Secure data parser method and system
A secure data parser is provided that may be integrated into any suitable system for securely storing and communicating data. The secure data parser parses data and then splits the data into multiple portions that are stored or communicated distinctly. Encryption of the original data, the portions of data, or both may be employed for additional security. The secure data parser may be used to protect data in motion by splitting original data into portions of data, that may be communicated using multiple communications paths.
1. A method for securely storing user data, the method comprising:
receiving, by a server-based system, the user data including a plurality of data portions, wherein each of the plurality of data portions comprises less than all of the user data, and wherein the user data can be reassembled using two or more of the plurality of data portions;
generating, by the server-based system, a data encryption key;
encrypting, by the server-based system, one or more data portions of the plurality of data portions with the data encryption key to provide one or more encrypted data portions;
encrypting, by the server-based system, the data encryption key with a key encryption key to provide an encrypted data encryption key;
storing, by the server-based system, the encrypted data encryption key with the one or more encrypted data portions; and
storing, by the server-based system, the key encryption key separate from the encrypted data encryption key and the one or more encrypted data portions.
2. The method of claim 1 , further comprising:
distributing, by the server-based system, the one or more encrypted data portions across one or more storage devices.
3. The method of claim 1 , wherein the user data is received from a user computer.
4. The method of claim 1 , wherein the key encryption key or the data encryption key comprises an AES key.
5. The method of claim 1 , further comprising:
generating, by the server-based system, a second data encryption key;
encrypting, by the server-based system, second one or more data portions of the plurality of data portions with the second data encryption key to provide second one or more encrypted data portions;
encrypting, by the server-based system, the second data encryption key with the key encryption key to provide a second encrypted data encryption key; and
storing, by the server-based system, the second encrypted data encryption key with the second one or more encrypted data portions;
wherein storing the key encryption key, by the server-based system, stores the key encryption key separate from the second encrypted data encryption key and the second one or more encrypted data portions.
6. The method of claim 1 , further comprising:
splitting, by the server-based system, the user data into the plurality of data portions.
7. The method of claim 1 , wherein storing, by the server-based system, the key encryption key includes:
storing the key encryption key in a key store separate from the encrypted data encryption key and the one or more encrypted data portions.
8. The method of claim 1 , further comprising:
decrypting, by the server-based system, the encrypted data encryption key using the key encryption key.
9. The method of claim 8 , further comprising:
decrypting, by the server-based system, the one or more encrypted data portions using the data encryption key after the encrypted data encryption key using the key encryption key; and
reassembling, by the server-based system, the user data after decrypting the one or more encrypted data portions using the data encryption key.
10. The method of claim 1 , further comprising:
storing, by the server-based system, a portion identifier with each of the one or more encrypted data portions.
11. A server-based computer system for securely storing user data, the server-based system comprising:
at least one hardware server processor configured to:
receive the user data including a plurality of data portions, wherein each of the plurality of data portions comprises less than all of the user data, and wherein the user data can be reassembled using two or more of the plurality of data portions;
generate a data encryption key;
encrypt one or more data portions of the plurality of data portions with the data encryption key to provide one or more encrypted data portions;
encrypt the data encryption key with a key encryption key to provide an encrypted data encryption key;
store the encrypted data encryption key with the one or more encrypted data portions; and
store the key encryption key separate from the encrypted data encryption key and the one or more encrypted data portions.
12. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to:
distribute the one or more encrypted data portions across one or more storage devices.
13. The server-based computer system of claim 11 , wherein the user data is received from a user computer.
14. The server-based computer system of claim 11 , wherein the key encryption key or the data encryption key comprises an AES key.
15. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to
generate a second data encryption key;
encrypt second one or more data portions of the plurality of data portions with the second data encryption key to provide second one or more encrypted data portions;
encrypt the second data encryption key with the key encryption key to provide a second encrypted data encryption key; and
store the second encrypted data encryption key with the second one or more encrypted data portions;
wherein storing the key encryption key stores the key encryption key separate from the second encrypted data encryption key and the second one or more encrypted data portions.
16. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to:
split, by the server-based system, the user data into the plurality of data portions.
17. The server-based computer system of claim 11 , wherein storing the key encryption key includes:
storing the key encryption key in a key store separate from the encrypted data encryption key and the one or more encrypted data portions.
18. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to:
decrypt the encrypted data encryption key using the key encryption key.
19. The server-based computer system of claim 18 , wherein the at least one hardware server processor is further configured to:
decrypt the one or more encrypted data portions using the data encryption key after the encrypted data encryption key using the key encryption key; and
reassemble the user data after decrypting the one or more encrypted data portions using the data encryption key.
20. The server-based computer system of claim 11 , wherein the at least one hardware server processor is further configured to:
store a portion identifier with each of the one or more encrypted data portions.
21. A method comprising:
obtaining, by a server-based system, one or more data portions;
obtaining, by the server-based system, a first data encryption key;
encrypting, by the server-based system, a first data portion of the one or more data portions with the first data encryption key to provide a first encrypted data portion;
encrypting, by the server-based system, the first data encryption key with a first key encryption key to provide a first encrypted data encryption key;
storing, by the server-based system, the first encrypted data encryption key with the first encrypted data portion; and
storing, by the server-based system, the first key encryption key separate from the first encrypted data encryption key and the first encrypted data portion.
22. The method of claim 21 , further comprising:
encrypting, by the server-based system, a second data portion of the one or more data portions with the first data encryption key to provide a second encrypted data portion; and
storing, by the server-based system, the first encrypted data encryption key with the second encrypted data portion; and
wherein the first key encryption key is stored separately from the first encrypted data encryption key and the second encrypted data portion.
23. The method of claim 22 , further comprising:
distributing, by the server-based system, the first encrypted data portion and the second encrypted data portion across one or more storage devices.
24. The method of claim 22 , further comprising:
distributing, by the server-based system, the first encrypted data portion and the second encrypted data portion across two different storage devices.
25. The method of claim 21 , further comprising:
obtaining, by the server-based system, a second data encryption key;
encrypting, by the server-based system, a second data portion of the one or more data portions with the second data encryption key to provide a second encrypted data portion;
encrypting, by the server-based system, the second data encryption key with the first key encryption key to provide a second encrypted data encryption key; and
storing, by the server-based system, the second encrypted data encryption key with the second encrypted data portion;
wherein the first key encryption key is stored separately from the second encrypted data encryption key and the second encrypted data portion.
26. The method of claim 25 , further comprising:
distributing, by the server-based system, the first encrypted data portion and the second encrypted data portion across one or more storage devices.
27. The method of claim 25 , further comprising:
distributing, by the server-based system, the first encrypted data portion and the second encrypted data portion across two different storage devices.
28. The method of claim 21 , further comprising:
obtaining, by the server-based system, a second data encryption key;
encrypting, by the server-based system, a second data portion of the one or more data portions with the second data encryption key to provide a second encrypted data portion;
encrypting, by the server-based system, the second data encryption key with a second key encryption key to provide a second encrypted data encryption key;
storing, by the server-based system, the second encrypted data encryption key with the second encrypted data portion; and
storing, by the server-based system, the second key encryption key separate from the second encrypted data encryption key and the second encrypted data portion.
29. The method of claim 21 , further comprising:
prior to obtaining the one or more data portions, receiving, by the server-based system, user data; and
splitting, by the server-based system, the user data into a plurality of data portions.