US 11,057,209 B2 · Methods and systems that efficiently and securely store data

Abstract

The current document is directed to distributed-secure-storage systems, and processes carried out within the distributed-secure-storage systems, that provide for secure storage and retrieval of confidential and critical data, referred to as “secrets,” within distributed computer systems. The secret-storage systems partition an input secret into multiple secret shares and distribute the secret shares among multiple secret-share-storing node subsystems, without persistently storing the secret itself. An agent within a client device subsequently requests a secret share corresponding to a secret, or a share of data derived from the secret share, from each of the multiple secret-share-storing nodes. The multiple secret-share-storing nodes additionally cooperate to periodically alter the stored secret shares corresponding to a secret in a way that allows agents to recover the original secret, or derived data, from all or a portion of the altered secret shares or derived-data shares.

Claims19

Dependent claims

A distributed-secure-storage system within one or more distributed computer systems, the distributed-secure-storage system comprising:

multiple servers, each implemented within a computer system having one or more processors, one or more memories, and one or more mass-storage devices, the multiple servers including a security-management server;
and
computer instructions, stored in the memories of the multiple servers and a client system, that, when executed by multiple processors, control the distributed-secure-storage system to
store policy information in association with a secret identifier for a secret;
partition data comprising the secret into multiple secret shares using a finite-field polynomial,
assign each secret share to a different server node;
store the secret share assigned to each server node within the server node;
iteratively refresh the stored secret shares using multiple polynomials over the integers,
use the policy information to manage access to the secret by secure-storage-subsystem client devices, and
reconstruct the secret within the client system from a subset of the stored secret shares.

7 more elements

A method that securely stores data in a distributed-secure-storage system within one or more distributed computer systems, the distributed-secure-storage system including multiple servers, each implemented within a computer system having one or more processors, one or more memories, and one or more mass-storage devices, the method comprising:

receiving the data;
storing policy information in association with a secret identifier for the data;
partitioning the data, comprising a secret, into multiple secret shares using a finite-field polynomial,
assigning each secret share to a different server node;
storing the secret share assigned to each server node within the server node;
iteratively refreshing the stored secret shares using multiple polynomials generated over the integers,
using the policy information to manage access to the secret by secure-storage-subsystem client devices, and
reconstructing the secret within the client system from a subset of the stored secret shares.

5 more elements

Dependencies are inferred from the claim text.

Methods and systems that efficiently and securely store data

Life of this patent

Methods and systems that efficiently and securely store data

Life of this patent

Abstract

Claims19