Secure distributed storage of documents containing restricted information, via the use of keysets

1. A computer-implemented method for securely storing one or more documents, the documents containing restricted information, the restricted information not to be disclosed at a minimally secure location, the method comprising software executing on a hardware computer system to execute the steps of:

segmenting fields in the documents into critical sections, sub-critical sections, and non-critical sections; each critical section containing data that is defined by information security rules as individually corresponding to restricted information, each sub-critical section containing data that is defined by information security rules as individually not corresponding to restricted information but collectively with other sub-critical sections as corresponding to restricted information, and each non-critical section containing data that is defined by information security rules as not corresponding to restricted information; wherein segmenting the fields in the documents further depends on a frequency of occurrence of data contained in the fields;

effecting storage of the critical sections at secure location(s), the critical sections stored in a manner that associates critical sections with first keys;

effecting storage of the sub-critical and the non-critical sections at minimally secure location(s), said sections stored in a manner that associates said sections with second keys;

wherein the first and second keys form keysets that can be used to reassemble the sections of a document.

2. The method of claim 1 wherein the secure location(s) store the critical sections of a document and also store reference keys that reference those sub-critical and non-critical sections stored at minimally secure location(s).

3. The method of claim 2 wherein a minimally secure location stores the reference key for those sub-critical and non-critical sections stored at that minimally secure location.

4. The method of claim 1 , further comprising:

changing the keyset, if a minimally secure location is compromised.

5. The method of claim 1 , further comprising:

periodically changing the keyset.

6. The method of claim 1 , further comprising:

using an encryption algorithm to change the keysets.

7. The method of claim 1 , further comprising:

hashing the sub-critical and/or non-critical sections stored at a minimally secure location;

comparing said hashes to previous hashes of the sub-critical and/or non-critical sections, wherein the previous hashes are stored at a location different from the minimally secure location.

8. A system comprising a hardware computer that includes a non-transitory computer readable medium having computer program code embodied thereon for securely storing one or more documents, the documents containing restricted information, the restricted information not to be disclosed at a minimally secure location, the computer program code comprising:

a document-dividing module, for segmenting fields in the documents into critical sections, sub-critical sections, and non-critical sections; each critical section containing data that is defined by information security rules as individually corresponding to restricted information, each sub-critical section containing data that is defined by information security rules as individually not corresponding to restricted information but collectively with other sub-critical sections as corresponding to restricted information, and each non-critical section containing data that is defined by information security rules as not corresponding to restricted information; wherein segmenting the fields in the documents further depends on a frequency of occurrence of data contained in the fields;

a storage module for effecting storage of the critical sections at secure location(s), the critical sections stored in a manner that associates critical sections with first keys;

the storage module further for effecting storage of the sub-critical and the non-critical sections at minimally secure location(s), said sections stored in a manner that associates said sections with second keys; and

wherein the first and second keys form keysets that can be used to reassemble the sections of a document.

9. A computer program product for use with a computer, the computer program product comprising a non-transitory tangible computer readable medium having a computer program code embodied therein for securely storing one or more documents, the documents containing restricted information, the restricted information not to be disclosed at a minimally secure location, the computer program code performing the steps of:

segmenting fields in the documents into critical sections, sub-critical sections, and non-critical sections; each critical section containing data that is defined by information security rules as individually corresponding to restricted information, each sub-critical section containing data that is defined by information security rules as individually not corresponding to restricted information but collectively with other sub-critical sections as corresponding to restricted information, and each non-critical section containing data that is defined by information security rules as not corresponding to restricted information; wherein segmenting the fields in the documents further depends on a frequency of occurrence of data contained in the fields;

effecting storage of the critical sections at secure location(s), the critical sections stored in a manner that associates critical sections with first keys;

effecting storage of the sub-critical and the non-critical sections at minimally secure location(s), said sections stored in a manner that associates said sections with second keys;

wherein the first and second keys form keysets that can be used to reassemble the sections of a document.

10. The computer program product of claim 9 wherein the secure location(s) store the critical sections of a document and also store reference keys that reference those sub-critical and non-critical sections stored at minimally secure location(s).

11. The computer product of claim 10 wherein a minimally secure location stores the reference key for those sub-critical and/or non-critical sections stored at that minimally secure location.

12. The computer program product of claim 9 , wherein the computer program code further performs the step of:

changing the keyset, if a minimally secure location is compromised.

13. The computer program product of claim 9 , wherein the computer program code further performs the step of:

periodically changing the keyset.

14. The computer program product of claim 9 , wherein the computer program code further performs the step of:

using an encryption algorithm to change the keysets.

15. The computer program product of claim 9 , wherein the computer program code further performs the steps of:

hashing the sub-critical and/or non-critical sections stored at a minimally secure location;

comparing said hashes to previous hashes of the sub-critical and/or non-critical sections, wherein the previous hashes are stored at a location different from the minimally secure location.