the second location from at least a subset of the at least two portions of data by recombining data from the subset of the at least two portions of data received over the at least two OFDM channels.

12. The method of claim 11, wherein the OFDM network comprises a broadband wireless network.

13. The method of claim 11, wherein the OFDM network comprises a broadband powerline network.

14. An apparatus for securing data in a cloud computing storage network, the apparatus comprising:

a first system operable to;

generate at least two portions of data from a data set;

communicate the at least two portions of data over a communications network to the cloud computing storage network, wherein the cloud computing storage network includes at least two respectively remote storage devices; and

store the at least two portions of data within the cloud computing storage network on the at least two storage devices, whereby the data set is restorable from at least a subset of the at least two portions of data by recombining data from the subset of the at least two portions of data.

15. The apparatus of claim 14, wherein the first system is further operable to generate the at least two portions of data and to communicate the at least two portions of data to the cloud computing network in a substantially transparent manner.

16. The apparatus of claim 14, wherein the communications network comprises an unsecured public network.

17. The apparatus of claim 14, wherein the first system is further operable to access the data set within the cloud computing network.

18. The apparatus of claim 14, wherein the data set is accessible by any user system within a community of interest associated with the first system.

19. The apparatus of claim 14, wherein the first system is further operable to generate a virtual machine image, whereby the virtual machine image is operable to access the data set within the cloud computing storage network.

20. The apparatus of claim 19, wherein the first system is further operable to transmit the virtual machine image to a second system, wherein the second system is operable to access the data set within the cloud computing storage network.

21. The apparatus of claim 14, wherein the data set comprises a data service and wherein the first system is further operable to securely access to the data service over the cloud computing storage network.

22. The apparatus of claim 14, wherein the cloud computing storage network further comprises at least one resilient networked storage device.

23. The apparatus of claim 22, wherein the first system is further operable to regenerate a data portion stored on the at least one resilient networked storage device from other networked storage device.

24. An apparatus for securing data in an orthogonal frequency-division multiplexing (OFDM) network, the apparatus comprising:

a secure data parser operable to generate at a first location at least two portions of data from a data set; and

an OFDM transceiver operable to communicate from the first location to a second location the at least two portions of data over at least two OFDM channels, wherein different portions of data are communicated over different OFDM channels, whereby the data set is restorable at the second location from at least a subset of the at least two portions of data by recombining data from the subset of the at least two portions of data received over the at least two OFDM channels.

25. The apparatus of claim 24, wherein the OFDM network comprises a broadband wireless network.

26. The apparatus of claim 24, wherein the OFDM network comprises a broadband powerline network.