Secure data parser method and system

Patent metadata

Field	Value
Publication number	US-9985932-B2
Application number	US-201213468428-A
Country	US
Kind code	B2
Filing date	May 10, 2012
Priority date	Oct 25, 2004
Publication date	May 29, 2018
Grant date	May 29, 2018

Abstract

A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data that may be communicated using multiple communications paths.

First claim

What is claimed is:

1. A secure storage network comprising:
a plurality of physical storage devices storing thereon a plurality of shares; and
a secure storage system configured to:
present to a client device a virtual disk, the virtual disk comprising a directory mapped to the plurality of physical storage devices such that physical locations of the shares are hidden from the client device;
receive a request from the client device via the network to store data to the virtual disk,
receive the data via the network;
encrypt the data and split the data into the plurality of shares, wherein each of the plurality of shares comprises a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares includes data indicative of a key used to secure the data;
store the plurality of shares on the plurality of physical storage devices; and
receive a request from the client device to read second data from the virtual disk via the network, wherein the secure storage system responds by:
reading the second data from the virtual disk by reconstituting the second data from at least a portion of a second plurality of shares on the plurality of physical storage devices; and
sending the second data via the network to the client device.

2. The secure storage network of claim 1 , wherein the secure storage system stores the data by distributing the data in the plurality of shares.

3. The secure storage network of claim 1 , wherein the secure storage system includes a network attached storage module within an application layer.

4. The secure storage network of claim 3 , wherein the network attached storage module communicates with the client device via the network.

5. The secure storage network of claim 3 , wherein the virtual disk is presented to the application layer as a local disk.

6. A secure storage system, the system comprising:
a memory;
a programmed hardware processor configured to:
present to a client device a virtual disk, the virtual disk comprising a directory mapped to a plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device;
receive a request from the client device via a network to store data to the virtual disk;
receive, in response to receiving the request, the data via the network;
encrypt the data and split the data into the plurality of shares, wherein each of the plurality of shares comprises a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares includes data indicative of a key used to secure the data;
store the plurality of shares on the plurality of physical storage devices;
receive a request from the client device to read second data from the virtual disk via the network, wherein the secure storage responds by:
reading the second data from the virtual disk by reconstituting the second data from at least a portion of a second plurality of shares on the plurality of physical storage devices; and
sending the second data to the client device via the network.

7. The secure storage system of claim 6 , wherein:
the secure storage system includes an application layer capable of connecting to the client device using the network; and
the client device communicates with the application layer through the network.

8. The secure storage system of claim 6 , wherein:
the programmed hardware processor is configured to store the data by distributing the data in the plurality of shares; and
the programmed hardware processor is further configured to perform a reconstitution operation to reconstitute the data from the plurality of shares.

9. The secure storage system of claim 7 , wherein the virtual disk is presented to the application layer as a local disk.

10. A method of securely storing data on a network having a client device connected to a secure storage system via a network, the method comprising:
presenting a virtual disk via the network, wherein the virtual disk comprises a directory mapped to a plurality of physical storage devices such that physical locations of a plurality of shares are hidden from the client device;
receiving a request to write data to the virtual disk via the network; and
writing the data to the virtual disk by encrypting the data and splitting the data into the plurality of shares, wherein each of the plurality of shares comprises a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares include data indicative of a key used to secure the data;
storing the plurality of shares on the plurality of physical storage devices;
receiving a request to read second data from the virtual disk via the network;
reading the second data from the virtual disk by reconstituting the second data from at least a portion of a second plurality of shares; and
sending the second data to the client device via the network.

11. The method of claim 10 , wherein splitting the data comprises distributing the data into the plurality of shares.

12. The method of claim 10 , wherein data sent across the network is secured by splitting and encrypting operations.

13. A method of securely accessing data the method comprising:
presenting, by processing circuitry, to a client device a virtual disk via a network, wherein the virtual disk comprises a directory mapped to a plurality of physical storage devices storing thereon a plurality of shares such that physical locations of the plurality of shares are hidden from the client device;
receiving a request from the client device to read data from the virtual disk via the network;
reading the data from the virtual disk by reconstituting the data from at least a portion of the plurality of shares, each of the plurality of shares comprising a subset of less than all of the data, and wherein splitting the data comprises rearranging the subset in each respective share from an original order, and wherein the plurality of shares include data indicative of a key used to secure the data;
receiving a request to write second data to the virtual disk via the network;
encrypting the data and splitting the second data into a second plurality of shares; and
storing the second plurality of shares on the plurality of physical storage devices.

14. The method of claim 13 , wherein splitting the data comprises distributing the data into the plurality of shares.

15. The secure storage network of claim 1 , wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

16. The secure storage system of claim 6 , wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

17. The method of claim 10 , wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

18. The method of claim 13 , wherein the subset is rearranged using at least one of a deterministic technique, a random technique, and pseudo-random technique.

Assignees

• Ohare Mark S
• Orsini Rick L
• Davenport Roger S
• Winick Steven
• Security First Corp

Inventors

• O'Hare Mark S
• Orsini Rick L
• Davenport Roger S
• Winick Steven

Classifications

• H04L67/108

  characterised by resources being split in blocks or fragments · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title