Secure data parser method and system

• US 9,298,937 B2
• Filed: 08/29/2014
• Issued: 03/29/2016
• Est. Priority Date: 09/20/1999
• Status: Expired due to Term

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Van Zandt, John, Davenport, Roger S.
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US14/473,387
• Publication Number:
  US 20140372756A1
• Time in Patent Office: 578 Days
• Field of Search: 709/201, 709/231, 705/50, 705/51, 711/100, 711/163, 711/164, 713/150, 713/165, 713/187, 713/189, 726 2- 6, 726/18, 726/26, 726/30, 380/1, 380/200, 380/255, 380/268, 380/37, 380/42, 380 28- 30, 707/602, 707/609, 707/687, 707/693, 707/705, 707/726, 707/729, 707/756, 715/220, 715/222, 715/253, 715/272, 715/277, 715/723, 717/103, 717/143, 717/145, 717/148, 382/173, 382/232, 382/276, 382/282, 382/284, 382/305
• US Class Current: 1/1
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06Q 20/02 involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]
• CPC Class Codes: G06Q 20/04 Payment circuits
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3823 combining multiple encryption tools for a transaction
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G07F 7/1016 Devices or methods for securing the PIN and other transaction-data, e.g. by encryption arrangements for secret communication, see H04L9/00
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/68 : Special signature format, e.g. XML format
• CPC Class Codes: H04L 2209/805 : Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3231 : Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

The present invention provides a method and system for securing sensitive data from unauthorized access or use. The method and system of the present invention is useful in a wide variety of settings, including commercial settings generally available to the public which may be extremely large or small with respect to the number of users. The method and system of the present invention is also useful in a more private setting, such as with a corporation or governmental agency, as well as between corporation, governmental agencies or any other entity.

Claims

1. A method performed by a computer system for securing a data set, the method comprising:

(a) producing redundancy information based on information in the data set;

(b) producing a plurality of n shares using the data set, each of the n shares comprising at least some of the data in the data set;

(c) including at least some of the redundancy information in each of the plurality of n shares; and

(d) using a computer network coupled to the computer system to substantially randomly distribute at least some of the plurality of n shares to a corresponding plurality of physically dispersed storage locations;

wherein the data set is recoverable using at least a threshold number, less than n, of the n shares.

2. The method of claim 1 further comprising providing an encryption key for use in encrypting the data set to form an encrypted data set, wherein producing the plurality of n shares from the data set comprises producing the plurality of n shares from the encrypted data set.

3. The method of claim 1, wherein at least some of the plurality of dispersed storage locations are geographically remote from one another.

4. The method of claim 1, wherein the plurality of dispersed storage locations are associated with different internet protocol (“

IP”

) addresses.

5. The method of claim 1, wherein producing the plurality of n shares comprises causing the n shares to comprise a substantially random distribution of units of data of the data set.

6. The method of claim 1, wherein producing the plurality of n shares comprises substantially randomly distributing units of data of the data set into the plurality of n shares.

7. The method of claim 1, wherein producing the plurality of n shares comprises distributing units of data of the data set into the plurality of n shares and substantially randomly shuffling the units of data in the shares.

8. The method of claim 2, wherein the data set is encrypted by a server.

9. The method of claim 2, wherein the data set is encrypted by a client device.

10. The method of claim 1, wherein producing the plurality of n shares is performed by a server.

11. A system configured for securing a data set, the system comprising:

one or more processors configured to;

(a) produce redundancy information based on information in the data set;

(b) produce a plurality of n shares using the data set, wherein each of the n shares comprises at least some of the data set;

(c) include at least some of the redundancy information in each of the plurality of n shares; and

(d) substantially randomly distribute at least some of the plurality of n shares to a corresponding plurality of physically dispersed storage locations, wherein the data set is recoverable using at least a threshold number, less than n, of the n shares.

12. The system of claim 11, wherein the one or more processors is further configured to provide an encryption key for use in encrypting the data set to form an encrypted data set, and wherein the one or more processors is further configured to produce the plurality of n shares from the data set by producing the plurality of n shares from the encrypted data set.

13. The system of claim 11, wherein at least some of the plurality of dispersed storage locations are geographically remote from one another.

14. The system of claim 11, wherein the plurality of dispersed storage locations are associated with different internet protocol (“

IP”

) addresses.

15. The system of claim 11, wherein the one or more processors is further configured to produce the plurality of n shares by causing the n shares to comprise a substantially random distribution of units of data of the data set.

16. The system of claim 11, wherein the one or more processors is further configured to produce the plurality of n shares by substantially randomly distributing units of data of the data set into the plurality of n shares.

17. The system of claim 11, wherein the one or more processors is further configured to produce the plurality of n shares by distributing units of data of the data set into the plurality of n shares and substantially randomly shuffling the units of data in the shares.

18. The system of claim 12, wherein the data set is encrypted by a server.

19. The system of claim 12, wherein the data set is encrypted by a client device.

20. The system of claim 11, wherein producing the plurality of n shares is performed by a server.

21. A non-transitory computer readable medium comprising instructions that, when executed by one or more processors, cause a computer system to carry out a method for securing a data set, the method comprising:

(a) producing redundancy information based on information in the data set;

(b) producing a plurality of n shares using the data set, wherein each of the n shares comprises at least some of the data set;

(c) including at least some of the redundancy information in each of the plurality of n shares; and

(d) substantially randomly distributing at least some of the plurality of n shares to a corresponding plurality of physically dispersed storage locations;

wherein the data set is recoverable using at least a threshold number, less than n, of the n shares.

22. The non-transitory computer readable medium of claim 21, wherein at least some of the plurality of dispersed storage locations are geographically remote from one another.

23. The non-transitory computer readable medium of claim 21, the method further comprising providing an encryption key for use in encrypting the data set to form an encrypted data set, wherein producing the plurality of n shares from the data set comprises producing the plurality of n shares from the encrypted data set.

24. The non-transitory computer readable medium of claim 21, wherein the plurality of geographically dispersed locations are associated with different internet protocol (“

IP”

) addresses.

25. The non-transitory computer readable medium of claim 21, wherein producing the plurality of n shares comprises causing the n shares to comprise a substantially random distribution of units of data of the data set.

26. The non-transitory computer readable medium of claim 21, wherein producing the plurality of n shares comprises substantially randomly distributing units of data of the data set into the plurality of n shares.

27. The non-transitory computer readable medium of claim 21, wherein producing the plurality of n shares comprises distributing units of data of the data set into the plurality of n shares and substantially randomly shuffling the units of data in the shares.

28. The non-transitory computer readable medium of claim 22, wherein the data set is encrypted by a server.

29. The non-transitory computer readable medium of claim 22, wherein the data set is encrypted by a client device.

30. The non-transitory computer readable medium of claim 21, wherein producing the plurality of n shares is performed by a server.