Method and system for shielding data in transit and data in memory

A system configured to operate in an untrusted environment to shield data in memory, the system comprising:

• a hardware processor;
• logic instructions stored in the memory and executable by the hardware processor, the logic instructions being configured to include:
• a remote compute agent configured to transform the data to shielded data;
• and
• the memory coupled to the remote compute agent, the memory being configured to store the shielded data in a plurality of memory blocks;
• wherein the remote compute agent is configured to include:
• a remote transformation knowledge key (TKK) agent, the remote TKK agent configured to receive a plurality of TKK's for transforming the data into the shielded data;
• a remote data transformer agent configured to transform the data into M segments of the shielded data using a corresponding instance of the plurality of TKK's, the M segments of the shielded data being stored in corresponding M blocks of the plurality of memory blocks, M being a positive integer, wherein each TKK of the plurality of TKK's is configured to include transformation expressions, wherein the transformation expressions are configured to include transformation operators, the TKK being configurable to include a nested instance of another TKK of the plurality of TKK's, wherein appearance of the data in memory in plaintext form is eliminated in the untrusted environment, wherein an initial TKK is configured to include KNO transformation operators and parameters of shielding algorithms included in a library of shielding algorithms, wherein additional TKK's of the plurality of TKK's are configured to include KNOS transformation operators and parameters of the shielding algorithms included in the library of shielding algorithms, wherein K represents an encryption operator, N represents a noise operator, O represents an order operator and S represents a split operator.

A system comprising:

• a hardware processor;
• logic instructions stored on computer readable storage media and executable by the hardware processor, the logic instructions being configured to include:
• a communications shield agent to shield data in transit;
• a memory shield agent to shield data in memory;
• a storage shield agent to shield data at rest,
• wherein the communications shield agent, the memory shield agent, and the storage shield agent use at least one transformation knowledge key (TKK) to transform the data in memory, the data in transit, and the data at rest into M segments of shielded data, M being an integer;
• and
• a trusted agent operable in a trusted computing environment, wherein the trusted agent is configured to generate the at least one TKK, wherein the at least one TKK is configured to include transformation expressions, wherein the transformation expressions are configured to include transformation operators, the at least one TKK being configurable to include a nested instance of another TKK, the at least one TKK and the another TKK being configurable from a plurality of TKK's, wherein the trusted agent is configured to store at least one segment of the M segments of the shielded data in the trusted computing environment, wherein the at least one TKK is configured to include KNO transformation operators and parameters of shielding algorithms included in a library of shielding algorithms, wherein the another TKK of the plurality of TKK's is configured to include KNOS transformation operators and parameters of the shielding algorithms included in the library of shielding algorithms, wherein K represents an encryption operator, N represents a noise operator, O represents an order operator and S represents a split operator.

One or more non-transitory computer-readable storage media storing instructions that, when executed by one or more processors, cause the one or more processors to perform acts comprising:

• configuring a communications shield agent to shield data in transit;
• configuring a memory shield agent to shield data stored in volatile memory;
• configuring a storage shield to shield data at rest stored in a hard disk drive,
• wherein the communications shield agent, the memory shield agent, and the storage shield agent use at least one transformation knowledge key (TKK) to transform the data in memory, the data in transit, and the data at rest into M segments of shielded data, M being an integer;
• and
• configuring a trusted agent operable in a trusted computing environment, wherein the trusted agent is configured to generate the at least one TKK, wherein the at least one TKK is configured to include transformation expressions, wherein the transformation expressions are configured to include transformation operators, the at least one TKK being configurable to include a nested instance of another TKK, the at least one TKK and the another TKK being configurable from a plurality of TKK's, wherein the trusted agent is configured to store at least one segment of the M segments of the shielded data in the trusted computing environment, wherein the at least one TKK is configured to include KNO transformation operators and parameters of shielding algorithms included in a library of shielding algorithms, wherein the another TKK of the plurality of TKK's is configured to include KNOS transformation operators and parameters of the shielding algorithms included in the library of shielding algorithms, wherein K represents an encryption operator, N represents a noise operator, O represents an order operator and S represents a split operator.