Systems and methods for securing data in motion

• US 8,745,372 B2
• Filed: 11/24/2010
• Issued: 06/03/2014
• Est. Priority Date: 11/25/2009
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Orsini, Rick L., O'Hare, Mark S., Bono, Stephen C., Landau, Gabriel D., Nielson, Seth James
• Primary Examiner(s): Nalven, Andrew
• Assistant Examiner(s): MALINOWSKI, WALTER J
• Application Number:
  US12/953,877
• Publication Number:
  US 20110202755A1
• Time in Patent Office: 1,287 Days
• Field of Search: 380/37, 380/42, 380/255, 705/76, 713/168, 713/186, 713/150, 713/156, 713/175, 713/151, 713/155, 726/15
• US Class Current: 713/151
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

Systems and methods are provided for distributing trust among a set of certificate authorities. One approach provides methods and systems in which the secure data parser is used to distribute trust in a set of certificate authorities during initial negotiation of a connection between two devices. Another approach provides methods and systems in which the secure data parser is used to disperse packets of data into shares. A set of tunnels is established within a communication channel using a set of certificate authorities, keys developed during the establishment of the tunnels are used to encrypt shares of data, and the shares of data are transmitted through each of the tunnels.

Claims

1. A method for securing data in motion comprising original data packets, the method comprising:

establishing a secure communication channel;

establishing a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities;

dispersing each one of the original data packets into a plurality of shares based on multi-factored secret sharing;

encrypting each of the plurality of shares using a key associated with the establishment of a different one of the secure communication tunnels; and

transmitting the plurality of encrypted shares over one or more of the plurality of secure communication tunnels.

2. The method of claim 1, wherein transmitting the plurality of encrypted shares comprises transmitting each encrypted share on a secure communication tunnel established using a key used to encrypt the respective encrypted share.

3. The method of claim 1, further comprising:

receiving the plurality of encrypted shares, each on a respective one of the plurality of secure communication tunnels;

decrypting each of the plurality of encrypted shares based on the key associated with the establishment of the respective one of the plurality of secure communication tunnels; and

restoring the set of original data packets based on the multi-factored secret sharing.

4. The method of claim 1, further comprising generating a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of root certificate authorities, and wherein the plurality of unique certificate authorities comprises the set of root certificate authorities.

5. The method of claim 1, further comprising generating a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities, and wherein the plurality of unique certificate authorities comprises the set of minor certificate authorities.

6. The method of claim 1, wherein each of the plurality of secure communication tunnels is established over a different physical transport medium.

7. The method of claim 6, wherein at least one of the physical transport mediums experiences a network failure, the method further comprising restoring the original data packets without a loss of data integrity.

8. The method of claim 7, wherein at least one of physical transport mediums experiences a network failure, wherein a portion of the plurality of shares is designated for transmission over the failed physical transport medium, and wherein at least one of the physical transport mediums is operational, the method further comprising:

establishing additional secure communication tunnels within the at least one operational physical transport medium; and

transmitting the portion of the plurality of shares designated for transmission over the at least one of the set of failed physical transport mediums over the additional secure communication tunnels.

9. The method of claim 1, wherein the associations between the tunnels and the unique certificate authorities are dynamic.

10. The method of claim 1, wherein dispersing each one of the original data packets into a plurality of shares further comprises splitting each one of the original data packets into a plurality of shares based on an M of N cryptosplit.

11. The method of claim 10, wherein the plurality of shares are restorable from at least a subset of the shares by recombining at least a quorum of the shares.

12. The method of claim 1, wherein the plurality of secure communication tunnels are established based on the Transport Layer Security protocol.

13. The method of claim 1, further comprising:

generating a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities; and

encrypting each one of the set of shares based on a certificate issued by a unique minor certificate authority of the certificate authority hierarchy.

14. The method of claim 1, wherein transmitting the plurality of encrypted shares comprises transmitting two or more of the plurality of shares over a same one of the plurality of secure communication tunnels.

15. The method of claim 1, wherein transmitting the plurality of encrypted shares comprises transmitting each of the plurality of shares over one of the plurality of secure communication tunnels, wherein each share is transmitted over a secure communication tunnel that is different than the tunnel corresponding to the key used to encrypt the respective share.

16. The method of claim 1, wherein transmitting the plurality of encrypted shares comprises transmitting each of the plurality of encrypted shares over a different one of the plurality of secure communication tunnels.

17. The method of claim 1, wherein transmitting the plurality of encrypted shares comprises transmitting the plurality of shares over the plurality of secure communication tunnels, wherein at least two of the plurality of encrypted shares are transmitted over the same tunnel.

18. The method of claim 1, wherein establishing a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities comprises establishing the plurality of secure communication tunnels using a different one of the certificate authorities to establish each of the secure communication tunnels.

19. The method of claim 1, wherein establishing a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities comprises establishing the plurality of secure communication tunnels using a same one of the certificate to establish at least two, but less than all, of the plurality of secure communication tunnels.

20. A system for securing data in motion comprising original data packets, the system comprising a first device comprising processing circuitry configured to:

establish a secure communication channel;

establish a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities;

disperse each one of the original data packets into a plurality of shares based on multi-factored secret sharing;

encrypt each of the plurality of shares using a key associated with the establishment of a different one of the secure communication tunnels; and

transmit the plurality of encrypted shares over one or more of the plurality of secure communication tunnels.

21. The system of claim 20, wherein the processing circuitry is configured to transmit the plurality of encrypted shares by transmitting each encrypted share on a secure communication tunnel established using a key used to encrypt the respective share.

22. The system of claim 20, further comprising a second device comprising processing circuitry further configured to:

receive the plurality of encrypted shares, each on a respective one of the plurality of secure communication tunnels;

decrypt each of the plurality of encrypted shares based on the key associated with the establishment of the respective one of the plurality of secure communication tunnels; and

restore the set of original data packets based on the multi-factored secret sharing.

23. The system of claim 20, wherein the processing circuitry is further configured to generate a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of root certificate authorities, and wherein the plurality of unique certificate authorities comprises the set of root certificate authorities.

24. The system of claim 20, wherein the processing circuitry is further configured to generate a certificate authority hierarchy, wherein the certificate authority hierarchy comprises a set of minor certificate authorities, and wherein the plurality of unique certificate authorities comprises the set of minor certificate authorities.

25. The system of claim 20, wherein each of the plurality of secure communication tunnels is established over a different physical transport medium.

26. The system of claim 25, wherein at least one of the physical transport mediums experiences a network failure, the method further comprising restoring the original data packets without a loss of data integrity.

27. The system of claim 26, wherein at least one of physical transport mediums experiences a network failure, wherein a portion of the plurality of shares is designated for transmission over the failed physical transport medium, and wherein at least one of the physical transport mediums is operational, the processing circuitry further configured to:

establish additional secure communication tunnels within the at least one operational physical transport medium; and

transmit the portion of the plurality of shares designated for transmission over the at least one of the set of failed physical transport mediums over the additional secure communication tunnels.

28. The system of claim 20, wherein the associations between the tunnels and the unique certificate authorities are dynamic.

29. The system of claim 20, wherein the processing circuitry is further configured to disperse each one of the original data packets into a plurality of shares by splitting each one of the original data packets into a plurality of shares based on an M of N cryptosplit.

30. The system of claim 29, wherein the plurality of shares are restorable from at least a subset of the shares by recombining at least a quorum of the shares.

31. The system of claim 20, wherein the plurality of secure communication tunnels are established based on the Transport Layer Security protocol.

32. The system of claim 20, wherein the processing circuitry is further configured to transmit the plurality of encrypted shares by transmitting the plurality of shares over one of the plurality of secure communication tunnels.

33. The system of claim 20, wherein the processing circuitry is further configured to transmit the plurality of encrypted shares by transmitting each of the plurality of shares over one of the plurality of secure communication tunnels, wherein each share is transmitted over a secure communication tunnel that is different than the tunnel corresponding to the key used to encrypt the respective share.

34. The system of claim 20, wherein the processing circuitry is further configured to transmit the plurality of encrypted shares by transmitting each of the plurality of shares over a different one of the plurality of secure communication tunnels.

35. The system of claim 20, wherein the processing circuitry is further configured to transmit the plurality of encrypted shares by transmitting the plurality of shares over the plurality of secure communication tunnels, wherein at least two of the plurality of encrypted shares are transmitted over the same tunnel.

36. The system of claim 20, wherein the processing circuitry is further configured to establish a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities by establishing the plurality of secure communication tunnels using a different one of the certificate authorities to establish each of the secure communication tunnels.

37. The system of claim 20, wherein the processing circuitry is further configured to establish a plurality of secure communication tunnels within the secure communication channel, wherein the plurality of secure communication tunnels is established using certificates issued by a plurality of unique certificate authorities by establishing the plurality of secure communication tunnels using a same one of the certificate to establish at least two, but less than all, of the plurality of secure communication tunnels.