Systems and methods for securing data in motion

Patent metadata

Field	Value
Publication number	US-9213857-B2
Application number	US-201313866411-A
Country	US
Kind code	B2
Filing date	Apr 19, 2013
Priority date	Mar 31, 2010
Publication date	Dec 15, 2015
Grant date	Dec 15, 2015

Abstract

The systems and methods of the present invention provide a solution that makes data provably secure and accessible—addressing data security at the bit level—thereby eliminating the need for multiple perimeter hardware and software technologies. Data security is incorporated or weaved directly into the data at the bit level. The systems and methods of the present invention enable enterprise communities of interest to leverage a common enterprise infrastructure. Because security is already woven into the data, this common infrastructure can be used without compromising data security and access control. In some applications, data is authenticated, encrypted, and parsed or split into multiple shares prior to being sent to multiple locations, e.g., a private or public cloud. The data is hidden while in transit to the storage location, and is inaccessible to users who do not have the correct credentials for access.

First claim

What is claimed is:

1. A method for retrieving data shares corresponding to a secured file stored on a storage network, the method comprising:
processing, by a programmed hardware processor communicatively coupled to a storage network, a filename of a file using an authentication algorithm to obtain an authentication value associated with the file, wherein the authentication value obscures the filename and the file corresponds to data shares stored at one or more share locations of the storage network, each data share corresponding to a portion of the file, each data share having a share name that is based on the authentication value associated with the file;
searching the share locations on the storage network for the data shares by comparing share names of the data shares with the authentication value associated with the file; and
retrieving the data shares corresponding to the file based on the comparing.

2. The method of claim 1 , further comprising:
generating the data shares corresponding to the file using an information dispersal algorithm; and
storing the generated data shares on the share locations on the storage network.

3. The method of claim 1 , wherein the generated share names are substantially equal to the authentication value associated with the file.

4. The method of claim 1 , wherein generating the share names comprises appending a respective share number to the authentication value associated with the file.

5. The method of claim 1 , wherein the storage network includes one of a private cloud, a public cloud, a hybrid cloud, a removable storage device, and a mass storage device.

6. The method of claim 1 , wherein the authentication algorithm is an HMAC-SHA256 algorithm.

7. The method of claim 6 , wherein the additional information includes a number associated with a data share location.

8. The method of claim 6 , wherein the additional information includes a share number associated with one of the data shares.

9. The method of claim 1 , further comprising appending additional information to the filename of the file prior to the processing.

10. The method of claim 1 further comprising encrypting the filename, and wherein processing the filename comprises processing the encrypted filename using the authentication algorithm to obtain the authentication value associated with the file.

11. A system for retrieving data shares corresponding to a secured file stored on a storage network, the system comprising:
at least one non-transitory computer readable medium storing computer executable instructions; and
processing circuitry communicatively coupled to the at least one non-transitory computer readable medium and operable to execute the computer-readable instructions stored thereon, the processing circuitry configured to:
process a filename of a file using an authentication algorithm to obtain an authentication value associated with the file, wherein the authentication value obscures the filename and the file corresponds to data shares stored at one or more share locations of the storage network, each data share corresponding to a portion of the file, each data share having a share name that is based on the authentication value associated with the file;
search the share locations on the storage network for the data shares by comparing share names of the data shares with the authentication value associated with the file; and
retrieve the data shares corresponding to the file based on the comparing.

12. The system of claim 11 , wherein the processing circuitry is further configured to:
generate the data shares corresponding to the file using an information dispersal algorithm; and
store the generated data shares on the share locations on the storage network.

13. The system of claim 11 , wherein the generated share names are substantially equal to the authentication value associated with the file.

14. The method of claim 11 , wherein generating the share names comprises appending a respective share number to the authentication value associated with the file.

15. The system of claim 11 , wherein the storage network includes one of a private cloud, a public cloud, a hybrid cloud, a removable storage device, and a mass storage device.

16. The system of claim 11 , wherein the authentication algorithm is an HMAC-SHA256 algorithm.

17. The system of claim 11 , wherein the processing circuitry is further configured to append additional information to the filename of the file prior to the processing.

18. The system of claim 17 , wherein the additional information includes a number associated with a data share location.

19. The system of claim 17 , wherein the additional information includes a share number associated with one of the data shares.

20. The system of claim 11 , wherein the processing circuitry is further configured to encrypt the filename and to process the filename by processing the encrypted filename using the authentication algorithm to obtain the authentication value associated with the file.

Assignees

• Security First Corp

Inventors

• O'Hare Mark S
• Orsini Rick L

Classifications

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title

• G06F11/2094

  Redundant storage or storage space (G06F11/2056 takes precedence) · CPC title

• H04L67/1097

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title