Systems and methods for distributing and securing data

Abstract

A robust computational secret sharing scheme that provides for the efficient distribution and subsequent recovery of a private data is disclosed. A cryptographic key may be randomly generated and then shared using a secret sharing algorithm to generate a collection of key shares. The private data may be encrypted using the key, resulting in a ciphertext. The ciphertext may then be broken into ciphertext fragments using an Information Dispersal Algorithm. Each key share and a corresponding ciphertext. Fragment are provided as input to a committal method of a probabilistic commitment scheme, resulting in a committal value and a decommittal value. The share for the robust computational secret sharing scheme may be obtained by combining the key share, the ciphertext fragment, the decommittal value, and the vector of committal values.

1 . (canceled) 
     
     
         2 . A method for securing data by generating a set of data fragments, the method comprising:
 generating, by a hardware processor, a set of shares by applying a computational secret sharing scheme to the data;   for each particular share of the set of shares computing a respective first value that has a binding property and a hiding property with respect to the particular share;   for each particular share of the set of shares computing a respective second value usable to verify the first value;   generating a plurality of fragments, each fragment comprising: at least one share, at least one second value, and at least two first values computed for at least two shares; and   and storing each fragment on at least one data repository.   
     
     
         3 . The method of  claim 2  wherein each fragment comprises first values computed for each share of the set of shares. 
     
     
         4 . The method of  claim 2  wherein storing each fragment on at least one data repository comprises storing each fragment at a different geographic location. 
     
     
         5 . The method of  claim 2  wherein storing each fragment on at least one data repository comprises storing each fragment at different physical locations on the at least one data repository. 
     
     
         6 . The method of  claim 2  wherein the at least one data repository comprises a distributed file system. 
     
     
         7 . The method of  claim 2  wherein the computational secret sharing scheme is selected from the group consisting of the Shamir, Blakley, and Krawczyk secret sharing schemes. 
     
     
         8 . The method of  claim 2  wherein computing each first value comprises employing a probabilistic scheme. 
     
     
         9 . The method of  claim 2  further comprising transmitting the generated fragments over a plurality of communication channels. 
     
     
         10 . The method of  claim 9  wherein transmitting the generated fragments over a plurality of communication channels comprises transmitting each generated fragment over a different communication channel. 
     
     
         11 . The method of  claim 9  wherein transmitting the generated fragments over a plurality of communication channels comprises transmitting the data fragments over communication channels before storing the data fragments. 
     
     
         12 . A system for securing data by generating a set of data fragments, the system comprising:
 a hardware processor configured to:
 generate a set of shares by applying a computational secret sharing scheme to the data; 
 for each particular share of the set of shares compute a respective first value that has a binding property and a hiding property with respect to the particular share; 
 for each particular share of the set of shares compute a respective second value usable to verify the first value; 
 generate a plurality of fragments, each fragment comprising: at least one share, at least one second value, and at least two first values computed for at least two shares; and 
 and store each fragment on at least one data repository. 
   
     
     
         13 . The system of  claim 12  wherein each fragment comprises first values computed for each share of the set of shares. 
     
     
         14 . The system of  claim 12  wherein the hardware processor is configured to store each fragment on at least one data repository comprises storing each fragment at a different geographic location. 
     
     
         15 . The system of  claim 12  wherein the hardware processor is configured to store each fragment on at least one data repository comprises storing each fragment at different physical locations on the at least one data repository. 
     
     
         16 . The system of  claim 12  wherein the at least one data repository comprises a distributed file system. 
     
     
         17 . The system of  claim 12  wherein the computational secret sharing scheme is selected from the group consisting of the Shamir, Blakley, and Krawczyk secret sharing schemes. 
     
     
         18 . The system of  claim 12  wherein the hardware processor is configured to compute each first value by employing a probabilistic scheme. 
     
     
         19 . The system of  claim 12  wherein the hardware processor is configured to transmit the generated fragments over a plurality of communication channels. 
     
     
         20 . The system of  claim 19  wherein the hardware processor is configured to transmit the generated fragments over a plurality of communication channels by transmitting each generated fragment over a different communication channel. 
     
     
         21 . The system of  claim 19  wherein the hardware processor is configured to transmit the generated fragments over a plurality of communication channels by transmitting the data fragments over communication channels before storing the data fragments.