RU2804310C1 - Method of protection of information placed in external data storages - Google Patents

Abstract

FIELD: data storage.

SUBSTANCE: invention is related to a method for protecting information placed in external data storage. In the method, the primary information message, or a file, which is a sequence of minimum information units, is divided into several data streams, usually of different lengths, in a way known only to the owner of the information, so that each stream contains only a part of the minimum information units of the primary information message, while in order to obtain several data streams, a pseudo-random sequence is formed of numbers representing stream numbers with a length equal to the length of the sequence of minimum information units of the primary information message or file, and the generated pseudo-random sequence is superimposed on the sequence of minimum information units, comparing each minimum information unit of this sequence with the corresponding number from formed pseudo-random sequence to place this minimum unit of information in the data stream corresponding to this number, sending the generated data streams to different storage locations, including geographically remote ones, and to obtain the primary information message, the generated streams are extracted from the storage locations and combined into the original message by the method reversing the separation.

EFFECT: increasing the level of information protection in external data storage

2 cl, 4 dwg

Description

The scope of this invention relates to non-cryptographic methods of protecting information from unauthorized access during storage, transmission and processing of information.

Technical level

The following analogue is known from a patent search: “Method of securing data in storage device and storage device thereof)) (Patent US 8,930,623 B2; G06F 12/00 (2006.01); published January 6, 2015)

What is claimed is:

1. A method of securing data in a storage device, comprising:

(a) confirming whether there is a removable security device connected to the storage device when a host attempts to store a file into the storage device;

(b) segmenting the file into a first segment and a second segment, determining a size ratio of the second segment to the first segment, and rendering the second segment a size according to the size ratio when the removable security device is confimed being connected to the storage device;

(c) storing the first segment into the storage device and relocating the second segment from the storage device into the removable security device; and

(d) removing the removable security device from the storage device.

2. The method of claim 1, further comprising:

(e) connecting the removable security device to the storage device when the host attempts to access the file;

(f) loading the second segment from the removable security device; and

(g) combining the second segment with the first segment to restore the file.

3. The method of claim 1, wherein the size ratio is calculated according to an available storage volume of the removable security device to that of the storage device.

4. The method of claim 1, further comprising:

(h) directly storing the file into the storage device when the removable security device is confirmed not being connected to the storage device.

5. A method of securing data in a storage device, comprising:

(a) segmenting a file into a first segment and a second segment, determining a size ratio of the second segment to the first segment, rendering the second segment a size according to the size ratio, and storing both the first segment and the second segment into the storage device when-a host attempts to store the file into the storage device;

(b) confirming whether there is a removable security device connecterd to the storage device after step (a);

(c) relocating the second segment from the storage device into the removable security device when the removable security device is confirmed being connected to the storage device; and

(d) removing the removable security device from the storage device.

6. The method of claim 5, further comprising:

(e) connecting the removable security device to the storage device when the host attempts to access the file;

(f) loading the second segment from the removable security device; and

(g) combining the second segment with the first segment to restore the file.

7. The method of claim 5, wherein the size ratio is calculated according to an available storage volume of the removable security device to that of the storage device.

8. The method of claim 5, further comprising:

(h) detecting an available storage volume of the removable security device;

and

(i) if the size is larger than the available storage volume, modifying the size to be smaller than the available storage volume by moving part of the second segment back to combine with the first segment.

9. A storage device containing:

a first bus configured to be connected to a host device;

a second bus configured to be connected to a removable security device;

a memory; and

a controller coupled to the first bus, the second bus, and the memory, the controller being configured to receive a file from the host device via the first bus, to confirm whether the removable security device is connected to the second bus, to segment the file into a first segment and a second segment, to determine a size ratio of the second segment to the first segment, to render the second segment a size according to the size ratio, and to store the first segment into the memory and to relocatethe second segment through the storage device into the removable security device when the removable security device is confirmed, by the controller, being connected to the second bus.

10. The storage device of claim 9, wherein when the host device attempts to store the file into the storage device, the controller is configured to segment the file into the first segment and the second segment when the removable security device is confirmed being connected to the second bus.

11. The storage device of claim 10, wherein when the host device attempts to access the file, the controller is further to load the second segment from the removable security device and combine the second segment with the first segment to restore the file when the removable security device is confirmed being connected to the second bus.

12. The storage device of claim 9, wherein the size ratio is calculated according to an available storage volume of the removable security device to that of the storage device.

13. The storage device of claim 9, wherein the controller is further configured to segment the file into the first segment and the second segment and to store both the first segment and the second segment into the memory when the file has been received by the storage device from the host device, and then to relocate the second segment from the memory to the removable security device when the removable security device is confirmed being connected to the second bus.

14. The storage device of claim 13, wherein when the host device attempts to access the file, the controller is further to load the second segment from the removable security device and combine the second segment with the first segment to restore the file when the removable security device is confirmed being connected to the second bus.

15. The storage device of claim 13, wherein the size ratio is calculated according to an available storage volume of the removable security device to that of the storage device.

16. The storage device of claim 13, wherein the controller is further configured to detect an available storage volume of the removable security device, and to modify the size to be smaller than the available storage volume by moving part of the second segment back to combine with the first segment if the size is larger than the available storage volume.

What is claimed is:

1. A method for protecting data in a storage device, including:

(a) confirming the presence of a removable security device connected to the storage device when the host attempts to save a file to the storage device;

(b) segmenting the file into a first segment and a second segment, determining a size ratio of the second segment to the first segment, and sizing the second segment according to the size ratio when the removable security device is connected to the storage device;

(c) storing the first segment into a storage device and moving the second segment from the storage device to a removable security device; And

(d) removing the removable security device from the storage device.

2. The method according to claim 1, additionally including:

(e) connecting a removable security device to the storage device when the host attempts to access the file;

(f) loading the second segment from the removable security device; And

(g) merging the second segment with the first segment to recover the file.

3. The method according to claim 1, wherein the size ratio is calculated in accordance with the available memory capacity of the removable protective device to the capacity of the storage device.

4. The method according to claim 1, additionally including:

(h) directly saving the file to the storage device when it is confirmed that the removable protective device is not connected to the storage device.

5. A method for protecting data in a storage device, including:

(a) segmenting the file into a first segment and a second segment, determining the size ratio of the second segment to the first segment, sizing the second segment according to the size ratio, and storing both the first segment and the second segment into a storage device when the host attempts to store the file in Memory device;

(b) confirming the presence of a removable security device connected to the storage device after step (a);

(c) moving the second segment from the storage device to the removable security device when it is confirmed that the removable security device is connected to the storage device; And

(d) removing the removable security device from the storage device.

6. The method according to claim 5, additionally including:

(e) connecting a removable security device to the storage device when the host attempts to access the file;

(f) loading the second segment from the removable security device; And

(g) merging the second segment with the first segment to recover the file.

7. The method according to claim 5, wherein the size ratio is calculated in accordance with the available memory capacity of the removable protective device to the capacity of the storage device.

8. The method according to claim 5, additionally including:

(h) detecting the available storage capacity of the removable protective device; And

(i) if the size is larger than the available storage capacity, resizing to be smaller than the available storage capacity by moving part of the second segment back to merge with the first segment.

9. A storage device containing:

a first bus configured to connect to a host device;

a second bus configured to connect to a removable security device; memory; and

a controller connected to a first bus, a second bus, and a memory, wherein the controller is configured to receive a file from a host device via the first bus to confirm whether a removable security device is connected to the second bus, to segment the file into a first segment and a second segment to determine a relationship sizes of the second segment to the first segment to display the size of the second segment according to the aspect ratio, and store the first segment in memory and move the second segment through the memory to the removable protective device when the controller confirms that the removable protective device is connected to the second bus.

10. The storage device of claim 9, wherein when the host device attempts to save a file to the storage device, the controller is configured to divide the file into a first segment and a second segment when it is confirmed that the removable security device is connected to the second bus.

11. The storage device of claim 10, wherein when the host device attempts to access a file, the controller further loads a second segment from the removable security device and combines the second segment with the first segment to recover the file when the removable security device is confirmed to be connected to the second bus. .

12. The storage device according to claim 9, wherein the aspect ratio is calculated according to the available storage capacity of the removable security device and the storage device.

13. The storage device of claim 9, wherein the controller is further configured to segment the file into a first segment and a second segment and to store both the first segment and the second segment in memory when the file has been received by the storage device from the host device, and then to move the second segment from memory to the removable protective device when it is confirmed that the removable protective device is connected to the second bus.

14. The storage device of claim 13, wherein when the host device attempts to access the file, the controller further loads a second segment from the removable security device and combines the second segment with the first segment to recover the file when the removable security device is confirmed to be connected to the second bus.

15. The storage device according to claim 13, wherein the size ratio is calculated in accordance with the available memory capacity of the removable protective device to the capacity of the storage device.

16. The storage device of claim 13, wherein the controller is further configured to detect available storage capacity of the removable security device and resize it to be smaller than the available storage.

The essence of the invention is that the source file is divided into 2 segments, of which 1 segment is placed and stored on the internal host device for storage, and segment 2 is placed on a removable security device for storage. Moreover, the ratio of the sizes of both files is determined depending on the free amount of memory in the storage location. Then, when the host tries to access the source file, a removable security device with 2 segments is inserted, downloaded and merged with 1 segment, thus forming the source file.

Flaws:

• Strong dependence of the size (volume) of the 2nd segment for recording on a removable security device on the memory of this device, which may impose restrictions on the operational use of this method in everyday life.

• If the removable security device is lost, the information is lost forever.

• The advantages of storing information in various data storage locations, including geographically remote ones, are not used.

• Mandatory storage of one of the segments on the host.

• It is theoretically possible that it will be impossible to use this method, provided that there is limited memory on both the host (internal storage device) and on the removable security device, such that it will not be possible to adequately form 2 segments of the source file for storing them using this method.

• Depending on the format of the source file, and also if such a small part of the source file is stored on a removable device or on the internal device of the host that having another much larger part of it will make it possible to restore the original data with a high probability. This is possible because The patent does not provide for the protection of information in each segment.

The main prototype was “Data distribution methods and systems”) (Patent US 10,216,822 B2; G06F 17/30584 (2013.01); G06F 17/30135 (2013.01); G06F 17/30194 (2013.01) ; G06F 21/62 (2013.01); H04L 9/085 (2013.01); published February 26, 2019)

DATA DISTRIBUTION METHODS AND SYSTEMS

Abstract

Methods and related systems for secured and distributed data storage and communication are disclosed. For each byte of a given data set or file, data is split at the bit level and reassembled into a given number of meaningless data sets or files. One or more parity files are also generated to ensure availability and integrity of the data at all times. Each file is sent to a different and typically geographically distinct data storage location. When the information is required, the reverse process takes place. The only place where the information is reconstructed and accessible is at the point where it is required (the authorized users' computing devices or the organization's network reassembly point). The source information is never stored or accessible in any single storage location, making it highly secured. The process can be embodied into a system through various forms, including software, firmware, hardware or combination thereof.

DATA DISTRIBUTION METHODS AND SYSTEMS

annotation

Methods and corresponding systems for secure and distributed data storage and communication are disclosed. For each byte of a given data set or file, the data is broken down at the bit level and reassembled into a given number of meaningless data sets or files. One or more parity files are also created to ensure data availability and integrity at all times. Each file is sent to a different and usually geographically different data storage location. When information is required, the reverse process occurs. The only place where information is recovered and accessible is the place where it is required (the computing devices of authorized users or the point of reassembly of the organization's network). The original information is never stored or accessed in any one storage location, making it highly secure. The process may be implemented in a system through various forms, including software, firmware, hardware, or a combination thereof.

The invention claimed is:

1. A computer-implemented method for partitioning a data set and storing dam set parts at different data storage locations, the data set comprising a plurality of bytes, each of the bytes comprising a plurality of bits, the method comprising;

a) for each pair of bytes in the data set:

i) generating a first byte comprising a portion of the bits from one of the pair of bytes and a portion of the bits from the other of the pair of bytes, each of the portions of the bits being a predetermined sequence of bits ensuring that the first byte may not be used to determine the content, of the data set;

ii) generating a second byte comprising the remaining bits from the one of the pair of bytes, and the remaining bits from the other of the pair of bytes, each of the portions of the bits being, a predetermined sequence of bits ensuring that the second byte may not be used to determine the content of the data set;

iii) generating a parity byte from the first byte and the second byte;

b) generating a first data set part from, all the first bytes:

e) generating a second data set part from all the second

bytes;

d) generating a parity part from ail the parity bytes;

e) staring the first data set part at a first data storage location;

g) storing the second data set part at a second data storage location;

h) storing the parity part at a third data storage location; wherein ail three locations are different from each other, and wherein, for each pair of bytes in the data set, the portion, of the bits from the one of the pair of bytes comprises half the bits -from the one of the pair of bytes , the portion of the bits from the other of the pair of bytes comprises half the bits from the other of the pair of bytes, the remaining bits from the one of the pair of bytes comprise the remaining half of the bits from, the one of the pair of bytes, and the remaining bits from the other of the pair of bytes comprise the remaining half of the bits from the other of the pair of bytes.

2. A method as claimed m claim 1, wherein, for each pair of bytes in the data set, the half of the bits from the one of the pair of bytes comprises all odd bits from the one of the pair of bytes, the half of the bits from the other of the pair of bytes comprises all odd bits from the other of the pair of bytes the remaining half of the bits from the one of the pair of bytes comprises all even bits from the one of the pair of bytes, and the remaining 'half of the bits from the other of the pair of bytes comprises all even, bits from the other of the pair of bytes.

US 10,216,

eleven

3. A computer-implemented system for partitioning a data set and storing data set parts at different data storage locations, the data set comprising a plurality of bytes, each of the bytes comprising a plurality of bits, the system comprising: ⁵

a) at least one processor:

b) for each pair of bytes in the data set?

i) generating a first byte comprising a portion of the bits from, one of the pair of bytes and a portion of the bits from the other of the pair of bytes each of the portions of the bits being a predetermined sequence of bits ensuring that the first byte may not be used to determine the content of the data set;

ii) generating a second byte comprising the remaining bits from the one of the pair of bytes, and the remaining bits from, the other of the pair of bytes, each of the portions of the bits being a predetermined sequence of bits ensuring that the second byte may not be used to determine the content of the data set,

iii) generating a parity byte from the first byte and the second byte,

b) generating a first data set part from all the first bytes;

c) generating a second data set part from all the second bytes;

d) generating a parity part from all the parity bytes:

e) storing the first data set part at a first data storage location;

f) storing the second data set part, at a second data storage location;

g) storing the parity part at a third data storage location; wherein all three locations are different from each other; wherein, for each pair of bytes ill the data set, the portion of the bit s from the one of the pair of bytes comprises half the bits from the one of the pair of bytes, the portion of the bits from the other of the pair of bytes comprise half the bits from the other of the pair of bytes, the remaining bits from the one of the pair of bytes comprise the remaining half of the bits from the one of the pair ofbytes, and the remaining bits from the other of the pair of bytes comprise the remaining half of the bits from the other of the pair of bytes.

4. A system as claimed, in claim 3, wherein, for each pair of bytes in the data set, the half of the bits from, the one of the pair of bytes comprises all odd bits from the one of the pair of bytes, the half of the bits from the other of the pair of bytes comprises all odd bits from the other of the pair of bytes, the remaining half of the bits from the one of the pair of bytes, comprises all even bits from the one of the pair of bytes, and the remaining half of the bits from the other of the pair of bytes comprises all even bits from the other of the pair of bytes.

Claimed invention:

1. A computer-implemented method of dividing a data set and storing portions of the data set in different data storage locations, the data set comprising a plurality of bytes, each of the bytes comprising a plurality of bits, the method comprising:

a) for each pair of bytes in the data set:

i) generating a first byte comprising a portion of bits from one pair of bytes and a portion of bits from another pair of bytes, each of the portions of bits being a predetermined sequence of bits ensuring that the first byte cannot be used to determine the contents of the data set;

ii) generating a second byte containing the remaining bits from one pair of bytes and the remaining bits from the other pair of bytes, each of the bits being a predetermined sequence of bits ensuring that the second byte cannot be used to determine the contents of the data set;

iii) forming a parity byte from the first byte and the second byte;

b) forming the first part of the data set from all the first bytes;

c) forming the second part of the data set from all second bytes;

d) forming a parity part from all parity bytes;

e) storing the first part of the data set in a first data storage location;

g) storing a second portion of the data set in a second data storage location;

h) storing the parity portion in a third data storage location; where all three locations are different from each other, and where for each pair of bytes in the data set, some bits from one pair of bytes include half the bits from one pair of bytes, some bits from another pair of bytes contain half the bits from another pair of bytes, the remaining bits from one pairs of bytes make up the remaining half of the bits from one pair of bytes, bytes, and the remaining bits from another pair of bytes make up the remaining half of the bits from another pair of bytes.

2. The method according to claim 1, characterized in that for each pair of bytes in the data set, half the bits from one pair of bytes contain all the odd bits from one pair of bytes, half the bits from the other pair of bytes include all odd bits from the other pair of bytes, the remaining half the bits from one pair of bytes include all the even bits from one pair of bytes, and the remaining half of the bits from the other pair of bytes include all the even bits from the other pair of bytes.

3. A computer-implemented system for dividing a data set and storing portions of the data set in different data storage locations, the data set comprising a plurality of bytes, each of the bytes containing a plurality of bits, the system including:

a) at least one processor;

b) for each pair of bytes in the data set:

i) generating a first byte comprising a portion of bits from one pair of bytes and a portion of bits from another pair of bytes, each of the portions of bits being a predetermined sequence of bits ensuring that the first byte cannot be used to determine the contents of the data set;

ii) generating a second byte containing the remaining bits from one of the pair of bytes and the remaining bits from the other of the pair of bytes, each of the bits being a predetermined sequence of bits ensuring that the second byte cannot be used to determine the contents of the data set;

iii) forming a parity byte from the first byte and the second byte;

b) forming the first part of the data set from all the first bytes;

c) forming the second part of the data set from all second bytes;

d) forming a parity part from all parity bytes;

e) storing the first part of the data set in a first data storage location;

f) storing a second portion of the data set in a second data storage location;

g) storing the parity portion in a third data storage location; wherein all three locations are different from each other, wherein for each pair of bytes in the data set, some bits from one pair of bytes include half the bits from one pair of bytes, some bits from another pair of bytes include half the bits from another pair of bytes, the remaining bits from one pair of bytes makes up the remaining half of the bits from one pair of bytes, and the remaining bits from another pair of bytes make up the remaining half of the bits from the other pair of bytes.

4. The system of claim 3, wherein for each pair of bytes in the data set, half the bits from one pair of bytes include all odd bits from one pair of bytes, half the bits from another pair of bytes include all odd bits from the other pair of bytes, the remaining half of the bits from one pair of bytes includes all the even bits from one pair of bytes, and the remaining half of the bits from the other pair of bytes includes all the even bits from the other pair of bytes.

The essence of the invention is that the method in accordance with the principles of the present invention radically changes the common practice and paradigm of storing information in one physical and geographic location or with one specific service provider. In its basic form, the method in accordance with the principles of the present invention splits the original data (for example, a computer file) by obtaining parity bits through mod2 addition (or XOR), usually for each byte, into a certain the number of necessarily equal parts, in relation to the parity files (i.e. if the source data is divided into 2 parts, then the parity file is 1, if into 3 parts, then 2) and sends each of these parts to a different location (data processing center, network location, workstation, local server, USB drive, etc.), depending on the requirements of the user or organization. Information is never stored in the same place, and since each piece is organized in a way that makes it meaningless, the service provider or anyone else targeting the storage location will never be able to access the original information. The parity file allows you to restore the original information if one of the original data is lost. And if there were several parts and, accordingly, parity files of 2 or more, then using only parity files to restore the original information, even if all its original parts are lost.

When original data is required, the method is performed in reverse order. It will retrieve each piece of data from different places and assemble it at the bit level, typically on a per-byte basis, to produce the raw data. The only place where information is fully accessible and readable is the place where it is required (the user's computing device or the organization's network reassembly point).

Since one or more of the generated parts are composed of parity data from other parts, the availability of the original data is generally always guaranteed in the event that one or more locations become unavailable. Since no location has access to the information, and since no location is “essential” to the availability and integrity of the information, it is no longer necessary to implement all the security measures that are typically required to ensure a high level of information security.

Flaws:

• An integral part of the patent (US 10,216,822 B2) is obtaining parity bits by adding modulo 2 (mod2), also known as exclusive “or” (XOR) (Fig. 1-7; description of Fig. p. 3 (from line 61 )-10; pp. 10-12 (claims)). This requires equal lengths of bit sequences located in different stores. If an attacker gains access to all the sequences, he can easily restore the original message by simple combination. Moreover, with 2 sequences, there are only two combinations. For example, by splitting the bit sequence into even/odd order (p. 10 (line 18)-12), 2 flows are formed; if both of them are present, the attacker has only 2 hacking combinations (with this option). The other options proposed in the patent do not complicate matters much.

• The so-called “one or more parity files” increase the degree of information protection in case of loss of part or complete loss, but also create additional risk precedents, because in particular, in all descriptions of figures 5-7 (US patent 10,216,822 B2, p. 6, lines 41-55; p. 7, lines 51-67; p. 8-9, lines 63-67, 1-47) it is said that if part of a message is lost or damaged, the original message is easily restored using parity files, which are also sent to the storage location or locations, and one of the fragments of the original file. But it is also noted that if all fragments of the original file are lost, the original file can be restored using parity files. This feature of parity files allows an attacker, having obtained a parity file and 1 fragment of the source file, to restore the entire source file, or, having obtained all the parity files, it is possible to completely restore the source file without knowing at least one of its fragments. Important vulnerabilities of this method include the fact that “parity files” require equal lengths of bit sequences, this leads to the fact that when an attacker receives 1 fragment and a “parity file” or only parity files or all fragments (figures 5-7 of the patent US 10,216,822 B2, page 6, lines 41-55; page 7, lines 51-67; page 8-9, lines 63-67, 1-47), then he will be able to get the original converted nonsense files, as can be seen in fig. 1 in a bold frame (note - one of the fragments is crossed out, but due to the parity file, all fragments are obtained, although still meaningless for an attacker), and since they are always equal, it will be much easier to combine the source file than if they were of different lengths, including because there are much fewer ways of equal division than dividing the original message into files of arbitrary length (this is Fig. 5 from US patent 10,216,822 B2).

• The method according to US patent 10,216,822 B2 is implemented on the “Virtual Online Data Distribution System and Method”, abbreviated as the VODD system, which appears repeatedly in the description of figures when using a method for secure and distributed data storage and communication. This increases risks, because The attacker may not hack a specific message, but hack the VODD system, where the entire customer base, their messages, storage locations and parity files will be provided (US Patent 10,216,822 B2, p. 4, lines 31-33). Here patent holders contradict themselves, because US patent 10,216,822 B2 states that in particular (US patent 10,216,822 B2, page 1, line 51 - page 2, line 5) the attractiveness of a company often depends on the regulatory framework of the country where it is legally located. Therefore, because the client can apply the method only through the VODD system, then this retains all the specified risks in (US patent 10,216,822 B2, page 1, line 60 - page 2, line 5), and in (US patent 10,216,822 B2, page 1, line 51 - 59) talk about the constant increase in subcontracting between service providers, which increases risks and reduces efficiency. But at the same time, the US patent 10,216,822 B2 itself proposes to increase this chain through the VODD system, and the consumer is invited to take the word of this corporation (VOD2 INC.) when providing its services and provide it with their personal data at their own peril and risk.

The goal is to ensure a high level of information protection (for example, confidentiality, integrity and availability) during transmission, storage and processing in cloud services and external data storage.

The problem is solved as follows:

clause 1. The method of protecting information placed in external data storage is to take the primary information message (file) as a sequence of minimal units of information (bits, trits, etc. depending on the computer architecture), which are distributed across several streams, usually of different lengths, in a manner known only to the owner of the information, so that each stream contains only part of the units of the primary information message, after which the streams are sent to different storage locations, including geographically distant ones; if necessary, these streams are extracted from storage locations and combined into the original message in the reverse way of splitting.

clause 2. The method according to clause 1, characterized in that they additionally use methods of cryptographic information protection at any stage of the procedure.

The proposed method is illustrated by drawings in figures 2, 3, 4.

Figure 2 shows a method for protecting information located in external data storage.

Legend in Figure 2:

1 - the initial sequence of minimal units of information, hereafter referred to as “bits” for simplicity;

2 - instructions specifying the number and order of formation of new bit sequences in a manner known only to the owner of the information;

3, 4, …, n - new bit sequences;

5, 6, …, m - cloud services or external data storage

A method for protecting information located in external data storages (Figure 2), which consists in the fact that the bits of the primary information message (block 1) are formed and converted into several (two or more) (blocks 3, 4, n) new bit sequences, according to order specified by the instructions (block 2), so that in each new sequence of bits (blocks 3, 4, n) without using encryption, bytes are formed (traits, etc., depending on the computer architecture; hereafter, for simplicity, the term “byte” is used "), different from the bytes of the primary information message (block 1). As a result, when transmitting received sequences (blocks 3, 4, ..., n) via communication channels or placing them on external data storages (blocks 5, 6, ..., n), restoration of the primary information message or any part of it becomes impossible without knowledge of all sequences of bits (blocks 3, 4, ..., n) and knowledge of instructions (block 2) describing the order of division of the bits of the original digital information (block 1).

Legend in Figure 3:

An example of using a method for protecting information located in external data storages (Figure 3), which consists in creating a pseudo-random sequence of numbers (thread numbers) 1, 2, 3 of length L (block 11) and this sequence is superimposed on the original sequence of binary bits from block 12. Then the bits of the original sequence (block 12) are distributed over three streams (blocks 13, 14, 15) according to a pseudo-random sequence (stream numbers) (block 11).

Legend in Figure 4:

An example for P. 1 of using a method for protecting information placed in external data storage for ternary logic (Figure 4), which consists in creating a pseudo-random sequence of numbers (thread numbers) 1, 2, 3 of length L (block 21) and this sequence is superimposed on the original sequence of ternary units of information (trits) from block 22. Then the trits of the original sequence (block 22) are distributed over three threads (blocks 23, 24, 25) according to a pseudo-random sequence (thread numbers) (block 21).

The procedure according to the formula:

The proposed method of protecting information located in external data storage is implemented by the following sequence of actions (bits still mean any minimal unit of information depending on the computer architecture: bit, trit, etc.):

1. The primary information message (file) is taken

2. A law is formed for distributing units of information across flows, and the sequence of units in flows may differ from their sequence in the original message.

3. Using a program that, based on the bits of the primary information message, generates several (two or more) streams of bits, usually of different lengths, so that the bits in each of the generated streams coincide only with part of the bits of the primary information message, and combining these bits of the streams in a certain way into the original sequence, will allow you to restore the primary information message (for example, a pseudo-random sequence of numbers (thread numbers) 1, 2, 3 of length L (block 11) is created and this sequence is superimposed on the original sequence of bits from block 12. Then the bits of the original sequence (block 12) are distributed over three streams (blocks 13, 14, 15) according to a pseudo-random sequence (stream numbers) (block 11) (Figure 3)).

4. The bytes resulting from the bits in each stream are sent to cloud services or external data stores or both (user defined).

5. If it is necessary to use the primary message, the bytes of secondary information are removed from their storage locations and, using a program that divides these bit streams into bits and combines them according to the principle of their reverse formation, the bit sequence of the primary message is restored.

Because patent US 10,216,822 B2 is the main prototype and the issue of priority of “novelty” between the proposed application for an invention and patent US 10,216,822 B2 is considered here.

It is considered necessary to consider the significant differences of the proposed invention:

• This method allows you to generate and convert primary digital information into two or more bit sequences, usually of different lengths.

• The proposed method allows you to generate and transform primary digital information in an arbitrary or pseudo-random manner.

• Also, the method is implemented by the user himself directly from any computer or suitable computer, converting and sending the original message to storage locations, without using the services of third parties.

• The very principle of the formation and transformation of primary digital information is generated by the user from his computer or any other device.

• Knowing all the bit sequences of the original message without knowing the instructions by which the message was divided, it is almost impossible to restore the original information.

• The proposed method does not require the mandatory creation of a parity file, and as a result, the splitting of the source file into parts equal in the number of bits.

• Unlike patent US 10,216,822 B2, in the formula of the proposed method it was possible to express this idea, a new paradigm in the field of information security, in strict lexical forms, which significantly expanded the claims of the patent holders.

• Also in the patent (US 10,216,822 B2) in the abstract it is stated that the claimed method allows you to store data in any number of data storages (for example, in the description of figures 6 and 7 on page 7 lines 51-67 and on page 8 lines 63- 67 indicates 4 possible storage locations and a larger number is assumed), but the formula describes the use of the claimed method only for placing the original information with the received parity file (only one) in only 3 storage locations (respectively, 1 storage location for the parity file and only 2 locations storage for 2 modified files of source information) (and despite the fact that in paragraph 3 of the formula on pp. 11-12 lines 1-3 it is said that the number of storage locations may be different, but further in the same sentence when listing that , what the proposed system contains, in paragraph (b), which describes the technology of the proposed method, it is clearly indicated that only 3 storage locations are used (lines p. 11 lines 4-26 and p. 12 lines 1-15)). Because Only the formula in the patent has legal force; this can be considered an important limitation for the implementation of this method, because there can be significantly more storage locations without any losses during use. Those. in the patent (US 10,216,822 B2), the formula specifies a limitation on the use of storage locations (no more than 2, considering that the 3rd storage location is always allocated for the parity file).

• The fundamental difference of the proposed method, according to our formula, is the division in a reversible random or pseudo-random manner, while the bits of primary digital information are placed in two or more bit sequences, usually of different lengths. An integral part of the patent (US 10,216,822 B2) is obtaining parity bits by adding modulo 2 (mod2), also known as exclusive “or” (XOR) (Fig. 1-7; description of Fig. p. 3 (from line 61) -10; pp. 10-12 (claims)). This requires equal lengths of bit sequences located in different stores. If an attacker gains access to all the sequences, he can easily restore the original message by simple combination (one of the reasons for this statement was indicated in the 1st paragraph of the shortcomings of this patent). Moreover, with 2 sequences, there are only two combinations. For example, by splitting the bit sequence into even/odd order (p. 10 (line 18)-12), 2 streams are formed; if both of them are present, the attacker has only 2 hacking combinations. Other options proposed in the patent do not complicate the matter much .

• It is also worth paying attention to the fact that the patent (US 10,216,822 B2) proposes a particular method of the general principle (p. 10-12, from line 18), the wording of this application for an invention is more general. This formulation allows you to implement any method, including the method in the patent (US 10,216,822 B2) as a special case. These differences are fundamental.

Claims (6)

1. A method of protecting information located in external data storages, containing the stages of: split the primary information message or file, which is a sequence of minimal information units, into several data streams, usually of different lengths, in a manner known only to the owner of the information, so that each stream contains only part of the minimal information units of the primary information message, in this case, to obtain several data streams, a pseudo-random sequence of numbers representing stream numbers is formed with a length equal to the length of the sequence of minimal information units of the primary information message or file, and the generated pseudo-random sequence is superimposed on the sequence of minimal information units, matching each minimal information unit with this sequence the corresponding number from the generated pseudo-random sequence to place this minimum unit of information in the data stream corresponding to this number, direct generated data streams to different storage locations, including geographically remote ones, to obtain the primary information message, the generated streams are retrieved from storage locations and combined into the original message in the reverse way to the separation method. 2. The method according to claim 1, characterized in that they additionally use methods of cryptographic information protection at any stage of the method.