Secure data parser method and system
The present invention provides a method and system for securing sensitive data from unauthorized access or use. The method and system of the present invention is useful in a wide variety of settings, including commercial settings generally available to the public which may be extremely large or small with respect to the number of users. The method and system of the present invention is also useful in a more private setting, such as with a corporation or governmental agency, as well as between corporation, governmental agencies or any other entity.
1. A method for securely storing data, the method comprising:
receiving, using an electronic computing system, a request to store primary data;
distributing the primary data into a plurality of shares, wherein each share of the plurality of shares comprises less than all of the primary data;
generating a plurality of secondary data, such that the primary data can be reconstructed using at least a subset of the plurality of secondary data, wherein generating each respective secondary data of the plurality of secondary data comprises:
encrypting a respective share of the plurality of shares with a respective one of a plurality of distinct encryption keys, and
including in the respective secondary data the encrypted respective share and data indicative of at least one of the plurality of the distinct encryption keys, wherein the respective secondary data is based on less than all of the plurality of shares, and wherein the respective secondary data is generated based on a random or pseudorandom value; and
storing the plurality of secondary data on a plurality storage devices.
2. The method of claim 1 , wherein including data indicative of at least one of the distinct encryption keys into the respective secondary data comprises including data indicative of an encryption key that was used to encrypt a different share of the plurality of shares into the respective secondary data.
3. The method of claim 1 , wherein distributing the primary data into the plurality of shares comprises using the generated random or pseudorandom value.
4. The method of claim 3 , wherein a portion of the primary data is distributed into a particular share of the plurality of shares based on the generated random or pseudorandom value.
5. The method of claim 1 , wherein each share of the plurality of shares comprises a substantially random distribution of a subset of the primary data.
6. The method of claim 1 , further comprising generating the primary data by encrypting a data set.
7. The method of claim 1 , further comprising storing at least one of the plurality of distinct encryption keys in a different location from the plurality of secondary data.
8. A computer system for securing a data set, the system comprising:
input circuitry configured to receive a request to store primary data; and
at least one hardware processor, configured to:
distribute the primary data into a plurality of shares, wherein each share of the plurality of shares comprises less than all of the primary data;
generate a plurality of secondary data, such that the primary data can be reconstructed using at least a subset of the plurality of secondary data, wherein generating each respective secondary data of the plurality of secondary data comprises:
encrypting a respective share of the plurality of shares with a respective one of a plurality of distinct encryption keys, and
including in the respective secondary data the encrypted respective share and data indicative of at least one of the plurality of the distinct encryption keys, wherein the respective secondary data is based on less than all of the plurality of shares, and wherein the respective secondary data is generated based on a random or pseudorandom value; and
store the plurality of secondary data on a plurality of different storage devices.
9. The system of claim 8 , wherein, when including data indicative of at least one of the distinct encryption keys into the respective secondary data, the at least one hardware processor is configured to include data indicative of an encryption key that was used to encrypt a different share of the plurality of shares into the respective secondary data.
10. The system of claim 8 , wherein, when distributing the primary data into the plurality of shares, the at least one hardware processor is configured to use the generated random or pseudorandom value.
11. The system of claim 10 , wherein the at least one hardware processor is configured to distribute a portion of the primary data into a particular share of the plurality of shares based on the generated random or pseudorandom value.
12. The system of claim 8 , wherein each share of the plurality of shares comprises a substantially random distribution of a subset of the primary data.
13. The system of claim 8 , the at least one hardware processor is further configured to generate the primary data by encrypting a data set.
14. The system of claim 8 , the at least one hardware processor is further configured to store at least one of the plurality of distinct encryption keys in a different location from the plurality of secondary data.
15. A non-transitory computer-readable storage medium for securely storing data, the non-transitory computer-readable medium comprising:
computer program instructions recorded thereon, wherein the computer program instructions, when executed by a hardware processor, cause the hardware processor to perform operations comprising:
receiving a request to store primary data;
distributing the primary data into a plurality of shares, wherein each share of the plurality of shares comprises less than all of the primary data;
generating a plurality of secondary data, such that the primary data can be reconstructed using at least a subset of the plurality of secondary data, wherein generating each respective secondary data of the plurality of secondary data comprises:
encrypting a respective share of the plurality of shares with a respective one of a plurality of distinct encryption keys, and
including in the respective secondary data the encrypted respective share and data indicative of at least one of the plurality of distinct encryption keys, wherein the respective secondary data is based on less than all of the plurality of shares, and wherein the respective secondary data is generated based on a random or pseudorandom value; and
storing the plurality of secondary data on a plurality of different storage devices.