Back to results
US 9,753,931 B2Granted
Security via data concealment
AssigneeCryptoMove, Inc.
InventorBoris Burshteyn
Life of this patent
Estimating the term…
Abstract
Methods, apparatuses, and embodiments related to improving security of data that is stored at a data store distributed over a computer network. In an example, source data to be protected is partitioned into multiple files, and each file is obfuscated, such as by being encrypted, to created multiple obfuscated data files. Information as to how each obfuscated data file was obfuscated is stored in an associated trace file. The multiple obfuscated data files are moved around a computer network via a data movement process that includes sending each of the multiple obfuscated data files to a different randomly selected computer, where the computer further obfuscates the obfuscated data the trace file, and sends the further obfuscated data and trace file to a next randomly selected computer.
Claims16
A method for securing a file via movement and obfuscation of data of the file, the method comprising:
- receiving, by a computer, a source data file;
- obfuscating, by the computer, data of the source data file by:
- compressing a version of the source data file to create a compressed version of the source data file,
- bit-scattering a version of the source data file to create a bit-scattered version of the source data file, and
- generating a plurality of obfuscated data files based on a selected version of the source data file, the selected version being the compressed version or the bit scattered version of the source data file, or a permutation thereof, wherein the generating of the obfuscated data files includes:
- partitioning data of the selected version to create initial versions of the obfuscated data files, wherein combined data of the initial versions includes the data of the selected version;
- generating a random name for each of the obfuscated data files,
- adding random data to a version of each of the obfuscated data files to create padded data versions of the obfuscated data files,
- cyclically exclusive-or'ing (XOR'ing) versions of the obfuscated data files to create XOR versions of the obfuscated data files, and
- encrypting versions of the obfuscated data files to create encrypted versions of the obfuscated data files,
- wherein the obfuscated data files correspond to the padded data versions, the XOR versions, the encrypted versions of the obfuscated data files, or a permutation thereof;
- generating, by the computer, a plurality of trace files that correspond to the obfuscated data files,
- wherein each of the trace files maps to a different one of the obfuscated data files,
- wherein the each trace file that maps to the different one of the obfuscated data files includes obfuscation information regarding the different one of the obfuscated data files, and
- wherein the obfuscation information of each of the trace files enables the source data file to be regenerated based on the obfuscated data files;
- encrypting, by the computer, the trace files;
- sending, by the computer via a communication network, each of the obfuscated data files and the trace file that maps to the each obfuscated data file to a different server in a pool of servers to enable a dynamic data movement process, wherein each of the obfuscated data files is periodically modified and transferred to another server in the pool to further obfuscate and conceal the data of the source data file;
- and
- cleaning up, by the computer, the source data file, the obfuscated data files, and the trace files,
- wherein the source data file is a version of the source data file,
- wherein the compressed version and the bit-scattered version of the source data file are each a version of the source data file,
- wherein the initial versions, the padded data versions, the XOR versions, and the encrypted versions of the obfuscated data files are each versions of the obfuscated data files,
- wherein the periodic modification of the obfuscated data files that is part of the data movement process is an encryption of the obfuscated data files,
- wherein the communication network is an unbounded communication network, and
- wherein the cleaning up of the source data file includes deleting the source data file, deleting the obfuscated data files, zero-ing out data of the obfuscated data files, freeing up storage space previously utilized to store the obfuscated data files, eliminating pointers to the obfuscated data files, or any combination thereof.
22 more elements
A method comprising:
- receiving, by a server, from a computer, an obfuscated data file,
- the obfuscated data file being one of a plurality of obfuscated data files derived from a source data file,
- the obfuscated data file being derived from the source data file via execution of an encryption algorithm and via execution of a data partitioning algorithm, a compression algorithm, a bit-scattering algorithm, a data padding algorithm, a cyclical exclusive-or (XOR) algorithm, or any combination thereof,
- wherein the obfuscated data files enable regeneration of the source data file;
- receiving, by the server, from the computer, a trace file,
- the trace file being an encrypted file,
- the trace file including obfuscation information regarding generation of the obfuscated data file,
- wherein the obfuscation information enables the source data file to be regenerated based on the obfuscated data files;
- further obfuscating the obfuscated data file, by the server, to create a modified version of the obfuscated data file;
- updating, by the server, the trace file with obfuscation information regarding said further obfuscating of the obfuscated data file to enable regeneration of the source data file based on the modified version of the obfuscated data file;
- further obfuscating the trace file to create a modified version of the trace file;
- sending, by the server, via a communication network, the modified version of the obfuscated data file and the modified version of the trace file to a second server to enable a dynamic data movement process;
- and
- cleaning up, by the server, the modified version of the obfuscated data file and the modified version of the trace file,
- wherein the trace file maps to a selected obfuscated data file of the obfuscated data files,
- wherein the trace file includes a selected hash value that enables determination as to whether data of the selected obfuscated data file has been improperly modified,
- wherein the data of the selected obfuscated data file being improperly modified indicates a security breach;
- and
- wherein the selected hash value enables positive identification of the selected obfuscated data file when the data of the selected obfuscated data file has not been improperly modified.
16 more elements
A server comprising:
- a processor;
- a network interface coupled to the processor;
- and
- a memory coupled to the processor and storing instructions which, when executed by the processor, cause the computing system to perform operations including:
- receiving, via the network interface, from a computer, an obfuscated data file,
- the obfuscated data file being one of a plurality of obfuscated data files that were derived from a source data file,
- the obfuscated data file being an encrypted file that is derived from the source data file,
- wherein the obfuscated data files enable the source data file to be regenerated;
- receiving, from the computer, a trace file,
- the trace file being an encrypted file,
- the trace file including obfuscation information regarding generation of the obfuscated data file,
- wherein the obfuscation information enables the source data file to be regenerated based on the obfuscated data files, and
- wherein the trace file includes a maximum depth value;
- further obfuscating the obfuscated data file to create a modified version of the obfuscated data file;
- updating the trace file with obfuscation information that indicates how data of the obfuscated data file was modified to create the modified version of the obfuscated data file;
- further obfuscating the trace file to create a modified version of the trace file;
- sending, via the network interface, the modified version of the obfuscated data file and the modified version of the trace file to a second server to enable a dynamic data movement process;
- cleaning up the modified version of the obfuscated data file and the modified version of the trace file;
- determining an obfuscation depth value,
- wherein the obfuscation depth value indicates how many versions of the obfuscated data file have been created by a set of servers, and
- wherein each server of the set of servers creates one version of the obfuscated data file;
- and
- comparing the obfuscation depth value to the maximum depth value,
- wherein the further obfuscating the obfuscated data file is in response to a determination that the obfuscation depth value is less than the maximum depth value.
21 more elements
Dependencies are inferred from the claim text.