Secure data parser method and system

• US 9,009,848 B2
• Filed: 05/10/2012
• Issued: 04/14/2015
• Est. Priority Date: 10/25/2004
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: Orsini, Rick L., O'Hare, Mark S., Davenport, Roger, Winick, Steven
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/468,605
• Publication Number:
  US 20120255035A1
• Time in Patent Office: 1,069 Days
• Field of Search: 726/28, 713/153, 713/168, 380/28, 380/277
• US Class Current: 726/28
• CPC Class Codes: G06F 11/1092 Rebuilding, e.g. when physically replacing a failing disk
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 67/108 characterised by resources being split in blocks or fragments
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths.

Claims

1. A method of presenting data in a secure data storage network, the method comprising:

defining a user group capable of accessing data stored in a secure data storage network, the user group including a plurality of users desiring access to a common set of data;

associating the user group with a workgroup key; and

upon determining that a client device is associated with a user from the user group, presenting, using a hardware processor, a virtual disk to the client device, wherein;

the common set of data is secured using the workgroup key,

the virtual disk comprises a directory mapped to a plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device, and

each of the plurality of shares comprises data units from the common set of data that have been shuffled.

2. The method of claim 1, wherein the virtual disk is presented to the client device as a unitary storage device.

3. The method of claim 1, further comprising presenting data stored on the plurality of physical storage devices to the client device, and wherein the shares are generated by performing a cryptographic operation on the data and distributing the data in the plurality of shares.

4. The method of claim 1, further comprising receiving the workgroup key from a remote key server.

5. The method of claim 1, further comprising defining a plurality of user groups, wherein each of the plurality of user groups is associated with a different workgroup key.

6. The method of claim 5, wherein each of the users within each of the plurality of user groups has a common set of security rights.

19. The method of claim 1, wherein the plurality of shares contain a substantially random distribution of the common set of data.

7. A secure storage system comprising:

processing circuitry configured to;

split data set received from a client device into a plurality of shares, the client device associated with a user of a user group including a plurality of users desiring access to the data set, wherein each of the plurality of shares comprises data units from data set that have been shuffled;

present a virtual disk to the client device, the virtual disk comprising a directory mapped to a plurality of physical storage devices such that physical locations of the plurality of shares are hidden from the client device,

wherein the data set is secured using a workgroup key.

8. The secure storage system of claim 7, wherein the virtual disk is presented to the client device as a unitary storage device.

9. The secure storage system of claim 7, wherein the processing circuitry is configured to generate a plurality of shares by performing a cryptographic operation on the data set and distributing the data set in the shares, each of the shares stored on one of the plurality of physical storage devices.

10. The secure storage system of claim 7, wherein the processing circuitry receives the workgroup key from a key server remote from the secure storage system.

11. The secure storage system of claim 7, further comprising a plurality of user groups, wherein each of the plurality of user groups is associated with a different workgroup key.

12. The secure storage system of claim 11, wherein each of the users within each of the plurality of user groups has a common set of security rights.

20. The secure storage system of claim 7, wherein the plurality of shares contain a substantially random distribution of the common set of data.

13. A secure data storage network comprising:

a plurality of storage systems managing a plurality of physical storage devices;

a secure storage system communicatively connected to the plurality of storage systems, the secure storage system configured to execute program instructions to;

define a user group capable of accessing data stored in a secure data storage network, the user group including a plurality of users desiring access to a common set of data;

associate the user group with a workgroup key; and

upon determining that a client device is associated with a user from the user group, present a virtual disk to the client device, wherein;

the common set of data is secured using the workgroup key,

the virtual disk comprises a directory mapped to the plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device, and

each of the plurality of shares comprises data units from the common set of data that have been shuffled.

14. The secure data storage network of claim 13, further comprising a key server configured to manage the workgroup key.

15. The secure data storage network of claim 13, wherein the virtual disk is presented to the client device as a unitary storage device.

16. The secure data storage network of claim 13, wherein the secure storage system is further configured to generate a plurality of shares by performing a cryptographic operation on the common set of data and distributing the common set of data in the plurality of shares.

17. The secure data storage network of claim 13, further comprising a plurality of user groups, wherein each of the plurality of user groups is associated with a different workgroup key.

18. The secure data storage network of claim 17, wherein each of the users within each of the plurality of user groups has a common set of security rights.

21. The secure data storage network of claim 13, wherein the plurality of shares contain a substantially random distribution of the common set of data.