Secure data parser method and system
A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.
1. A method for securely storing a user data set, the method comprising:
splitting, by a server-based system, the user data set into a plurality of data portions, wherein each of the plurality of data portions comprises less than all of the user data set, and wherein the user data set can be reassembled using two or more of the plurality of data portions;
generating, by the server-based system, a plurality of data encryption keys distinct from each other;
encrypting, by the server-based system, each of the plurality of data portions with one of the plurality of data encryption keys;
distributing, by the server-based system, the plurality of encrypted data portions across a plurality of different storage devices;
encrypting, by the server-based system, each of the plurality of data encryption keys with a key encryption key;
storing, by the server-based system, the plurality of encrypted data encryption keys;
storing, by the server-based system, data indicative of the plurality of data encryption keys with information representative of the plurality of data portions; and
storing, by the server-based system, the key encryption key separate from (i) the data indicative of the plurality of data encryption keys stored with the information representative of the plurality of data portions, (ii) and the plurality of data portions.
2. The method of claim 1 , wherein the key encryption key comprises an AES key, and wherein each of the plurality of data encryption keys comprises an AES key.
3. The method of claim 1 , wherein storing the data indicative of the plurality of data encryption keys further includes storing the plurality of encrypted data encryption keys with the information representative of the plurality of data portions.
4. The method of claim 1 , wherein the information representative of the plurality of data portions comprises the plurality of data portions.
5. The method of claim 1 , further comprising:
decrypting, by the server-based system, each of the plurality of encrypted data encryption keys using the key encryption key.
6. The method of claim 5 , further comprising:
decrypting, by the server-based system, each of the plurality of encrypted data portions using a corresponding one of the plurality of data encryption keys obtained by said decrypting each of the plurality of encrypted data encryption keys.
7. The method of claim 6 , further comprising:
reassembling, by the server-based system, the plurality of encrypted data portions obtained by said decrypting each of the plurality of encrypted data portions to provide reassembled user data set.
8. The method of claim 7 , further comprising:
transmitting, by the server-based system, the reassembled user data set to a user computer.
9. The method of claim 1 , further comprising:
generating, by the server-based system, the key encryption key.
10. The method of claim 1 , wherein storing the key encryption key comprises storing the key encryption key in a key store, wherein the key store does not store the data indicative of the plurality of data encryption keys, and wherein the key store does not store the information representative of the plurality of data portions.
11. A server-based computer system for securely storing a user data set, the server-based system comprising:
at least one hardware server processor configured to:
split the user data set into a plurality of data portions, wherein each of the plurality of data portions comprises less than all of the user data set, and wherein the user data set can be reassembled using two or more of the plurality of data portions;
generate a plurality of data encryption keys distinct from each other;
encrypt each of the plurality of data portions with one of the plurality of data encryption keys;
distribute the plurality of encrypted data portions across a plurality of different storage devices;
encrypt each of the plurality of data encryption keys with a key encryption key;
store the plurality of encrypted data encryption keys;
store data indicative of the plurality of data encryption keys with information representative of the plurality of data portions; and
store the key encryption key separate from (i) the data indicative of the plurality of data encryption keys stored with the information representative of the plurality of data portions, (ii) and the plurality of data portions.
12. The server-based computer system of claim 11 , wherein the key encryption key comprises an AES key, and wherein each of the plurality of data encryption keys comprises an AES key.
13. The server-based computer system of claim 11 , wherein storing the data indicative of the plurality of data encryption keys further includes storing the plurality of encrypted data encryption keys with the information representative of the plurality of data portions.
14. The server-based computer system of claim 11 , wherein the information representative of the plurality of data portions comprises the plurality of data portions.
15. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to:
decrypt each of the plurality of encrypted data encryption keys using the key encryption key.
16. The server-based computer system of claim 15 , wherein the at least one hardware server processor is further configured to:
decrypt each of the plurality of encrypted data portions using a corresponding one of the plurality of data encryption keys obtained by said decrypting each of the plurality of encrypted data encryption keys.
17. The server-based computer system of claim 16 , wherein the at least one hardware server processor is further configured to:
reassemble the plurality of encrypted data portions obtained by said decrypting each of the plurality of encrypted data portions to provide reassembled user data set.
18. The server-based computer system of claim 17 , wherein the at least one hardware server processor is further configured to:
transmit the reassembled user data set to a user computer.
19. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to:
generate the key encryption key.
20. The server-based computer system of claim 11 , wherein storing the key encryption key comprises storing the key encryption key in a key store, wherein the key store does not store the data indicative of the plurality of data encryption keys, and wherein the key store does not store the information representative of the plurality of data portions.
21. A method for securely storing a user data set, the method comprising:
splitting, by a server-based system, the user data set into a plurality of data portions, wherein each of the plurality of data portions comprises less than all of the user data set, and wherein the user data set can be reassembled using two or more of the plurality of data portions;
generating, by the server-based system, a plurality of data encryption keys distinct from each other;
encrypting, by the server-based system, each of the plurality of data portions with a corresponding one of the plurality of data encryption keys to provide a plurality of encrypted data portions;
distributing, by the server-based system, the plurality of encrypted data portions to be stored across a plurality of different storage devices;
encrypting, by the server-based system, each of the plurality of data encryption keys with a corresponding one of one or more key encryption keys to provide a plurality of encrypted data encryption keys;
storing, by the server-based system, the plurality of encrypted data encryption keys with data indicative of the plurality of data encryption keys; and
storing, by the server-based system, the one or more key encryption keys separate from (i) the plurality of encrypted data encryption keys stored with the data indicative of the plurality of data encryption keys, and (ii) the plurality of encrypted data portions.
22. The method of claim 21 , wherein each of the one or more key encryption keys comprises an AES key, and wherein each of the plurality of data encryption keys comprises an AES key.
23. The method of claim 21 , wherein splitting, by the server-based system, the user data set into the plurality of data portions comprises splitting, by the server-based system, the user data set into the plurality of data portions using a deterministic technique.
24. The method of claim 21 , wherein storing the data indicative of the plurality of data encryption keys further includes storing the plurality of encrypted data encryption keys with information representative of the plurality of data portions.
25. The method of claim 21 , further comprising:
decrypting, by the server-based system, each of the plurality of encrypted data encryption keys using the key encryption key;
decrypting, by the server-based system, each of the plurality of encrypted data portions using a corresponding one of the plurality of data encryption keys obtained by said decrypting each of the plurality of encrypted data encryption keys;
reassembling, by the server-based system, the plurality of encrypted data portions obtained by said decrypting each of the plurality of encrypted data portions to provide reassembled user data set; and
transmitting, by the server-based system, the reassembled user data set to a user computer.
26. A server-based computer system for securely storing a user data set, the server-based system comprising:
at least one hardware server processor configured to:
split the user data set into a plurality of data portions, wherein each of the plurality of data portions comprises less than all of the user data set, and wherein the user data set can be reassembled using two or more of the plurality of data portions;
generate a plurality of data encryption keys distinct from each other;
encrypt each of the plurality of data portions with a corresponding one of the plurality of data encryption keys to provide a plurality of encrypted data portions;
distribute the plurality of encrypted data portions to be stored across a plurality of different storage devices;
encrypt each of the plurality of data encryption keys with a corresponding one of one or more key encryption keys to provide a plurality of encrypted data encryption keys;
store the plurality of encrypted data encryption keys with data indicative of the plurality of data encryption keys; and
store the one or more key encryption keys separate from (i) the plurality of encrypted data encryption keys stored with the data indicative of the plurality of data encryption keys, and (ii) the plurality of encrypted data portions.
27. The server-based computer system of claim 26 , wherein each of the one or more key encryption keys comprises an AES key, and wherein each of the plurality of data encryption keys comprises an AES key.
28. The server-based computer system of claim 26 , wherein splitting the user data set into the plurality of data portions comprises splitting the user data set into the plurality of data portions using a deterministic technique.
29. The server-based computer system of claim 26 , wherein storing the data indicative of the plurality of data encryption keys further includes storing the plurality of encrypted data encryption keys with information representative of the plurality of data portions.
30. The server-based computer system of claim 26 , wherein the at least one hardware server processor is further configured to:
decrypt each of the plurality of encrypted data encryption keys using the key encryption key;
decrypt each of the plurality of encrypted data portions using a corresponding one of the plurality of data encryption keys obtained by said decrypting each of the plurality of encrypted data encryption keys;
reassemble the plurality of encrypted data portions obtained by said decrypting each of the plurality of encrypted data portions to provide reassembled user data set; and
transmit the reassembled user data set to a user computer.