“Integrated Circuits For Secure Data Storage And Retrieval” in Patent Application Approval Process (USPTO 20190278930)

2019 SEP 30 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- A patent application by the inventors TOBIAS, Eric (La Jolla, CA); IASI, Anthony (San Diego, CA); KAHLE, Charles (Escondido, CA); SCHNEIR, Gary (Carlsbad, CA); TYNER, John (San Diego, CA); GIACONI, Stefano (San Diego, CA), filed on March 7, 2019, was made available online on September 12, 2019, according to news reporting originating from Washington, D.C., by NewsRx correspondents.

This patent application is assigned to FHOOSH Inc. (La Jolla, California, United States).

The following quote was obtained by the news editors from the background information supplied by the inventors: “Various embodiments described herein relate generally to the field of electronic data security, and more particularly to managing access to secured data to resolve conflicting access to secured data by multiple systems. Further, various embodiments described herein relate generally to implementations of electronic data security in integrated circuits, and more particularly to the implementation of application specific integrated circuits (‘ASIC’) and/or field programmable gate arrays (‘FPGA’).

“The vision of a paperless modern society is quickly becoming a reality, as more and more communications, services and transactions take place digitally across networks such as the Internet. The need for paper copies of correspondence, financial documents, receipts, contracts and other legal instruments is dwindling as electronic methods for securely transmitting, updating and accessing these documents increases. In addition to the electronic transmission and access to documents and correspondence, the process of electronically submitting information is also commonplace, such as with online shopping or applications for loans, credit cards, health insurance, college or job applications, etc.

“Security of electronic data is of paramount importance for private individuals and for almost every conceivable business and government entity. A tremendous volume of electronic data is being generated, stored, and transmitted on a constant basis. Moreover, the breadth of electronic data, which nowadays inevitably extends to private and sensitive information, necessarily attracts a host of bad actors.

“Conventional data security solutions are relatively static. For example, one or more data security mechanisms (e.g., password protection, encryption scheme) may be deployed at a particular data storage location. The same data security mechanisms will generally remain in place until a significant security breach is detected, at which point the entire data storage location may have already been compromised.

“Data that has been stored based on standard relational data models are particularly vulnerable to unauthorized access. Individual data records (e.g., name, address, social security number, credit card number, and bank account number) stored in separate storage locations are typically accompanied by a common record locator indicating a logical nexus between the data records (e.g., associated with the same user). For example, individual data records may each be associated with the same user identification number. As such, unauthorized access to any one data record may expose sufficient information (i.e., the user identification number) to gain access to the remainder of the data records.

“Although numerous data security methods are available, implementing a flexible roster of seamlessly integrated and complementary data security solutions at a single data storage location remains an enormous challenge. For example, while combining security solutions will normally increase data security, incompatibilities between different solutions may in fact give rise to additional security risks.

“Moreover, in order for a user to be able to store and retrieve data, there must be a way to identify that user and protect their data from being accessed by any other user. Traditionally, this is performed by ‘front-end’ software where the user is authenticated and authorized through a login process.

“The conventional login process is associated with a number of documented weaknesses. For example, in many systems, the login step is commonly considered a part of the user interface (UI) and a separate entity from the security bubble. The problem is magnified in cases where in-house developers, having limited background in security, attempt to build custom login authentication and authorization systems. As such, a malicious user can potentially have access to other users’ data once that user successfully completes the login process.

“But these issues are also exacerbated by the fact that much of the data that is created today is created or accessed at a client endpoint, e.g., a computer, laptop, smartphone, tablet, Internet of Things device, etc. Furthermore, users are increasingly attempting to share data so to collaborate and accessed common data, such as documents and files. Thus, these issues are further complicated by the fact that multiple client endpoints data are increasing simultaneously accessing and modifying common data causing race conditions and conflicting access. Even if the issues described above can be solved for data stored and retrieved at a server, there is the additional problem of securing the data and ensuring that such data remains uncorrupted at the endpoint. Thus, any solution to the above issues should take into account the fact that the client endpoint must also be secured and access thereto managed. Furthermore, when multiple users attempt to access common data stored in a file system two or more systems may collide and/or conflict in their attempts to access, read, write, or modify the same file. Thus, there is an inherent risk of data loss when multiple users attempt to access and/or write to the same file located at the same location at the same time. Some approaches attempt to remedy this through file locking, such that a single system is permitted access at a given time. Other approaches attempt to address this situation by providing exclusive access to a host system, such that systems accessing the data do so via communication with the host system. However, these approaches do not have a consistent method to handle race conditions when multiple processes on different host systems attempt to write to the same file when the device is not controlled by one of the host systems. In such a scenario, a race condition can occur where data may be overwritten by a process without consideration or inclusion of modifications entered other processes. Similarly, a race condition may corrupt the data by the competing processes. It is possible that one system may receive indication that the file has been successfully written only to later realize that the data is not as stored as expected.”

In addition to the background information obtained for this patent application, NewsRx journalists also obtained the inventors’ summary information for this patent application: “Disclosed herein are systems and methods for secure storage, transmission and management of data, credentials and encryption keys to and from the client endpoint. According to one aspect, an integrated circuit is provide. The integrated circuit comprises: at least one connection node; and a secure circuit electrically connected to the at least one connection node. The secure circuit is configured to: receive a data object via the at least one connection node, disassemble the data object into a plurality of data fragments, encrypt the plurality of data fragments, and send the plurality of encrypted data fragments to a plurality of storage locations.

“In another aspect, an integrated circuit is provided. The integrated circuit comprises: at least one connection node; and a decrypt circuit electrically connected to the at least one connection node. The decrypt circuit is configured to: receive an electrical signal indicative of a request to access a data object via the at least one connection node, retrieve a plurality of encrypted data fragments stored at a plurality of storage locations, decrypt the plurality of encrypted data fragments, and reassemble the decrypted data fragments into the data object.

“In another aspect, an integrated circuit is provided. The integrated circuit comprises: a plurality of connection nodes comprising at least a first connection node and a second connection node; a secure intellectual property (IP) block coupled to the first connection node; and a decrypt IP block coupled to the second connection node. The secure IP block is configured to: receive a data object via the first connection node, disassemble the data object into a plurality of data fragments, encrypt the plurality of data fragments, and send the plurality of encrypted data fragments to a plurality of storage locations. The decrypt IP block is configured to: receive an electrical signal indicative of a request to access a data object via the second connection node, retrieve a plurality of encrypted data fragments stored at a plurality of storage locations, decrypt the plurality of encrypted data fragments, and reassemble the decrypted data fragments into the data object.

“Other features and advantages should become apparent from the following description of the preferred embodiments, taken in conjunction with the accompanying drawings.”

The claims supplied by the inventors are:

“1. An integrated circuit comprising: at least one connection node; and a secure circuit electrically connected to the at least one connection node, the secure circuit configured to: receive a data object via the at least one connection node, disassemble the data object into a plurality of data fragments, encrypt the plurality of data fragments, and send the plurality of encrypted data fragments to a plurality of storage locations.

“2. The integrated circuit of claim 1, wherein the secure circuit comprises a fragmentation block, an encryption block, and a distribution interface block configured to interface with the plurality of storage locations.

“3. The integrated circuit of claim 1, wherein the secure circuit is configured to individually encrypt each of the data fragments based, in part, on an encryption algorithm.

“4. The integrated circuit of claim 3, wherein the secure circuit is configured to generate a manifest comprising at least decryption data based on the encryption algorithm.

“5. The integrated circuit of claim 3, wherein the secure circuit is configured to individually encrypt each of the data fragments upon generating each respective data fragment.

“6. The integrated circuit of claim 1, wherein the secure circuit is configured to transmit the plurality of encrypted data fragments to the plurality of storage of storage locations based on a data map of a data repository comprising mapping information for storage to the plurality of storage locations.

“7. The integrated circuit of claim 1, wherein the secure circuit is communicatively coupled to a trusted file manager system comprising the plurality of storage locations.

“8. The integrated circuit of claim 1, wherein the secure circuit is communicatively coupled to a memory circuit via the at least one connection node, wherein the secure circuit is further configured to receive the data object from the memory circuit.

“9. The integrated circuit of claim 8, wherein the data object is received as a plurality of pieces in a sequential order based on content of the data object.

“10. The integrated circuit of claim 9, wherein the secure circuit is configured to disassemble each of the plurality of pieces upon reception of each respective piece.

“11. The integrated circuit of claim 1, further comprising one or more external pins comprising the at least one connection node, wherein the secure circuit is coupled to a data bus via the one or more external pins.

“12. The integrated circuit of claim 11, wherein the integrated circuit is an application specific integrated circuit.

“13. The integrated circuit of claim 11, wherein the integrated circuit is a field programmable gate array.

“14. The integrated circuit of claim 1, further comprising a processor circuit coupled to the secure circuit via an internal data bus.

“15. An integrated circuit comprising: at least one connection node; and a decrypt circuit electrically connected to the at least one connection node, the decrypt circuit configured to: receive an electrical signal indicative of a request to access a data object via the at least one connection node, retrieve a plurality of encrypted data fragments stored at a plurality of storage locations, decrypt the plurality of encrypted data fragments, and reassemble the decrypted data fragments into the data object.

“16. The integrated circuit of claim 15, wherein the decrypt circuit comprises an interface block configured to interface with the plurality of storage locations, a decryption block, and a reassembly block.

“17. The integrated circuit of claim 15, wherein the signal indicative of a request to access a data object comprises an identification of at least one manifest for decrypting a subset of the plurality of data fragments and identifying the subset of the plurality of data fragments.

“18. The integrated circuit of claim 17, wherein the at least one manifest is encrypted, wherein the decrypt circuit is configured to decrypt the manifest.

“19. The integrated circuit of claim 17, wherein the decrypt circuit is configured to, based on the at least one manifest, retrieve and decrypt the subset of the plurality data fragments.

“20. The integrated circuit of claim 19, wherein the decrypt circuit is configured to decrypt each data fragment as each data fragment of the subset of the plurality of data fragments is received.

“21. The integrated circuit of claim 17, wherein the at least one manifest comprises a data map of a data repository comprising mapping information for retrieving the subset of the plurality of data fragments from the plurality of storage locations.

“22. The integrated circuit of claim 17, wherein the decrypt circuit is configured reassemble the subset of data fragments based on the at least one manifest.

“23. The integrated circuit of claim 15, wherein the decrypt circuit is communicatively coupled to a memory circuit via the at least one connection node, wherein the decrypt circuit is further configured to electrically transmit the reassemble decrypted data fragments to the memory circuit.

“24. The integrated circuit of claim 15, further comprising one or more external pins comprising the at least one connection node, wherein the decrypt circuit is coupled to a data bus via the one or more external pins.

“25. The integrated circuit of claim 24, wherein the integrated circuit is an application specific integrated circuit.

“26. The integrated circuit of claim 24, wherein the integrated circuit is a field programmable gate array.

“27. The integrated circuit of claim 15, further comprising a processor circuit coupled to the decrypt circuit via an internal data bus.

“28. An integrated circuit comprising: a plurality of connection nodes comprising at least a first connection node and a second connection node; a secure intellectual property (IP) block coupled to the first connection node, the secure IP block configured to: receive a data object via the first connection node, disassemble the data object into a plurality of data fragments, encrypt the plurality of data fragments, and send the plurality of encrypted data fragments to a plurality of storage locations; and a decrypt IP block coupled to the second connection node, the decrypt IP block configured to: receive an electrical signal indicative of a request to access a data object via the second connection node, retrieve a plurality of encrypted data fragments stored at a plurality of storage locations, decrypt the plurality of encrypted data fragments, and reassemble the decrypted data fragments into the data object.

“29. The integrated circuit of claim 28, wherein at least one or more of the secure IP block and the decrypt IP block is an asynchronous IP block.

“30. The integrated circuit of claim 28, wherein the secure IP block and the decrypt IP block are configured to operate independently.

“31. The integrated circuit of claim 28, wherein the integrated circuit is an application specific integrated circuit.

“32. The integrated circuit of claim 28, wherein the integrated circuit is a field programmable gate array.

“33. The integrated circuit of claim 15, further comprising a processor circuit coupled to at least the decrypt IP block and the secure IP block via an internal data bus.”

URL and more information on this patent application, see: TOBIAS, Eric; IASI, Anthony; KAHLE, Charles; SCHNEIR, Gary; TYNER, John; GIACONI, Stefano. Integrated Circuits For Secure Data Storage And Retrieval. Filed March 7, 2019 and posted September 12, 2019. Patent URL: http://appft.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1=%2220190278930%22.PGNR.&OS=DN/20190278930&RS=DN/20190278930

(Our reports deliver fact-based news of research and discoveries from around the world.)