Secure data at rest

Patent metadata

Field	Value
Publication number	US-11501025-B2
Application number	US-202117206308-A
Country	US
Kind code	B2
Filing date	Mar 19, 2021
Priority date	Feb 15, 2019
Publication date	Nov 15, 2022
Grant date	Nov 15, 2022

Abstract

A method for providing and maintaining secure storage of target data includes, during a first time period in which a server provides a first mapping between user-specific cloaking sequence elements and hidden sequence elements, cloaking the target data using a first set of user-specific cloaking sequences and the first mapping, and storing the cloaked data in a persistent memory. The method further includes, during a later, second time period in which the server provides a different, second mapping between the user-specific cloaking sequence elements and the hidden sequence elements, re-cloaking the cloaked data using the first set of user-specific cloaking sequences and the second mapping, and storing the re-cloaked data in the persistent memory.

First claim

The invention claimed is:

1. A method for providing and maintaining secure storage of target data, the method comprising:
during a first time period in which a server provides a first mapping between user-specific cloaking sequence elements and hidden sequence elements, cloaking the target data using (i) a first set of one or more user-specific cloaking sequences and (ii) the first mapping;
storing the cloaked target data in a persistent memory;
during a second time period, occurring after the first time period, in which the server provides a different, second mapping between the user-specific cloaking sequence elements and the hidden sequence elements, re-cloaking the cloaked target data using (i) the first set of user-specific cloaking sequences and (ii) the second mapping; and
storing the re-cloaked target data in the persistent memory.

2. The method of claim 1 , wherein cloaking the target data includes applying the target data, and a first set of hidden sequences corresponding to the first mapping, as inputs to a cloaking algorithm.

3. The method of claim 2 , wherein re-cloaking the cloaked target data includes generating uncloaked target data at least by applying the cloaked target data and the first set of hidden sequences as inputs to an inverse of the cloaking algorithm.

4. The method of claim 3 , wherein re-cloaking the cloaked target data further includes applying the uncloaked target data, and a second set of hidden sequences corresponding to the second mapping, as inputs to the cloaking algorithm.

5. The method of claim 2 , wherein cloaking the target data includes:
generating once-cloaked target data at least by applying the target data and a first subset of the first set of hidden sequences as inputs to a first portion of the cloaking algorithm; and
generating twice-cloaked target data at least by applying the once-cloaked target data and a second subset of the first set of hidden sequences as inputs to a second portion of the cloaking algorithm.

6. The method of claim 1 , wherein either:
cloaking the target data includes cloaking the target data on a bit-by-bit basis, and re-cloaking the cloaked target data includes re-cloaking the cloaked target data on a bit-by-bit basis; or
cloaking the target data includes cloaking the target data on a byte-by-byte basis, and re-cloaking the cloaked target data includes re-cloaking the cloaked target data on a byte-by-byte basis.

7. The method of claim 1 , wherein the target data consists of data corresponding to a number of data structures within one or more structured data files, such that cloaking the target data results in cloaking only a portion of the structured data files.

8. The method of claim 7 , wherein cloaking the target data includes:
determining that a partial cloaking mode is currently selected; and
in response to determining that the partial cloaking mode is currently selected, cloaking only the portion of the structured data files.

9. The method of claim 1 , wherein:
the first set of user-specific cloaking sequences includes a primary user-specific cloaking sequence and a secondary user-specific cloaking sequence;
the first mapping corresponds to a first set of hidden sequences that includes a primary hidden sequence corresponding to the primary user-specific cloaking sequence and a secondary hidden sequence corresponding to the secondary user-specific cloaking sequence; and
the second mapping corresponds to a second set of hidden sequences that includes one or both of (i) a different primary hidden sequence corresponding to the primary user-specific cloaking sequence and (ii) a different secondary hidden sequence corresponding to the secondary user-specific cloaking sequence.

10. The method of claim 9 , wherein cloaking the target data includes:
using the primary hidden sequence to identify offset positions within the target data; and
using the secondary hidden sequence to perform one or more operations on the target data at the identified offset positions.

11. The method of claim 1 , further comprising:
after the second time period, receiving an indication that a user has changed the first set of user-specific cloaking sequences to a second set of one or more user-specific cloaking sequences; and
in response to receiving the indication, again re-cloaking the re-cloaked target data using (i) the second set of user-specific cloaking sequences and (ii) a third mapping between the user-specific cloaking sequence elements and the hidden sequence elements; and
storing the again re-cloaked target data in the persistent memory.

12. The method of claim 1 , wherein the first set of user-specific sequences includes one or more image sequences.

13. The method of claim 1 , further comprising:
receiving a master key entered by a user; and
in response to receiving the master key, providing the user with access to the re-cloaked target data stored in the persistent memory at least by uncloaking the re-cloaked target data.

14. The method of claim 1 , further comprising:
receiving a first split delegate key entered by a first person other than the user;
receiving a second split delegate key entered by a second person other than the user and the first person; and
in response to receiving at least the first split delegate key and the second split delegate key, providing access to the re-cloaked target data stored in the persistent memory at least by uncloaking the re-cloaked target data.

15. A non-transitory, computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:
during a first time period in which a server provides a first mapping between user-specific cloaking sequence elements and hidden sequence elements, cloak target data using (i) a first set of one or more user-specific cloaking sequences and (ii) the first mapping;
store the cloaked target data in a persistent memory;
during a second time period, occurring after the first time period, in which the server provides a different, second mapping between the user-specific cloaking sequence elements and the hidden sequence elements, re-cloak the cloaked target data using (i) the first set of user-specific cloaking sequences and (ii) the second mapping; and
store the re-cloaked target data in the persistent memory.

16. The non-transitory, computer-readable medium of claim 15 , wherein cloaking the target data includes applying the target data, and a first set of hidden sequences corresponding to the first mapping, as inputs to a cloaking algorithm.

17. The non-transitory, computer-readable medium of claim 16 , wherein re-cloaking the cloaked target data includes:
generating uncloaked target data at least by applying the cloaked target data and the first set of hidden sequences as inputs to an inverse of the cloaking algorithm; and
applying the uncloaked target data, and a second set of hidden sequences corresponding to the second mapping, as inputs to the cloaking algorithm.

18. The non-transitory, computer-readable medium of claim 16 , wherein cloaking the target data includes:
generating once-cloaked target data at least by applying the target data and a first subset of the first set of hidden sequences as inputs to a first portion of the cloaking algorithm; and
generating twice-cloaked target data at least by applying the once-cloaked target data and a second subset of the first set of hidden sequences as inputs to a second portion of the cloaking algorithm.

19. The non-transitory, computer-readable medium of cla

Assignees

• Charter Communications Operating Llc

Inventors

• Blackley James Anderson
• Carlson Jay Eric
• Hanrahan Michael David
• Pattan Bajeed
• Alcott Christopher Scott

Classifications

• G06F21/602

  Providing cryptographic facilities or services · CPC title

• G06F2212/402

  Encrypted data · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/2107

  File encryption · CPC title