How to protect your content from unauthorized access

Abstract

A reordering algorithm using modular arithmetic is applied to the cells of one or more specific fields of a database or other file type. The reordering hides relationships between the cells of the reordering field(s) and other information of the associated records by changing the order of the cells of the specific field(s) without changing the content of any individual cells. The reordering algorithm may use modular addition and modular subtraction in any order. Different reordering algorithms may use different numbers of parameters. To locate a specific cell in the reordering field, the modular arithmetic applies the parameter(s) from the reordering, an identification of a specific record associated with the cell, and an identification of the specific reordering field. An inverse modular arithmetic may obtain a specific record with which a specific cell in the reordering field is associated.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

[0001]

[0001] This application claims the benefit under 35 U.S.C. § 119(e) of U.S. Provisional Patent Application No. 63 / 153,352, entitled "Protection of Databases, Data Transmissions and Files without Encryption," filed on February 24, 2021, the entire disclosure of which is incorporated herein by reference. [Technical field]

[0002]

[0002] This disclosure relates generally to computer data security, and more particularly to protecting databases and other types of computer files by using modular arithmetic to rearrange fields within columns or rows without encrypting the contents or modifying the individual data in the database.

[0003]

[0003] Protecting computer data from access by malicious parties such as hackers is of paramount importance. More and more of the world's data is stored online (e.g., in corporate, government, university, and other organizational databases, as well as corporate and personal accounts on various cloud-based storage services). Despite the use of data encryption and other traditional security protocols (such as firewalls and dual authentication) with varying degrees of effectiveness, hacks into data stored online are often successful. Government, corporate, and personal information, which is often private and highly sensitive, is often illegally accessed, stolen, sold, and / or used for illicit purposes, such as espionage, ransomware, blackmail, financial fraud, and other criminal activities.

[0004]

[0004] Data stored online is usually protected by encryption. Encryption is the process of encoding information. It converts the original data, called plaintext, into an unintelligible form called ciphertext. Encryption is usually based on encrypting the plaintext into ciphertext using a pseudorandom encryption key. The ciphertext can be decrypted back to plaintext with the use of a decryption key given to an authorized person. There are many different techniques for encryption. Modern encryption usually utilizes public key (asymmetric) or symmetric key methods.

[0005] Hackers use a variety of techniques to decrypt ciphertext without having the decryption key. These techniques usually require significant computing power, but powerful computing resources are readily available and not prohibitively expensive, even at the levels required to break modern commercial-grade encryption. Hackers and computer security experts are constantly engaged in a "cat and mouse" game: hackers try to stay one step ahead of security experts, who then "improve their skills" to catch up or, hopefully, stay ahead of the hackers.

[0006]

[0006] A property of encryption is that successful decryption of the ciphertext is immediately evident: the ciphertext is incoherent, while the plaintext is clearly readable. When a hacker attempts to decrypt the ciphertext, it is immediately evident when he has been successful.

[0007] It would be desirable to address these issues.

[0008]

[0008] Sensitive content, such as personal or financial information, in a database or other type of file is protected from unauthorized access by hiding the relationship between the sensitive content and other related data. For example, in the case of a database, the relationship between the field containing the protected information and each associated database record is hidden. To this end, a permutation algorithm using modular arithmetic is applied to the cells of one or more specific fields of the database. This permutation changes the order of the cells of the specific field(s) without changing the content of any individual cell. The permutation field still contains all the original cells in the permutation order, thus hiding the relationship between the cells of the permutation field(s) and other information of the associated record. Typically, databases store fields in columns and records in rows, in which case permutation of the cells of a specific field of the database is a form of application of a permutation algorithm to the cells of the column containing that field. In one embodiment where the database stores fields in rows and records in columns, permutation of a field is a form of permutation of the corresponding row.

[0009]

[0009] The reordering algorithm may be in the form of a bijective function using modular arithmetic, for example by using modular addition and modular subtraction in any order. Different implementations may apply other reordering algorithms using a single parameter or different numbers of multiple parameters. Using more parameters provides a higher level of security, but generally at the expense of using more computational resources. Different implementations may apply different trade-offs between security and computational resource usage as required in different scenarios.

[0010]

[0010] The one or more parameters used in the step of applying the reordering algorithm may be applied in a modular operation to locate the particular cell in the reordering field. It is understood that the particular cell to be located is associated with a particular record as a result of the reordering, but is not located within the particular record. To locate the cell, the one or more parameters, an identification of a particular record with which the particular cell in the reordering field is associated, and an identification of the particular reordering field are applied in a modular operation to locate the particular cell in the reordering field.

[0011]

[0011] The inverse modular operation may be adapted to obtain a particular record with which the particular cell in the sorting field is associated but in which the particular cell is not located. More specifically, via one or more parameters used in the step of applying the sorting algorithm, an identification of the particular record in which the particular cell of the sorting field is located and an identification of the particular sorting field are applied in the modular operation to locate the particular record with which the particular cell in the sorting field is associated.

[0012] In some embodiments, the content of a particular type of file is protected from unauthorized access by hiding relationships between units of the content of the file other than in a database. To this end, one or more segment sizes of the particular type of file may be determined. The file is then partitioned into a linear arrangement of segments of the determined size(s). The linear arrangement may be treated as a series of rows and columns, and the segments may be partitioned into a linear arrangement of segments of the determined size(s). in Fills the cells of the row and column MayDifferent segments resulting in cells of different columns may have different sizes. The cells of a particular column or row (or multiple columns or rows) may be reordered by applying a reordering algorithm using modular arithmetic as described above to the cells of the particular column or row, which reorders the cells without modifying the content of any individual cell. The reordered column(s) or reordered row(s) still contain all the original cells in the reordered order, thus hiding the relationships between the cells of the reordered column(s) or reordered row(s) and the other cells of the file.

[0013]

[0013] The reordering function described herein does not allow the secured database (or other type of file) to change the contents of any cells in the unsecured ("clear") database. Thus, if a cell records the number of purchases of a product by a particular customer, or someone's birthdate, or a doctor's prognosis description, each of these values ​​remains unchanged during security. As long as a birthdate is not tied to its context (whose birthdate it is), it cannot, by itself, be a potentially damaging piece of data if it falls into the wrong hands. Security is achieved by changing the position of the contents of this cell, so that it can no longer be tied to a name or other context information. Since moving a birthdate to the "Diagnosis" column would gain nothing, the position of the contents of any given cell is changed within the column. Once security is in place, the "Birthdate" column will only contain birthdates, the "Practitioner" column will only contain practitioner names, and the "Credit Limit" column will only contain credit limits. By changing positions within a column in this way, [a] the number of rows is preserved, [b] specific positions (usually different from their original positions) are assigned to the cells, and [c] each destination position is unique (e.g., the contents of {row 4, column 17} and the contents of {row 27, column 17} cannot both be placed in {row 62, column 17}). These properties are satisfied if moving cell data within a column is a reordering (a reordering of an ordered set). In fact, any method of moving the content of cells within a column that satisfies [a], [b], and [c] is a reordering.

[0014]

[0014] Systematic reordering of cell contents within a column requires modular operations, meaning that the operations are designed to ensure that cell contents are not moved to rows outside the set of rows in the unprotected database. In a reordering of 10,000 rows, the contents of any cell must be moved to at least the row numbered 0 (the top row) and at most to the row numbered 9,999 (the bottom row). If the extent of moving cell contents downwards or upwards is random, then the randomization is controlled so that [c] above is satisfied.

[0015]

[0015] This approach allows the data needed to answer queries (e.g., "Which of Dr. X's patients have also been seen by Dr. Y?" or "What were the total frozen food sales last week from customers in zip code 90084?") to be obtained directly from the protected database. This relies on the fact that in the protected database, the zip code at {row 27, column 17} does not relate to the frozen food sales at {row 27, column 43}, but rather to, say, the frozen food sales at {row 196, column 43} (where 196 is derived from 27 by the modular arithmetic used to protect the database).

[0016]

[0016] However, suppose that the reason why it is desirable to protect a file is not a database that requires frequent and secure queries by an organization, but rather some kind of file that is digitally stored for possible future use and contains highly sensitive, confidential or proprietary information. Any kind of file that requires digital storage but needs to be securely protected can be considered, such as confidential contracts, dated files of images that can prove that the owner had them on a certain date, telephone call records, etc. The sorting function described herein can be used to protect any kind of file, making the protected file more secure than encryption.

[0017]

[0017] Any kind of file can be protected as described herein, be it an image file, an audio file, a text file, etc. To a computer device, the file appears as a single, possibly very long, line of hexadecimal characters. After dividing the line into segments, perhaps 4 bytes each (or another chosen length), these segments can be converted into rectangles, perhaps 1000 rows across 2400 columns each, where each "cell" in {row R, column C} consists of, say, 4 bytes. Now, by rearranging the columns using modular arithmetic, a protected file is produced that is much more difficult to deprotect (or even to recognize, say, that it is a call recording) than if it were protected by encryption.

[0018]

[0018] The features and advantages described in this summary and the detailed description below are not all-inclusive, and many additional features and advantages may become apparent to those skilled in the relevant art, particularly in light of the drawings, specification, and claims of this specification. Furthermore, it should be noted that the expressions used in this specification have been selected primarily for ease of reading and instructional purposes, and may not have been selected to define or limit the subject matter of the present invention, and that the scope of the subject matter of the present invention should be determined by relying on the claims. [Brief description of the drawings]

[0019] [Figure 1] FIG. 1 is a block diagram of an exemplary network architecture in which a reordering-based data protection system may be implemented, according to some embodiments.

[0020] [Diagram 2] FIG. 2 is a block diagram of the operation of a reordering-based data protection system in the context of database protection, according to some embodiments.

[0021] [Diagram 3]FIG. 3 is a flow chart illustrating steps of operation of a reordering-based data protection system in the context of protecting non-database format files, according to some embodiments.

[0022] [Figure 4] FIG. 4 is a block diagram of a computer system suitable for implementing a reordering-based data protection system in accordance with some embodiments. Detailed Description

[0023]

[0023] The above drawings, while showing various embodiments, are for illustrative purposes only. Those skilled in the art will readily recognize from the following discussion that other embodiments of the structures and methods shown herein may be employed without departing from the principles described herein.

[0024]

[0024] Figure 1 is a high-level block diagram illustrating an exemplary network architecture 100 in which a reconciliation-based data protection system 101 may be implemented. As described in more detail below, the reconciliation-based data protection system 101 may be used to protect databases 113 (and computer files in other formats) without modifying any individual data, and to protect data transmissions by adding extraneous data without modifying any required data. Individual pieces of data in database 113 are typically meaningless in themselves, but are instead only useful in conjunction with other data to which they are linked. Thus, a hacker cannot do any damage by obtaining individual cells of data from database 113. For example, obtaining an individual credit card number without any contextual information would be of no use to a hacker. What is desirable to protect are the connections between data points, such as the name of the person associated with that particular credit card number, the associated three-digit code (CVV), the person's zip code, billing address, etc. As another example, the measurement results of a given medical test performed on a particular patient (e.g., a single cell in database 113) or group of patients (e.g., an entire column) are useless without knowing how the raw measurement data is linked to other data (e.g., when the test was performed, who performed it, how those results compare to the most recent measurements of the same patient, etc.).

[0025]

[0025] The database 113 typically provides structure to the data by organizing it into tables where types of data (e.g., names, credit card numbers, addresses, etc.) are stored in columns (sometimes called fields of the database) and data associated with a given entity (e.g., a particular person's name, credit card number, address, etc.) are stored in rows (sometimes called records). In other words, a record contains all the fields of data for a given entry in the database. Thus, the fact that a given credit card number is associated with a given name, CVV, and zip code can only be known by accessing the entire record for that given person. Accessing individual cells in the credit card column (or even the entire column) does not allow a hacker to learn the association of credit cards with people, etc. Although records are conventionally stored as rows and fields as columns, this is arbitrary and records can be stored in columns and fields in rows. Additionally, multiple tables can be related to each other by common fields. For example, a table containing patient names, addresses, and credit card information and a table containing medical history data may be related by a "Patient ID" field common to both tables.

[0026] The reordering based data protection system 101 prevents damage by hackers by reordering data in one or more fields (e.g., columns) of a database 113 or file to hide the relationships between different fields of data in a given record, thereby protecting the relationships between fields within a record, for example separating measurement results from patient names and separating supplier names from supplier bank account information.

[0027]

[0027] Sorting is the rearrangement of the elements of a set. If each cell of a database column is a set, then the possible permutations of that set are all the cases in which the contents of the column can be ordered. For illustrative purposes, using a (trivial) example of a column with only three rows containing the positive integers 1, 2, and 3, the set is {1,2,3} and the possible permutations are (1,2,3), (1,3,2), (2,1,3), (2,3,1), (3,1,2), (3,2,1). The number of permutations of a set of n elements is the factorial of n (n!). Thus, the number of possible permutations of a set increases factorially as the size of the set increases. An example set of three elements has 3! (6) permutations. However, adding just one element increases the number of permutations to 4!(24), adding two elements increases it to 5!(120), and so on.

[0028]

[0028] Note that reordering the data in a database cell does not change the data, it only changes the order of the data. Thus, instead of changing the data in the cells of the database 113, the reordering-based data protection system 101 reorders the data within columns (or within rows, in the case of a field-based database, rather than the more typical configuration where fields are column-based and records are stored in rows). A database 113 secured by the reordering-based data protection system 101 still looks like a database 113. In other words, unencrypted column data still appears in the columns, and unencrypted row data still appears in the rows. Furthermore, attempts to unorder, i.e., to restore the connections by returning the data to its original unsecured order for a possibly randomly chosen permutation of the columns, still produce a result that looks like a valid database 113. Thus, successful deprotection of a database 113 reordered by the reordering-based data protection system 101 is indistinguishable from failure, since both successful and unsuccessful results look like a valid database 113. In contrast, a successful attempt to decrypt the ciphertext would be obvious. The resulting plaintext is human readable, while the ciphertext is not.

[0029]

[0029] Thus, the reordering-based data protection system 101 protects data by "hiding it in plain sight," leaving only the contents of data points (e.g., cells in a database 113 or a configuration data table) and removing the connections between them through reordering. This is not only significantly more secure than encrypting the data, but in principle is more computationally efficient, since performing a single reordering operation requires fewer computations than performing commercial-grade encryption. However, since successful deprotection of the reordered database 113 cannot be distinguished from failure, data protected by the reordering-based data protection system 101 is virtually immune to the vast increase in computing power available to hackers. As mentioned above, to try all possible reorderings of a column with n rows, one needs to perform n! permutations. For a database with only 25 rows (orders of magnitude smaller than typical deployments in the real world), 10 permutations for a single column would be 100%. 25 Of the permutations over the streets, any one of them could be the only correct permutation (for comparison, a trillion is 10 12 (100% of the data is encrypted using the reordering-based data protection system 101). This already makes a hacker's task harder than the 10 million row database protected by the longest encryption key used by Amazon AWS. This level of security implies relative permanence compared to encryption-based methods. Beyond skill and patience, the increasing computing power available to hackers has led many companies to spend huge amounts of money repeatedly "upgrading" to stay one step ahead of hackers. Such repeated and expensive efforts are unnecessary when data is protected by the reordering-based data protection system 101 as described herein.

[0030]

[0030] Referring to Figure 1, a network architecture 100 is shown including a number of clients 103A, 103B, and 103N (sometimes referred to collectively as "clients 103") as well as a number of servers 105A and 105N (sometimes referred to collectively as "servers 105"). In Figure 1, a collation-based data protection system 101 is shown residing on server 105A, a database management system 111 and corresponding database 113 are shown residing on server 105N, and a client agent 109 is shown running on each of the clients 103A-103N. It should be understood that this is by way of example only. In various embodiments, various functions of the collation-based data protection system 101 may be instantiated on the server 105, the client 103, or may be distributed among multiple servers 105 and / or clients 103. Also, while database management system 111 is shown as residing on a single server 105B, it is understood that database management system 111 and / or database 113 may be distributed among multiple computing devices and / or storage devices. As discussed in more detail below in conjunction with FIGURE 3, in some embodiments database management system 111 is not utilized and instead (or in addition) collation-based data protection system 101 operates in conjunction with data in a file format other than database management system 111.

[0031]

[0031] The client 103 may be in the form of a computing device operated by a user of the database management system 111 (or a user accessing other forms / types of data). The client agent 109 may be in the form of an application that includes endpoint level functionality for utilizing and / or interacting with the collation-based data protection system 101 and / or the database system 101. In some embodiments, the client agent 109 is not utilized and the functionality of the collation-based data protection system 101 and / or the database system 101 is accessed in other ways (e.g., via a browser (not shown)).

[0032]

[0032] The client 103 and the server 105 can be implemented using a computer system 610 as shown in Figure 4 and described below. The client 103 and the server 105 are communicatively coupled to the network 107, for example, via a network interface 248 as described below in conjunction with Figure 4. The client 103 can access applications and / or data on the server 105 using, for example, a web browser or other client software such as a client agent 109. The client 103 can be in the form of other types of computers / computer devices, including laptops, desktops, and / or mobile computing devices with portable computing systems that can connect to the network 107 and run applications (e.g., smartphones, tablet computers, wearable computing devices, etc.). The server 105 can be in the form of, for example, rack-mounted computing devices located in a data center, etc.

[0033] 1 shows three clients 103 and two servers 105 as an example, in practice more (or less) clients 103 and / or servers 105 may be deployed. In one embodiment, the network 107 is in the form of the Internet. In other embodiments, other networks 107 or network-based environments may be used.

[0034]

[0034] Figure 2 illustrates the operation of a reordering-based data protection system 101 operating on a server 105 and communicating with multiple client agents 109, according to some embodiments. As mentioned above, the functionality of the reordering-based data protection system 101 may reside on the server 105 or other specific computer 610, or may be distributed among multiple computer systems 610, including a cloud-based computing environment in which the functionality of the reordering-based data protection system 101 is provided as a cloud-based service on a network 107. Although the reordering-based data protection system 101 is shown as a single entity in Figure 2, it is to be understood that the reordering-based data protection system 101 represents a collection of functionality that may be instantiated as a single module or multiple modules as desired. In some embodiments, different modules of the reordering-based data protection system 101 may reside on different computing devices 610 as desired. Each client agent 109 may be instantiated as an application configured to run under an operating system such as Windows®, OS X, Linux®, etc., or an app for a given mobile operating system (e.g., Android®, iOS, Windows 10, etc.), with different client agents 109 being specifically implemented for different types of operating environments utilized by different end users.

[0035]

[0035] It is to be understood that the components and modules of the reordering-based data protection system 101 can be instantiated (e.g., as object code or executable images) within the system memory 617 (e.g., RAM, ROM, flash memory) of any computer system 610 such that when the processor 614 of the computer system 610 processes the modules, the computer system 610 performs the associated functions. As used herein, the terms "computer system," "computer," "client," "client computer," "server," "server computer," and "computing device" refer to one or more computers configured and / or programmed to perform the functions described above. Also, the program code implementing the functions of the reordering-based data protection system 101 can be stored in a computer-readable storage medium. In this context, any form of tangible computer-readable storage medium can be used, such as magnetic, optical, flash, and / or semiconductor storage media, or any other type of media. As used herein, the term "computer-readable storage medium" does not connote electrical signals separate from the underlying physical medium.

[0036]

[0036] As shown in Figure 2, in one embodiment, this "hide as you see it" is accomplished by reordering cells within a given column of database 113. As will be described in more detail below in conjunction with Figure 3, in other embodiments, similar functionality is utilized in the context of other format files. In the instantiation of database 113 of Figure 2, the data in the cells of the reordered columns is still of the same type and represents the same type of object (e.g., first visit date, social security number, etc.) as before reordering, but in a different order and no longer matches other columns (i.e., unreordered columns (referred to herein as "clear"). Thus, when a given column is reordered, the cells of that column are no longer associated with other columns in that given row, which represent different data points for a given patient, client, customer, supplier, cardholder, member, employee, etc., all for a particular entry in database 113. For example, if records for patients at a hospital are stored in rows of database 113 and the column of database 113 in which the patient's social security numbers are stored is reordered, the social security number of a given patient will no longer be located in a given row of database 113 associated with that given patient and will be impossible to identify by a malicious party who has gained access to database 113.

[0037] It is to be understood that the reordering based data protection system 101 may further hide relationships between entities in the database 113 by reordering multiple columns. As explained above, these reordered columns still appear in the unprotected database 113, except that they do not themselves contain any proprietary or highly confidential information, since no relationship to a particular patient can be identified. CLEAR contains the same type of content (e.g., a patient's social security number or a particular medical test result).

[0038]

[0038] To reorder the cells of a column, the reordering-based data protection system 101 applies a reordering algorithm that uses modular arithmetic. As will be described in more detail below, in different embodiments, the reordering-based data protection system 101 may apply different modular arithmetic-based reordering algorithms with different numbers and / or orders of parameters to the column(s) to be protected. More specifically, the reordering-based data protection system 101 may apply a bijective function that uses modular arithmetic, including, for example, modular subtraction and modular addition, in any order. A bijective function is a mathematical function between the elements of two sets, such that each element of the first set is paired with exactly one element of the second set, and vice versa, with no unpaired elements. In the case of the reordering-based data protection system 101, a bijective function from a set to itself is applied, which is a reordering. In this context, a bijective function from a set to itself means a reordering from a set of elements of the clear column to the same set of elements of the reordered column. Modular arithmetic is a system of integer arithmetic in which, once a given value, called the modulus, is reached, the numbers "roll over" leaving a remainder. A classic example is a 12-hour clock, where 12 is the modulus. When the time exceeds 12, it rolls over and the remainder becomes the new time. For example, on a 12-hour clock, 9+5=2.

[0039]

[0039] As mentioned above, the particular number of parameters used in the mathematical bijective function applied to permute the cells of the column is a variable design choice. Using more parameters provides a higher level of security, but also requires more processing resources. Different people in different scenarios will need to choose different balances between these factors.

[0040]

[0040] Sorting cells in one or more columns of a database 113 (or other form of data table) involves clearing the database 113 to be sorted. CLEARand clearing columns to create a protected database 113 having one or more columns in which the cells have been rearranged. PROTECTED It is understood that the Clear Database 113 CLEAR The content of the database is 113 CLEAR The protected database 113 is easily understandable by anyone with access to the PROTECTED The contents of the sorted columns of the database 113 are hidden because the relationships between the cells of the sorted columns and the associated database records are hidden, as described herein. PROTECTED Thus, the conversion of databases into secure content without encryption and with the reordering-based data protection system 101 is a major improvement in the field of computer security.

[0041]

[0041] As an example, we will discuss an instantiation where the owner of a confidential file cares so much about security that performance cost is not an issue. It should be understood that this is a theoretical scenario and that in practical examples there will likely be a trade-off between security and processing cost. In any case, in this hypothetical example, a parameter-heavy procedure may be chosen for the desired column permutation of a database 113 consisting of R rows and C columns, as follows: The clear database 113 is considered to be a rectangular array U (unprotected array) with R rows and C columns. In this example, we assume that column 0 is not to be permuted (e.g., the unpermuted data of column 0 does not pose a security risk in itself). The other columns 1 to C-1 are to be permuted. Thus, a protected array P is generated by the following steps: Generate three two-dimensional arrays S, FC, and FR, each with R+1 rows and C-1 columns, and initially fill FC and FR with all 0s, then work your way down the rows filling each column of S with integers 0, 1, 2, . . . , R (e.g., row 3 is made up of all 3s). Here, we protect column c=1. We remove the leftmost column from S to obtain a one-dimensional array T cLet Z be a set of {0, 1, 2, , R}. First, in step cr for r=0, we determine where in column c=1 to move the contents of cell r=0. In this case, we select a random number X from the set Z={0, 1, , Rr}. rc Take out. T c From X rc Remove and reduce the array by one element (e.g., X rc If =4, T c (The number of FCs is {0, 1, 2, 3, 5, 6, , R}.) Here, FC 0c Set Z to element X rc th Set FR x equal to rc = 0, U rc The contents of P are rc Continuing down the columns in this way, each cell in U is placed into a randomly chosen cell (from the still-empty cells in that column) in the same column of P, and so on for each column of P to the right, determined by a new randomization.

[0042]

[0042] Although randomization is used in parameter selection in the exemplary instantiations described herein, it is to be understood that the randomness used is merely an accidental selection. For example, in a hypothetical example where the parameters are not randomly but purposefully selected, the parameters chosen may, for example, never or rarely use numbers ending in 5 or 0 (e.g., due to some preference to avoid them). In this case, the factorial problem becomes a bit smaller if the rarity of parameters ending in 5 or 0 can somehow be guessed by a hacker. For 1 million rows, the number of permutations would be reduced from 5.65 million digits to 2 million digits if 0 and 5 were never used, and to 5.2 million digits if they were used disproportionately less than 1-4 and 6-9. In other words, even without random parameter selection, the level of protection is still very high.

[0043]

[0043] Using two subroutines provided by the sorting-based data protection system 101, the protection database 113 PROTECTED , to obtain the particular desired content. These two subroutines are referred to herein as FindCell 201 and FindRecord 203. In the above sorting example, array FC provides the R*(C-1) parameters for FindCell 201, and array FR of the same dimension provides the R*(C-1) parameters for FindRecord 203. The operations of FindCell 201 and FindRecord 203 are discussed in more detail below.

[0044]

[0044] In the following, we will describe the application of different exemplary algorithms by the reordering-based data protection system 101, which are closer to other theoretical limits and have a higher performance cost, so we minimize the performance cost by applying a one-parameter algorithm at the expense of reducing the robustness of the security provided. In one embodiment example where the reordering-based data protection system 101 applies a one-parameter algorithm, we also pick a random integer A, say between 11 and N-12, for N rows. Now, using modular arithmetic, we place the data point that was in row r, column c, in row r'=mod(r+c*A,N), while still in column c. If a data point in row r, column c satisfies the query and the corresponding data point in row 0 is desired, then that data point is placed in row r'=mod(r+c*A,N), while still in column c. r =mod(r+Nc*A,N) (the inverse function of the preceding function). In this specification, * indicates multiplication.

[0045]

[0045] In the application of this exemplary algorithm, the guarded data table is filled by a set of projection fields, which is a mathematical term. By definition, two sets A and B, which are partitions of a given set S, constitute a projection field if any element of A crosses all elements of B and any element of B crosses all elements of A. Thus, the rows and columns are projection fields. Here, A consists of the elements defined by the cells of the leftmost column and the cells of each of the other columns obtained by applying the formula mod(r+c*A,N), and B can consist of the set of columns of the data table. In this context, projection fields can be used in other instantiations of the sorting algorithm with other numbers of parameters as needed.

[0046] Here, we provide an example of a reordering-based data protection system 101 that applies a two-parameter algorithm with parameters (x, y), where we protect any column c of an unprotected database 113 by performing the following steps: If c is odd, we reorder the data points of row r by row r. r =mod(r+x,N) If c is even, put the data points in row r into row

number

[0047] In other examples, other numbers of parameters can be used as needed. In the four parameter example for column C, pick a random integer D from [0.25C, 0.6C]. Once D is picked, pick a random integer from [D+1, 0.9C]. D In the left column of D, use a random integer A, as in the one-parameter example, and in columns D and to the right of it, D The column to the left of uses a separate randomized B with the same formula. D And the column to the right uses a separately randomized G with the same formula.

[0048] For the three-parameter example for column C, pick a random integer D from [0.3C, 0.8C]. As with the two-parameter example, for the left column of D, if c is odd, then pick the data point in row r from r =mod(r+x,N) If c is even, put the data points in row r into row

number

[0049] As noted above, the particular number of parameters used in the bijective function used to sort particular columns of database 113 is a variable design choice, with more parameters providing greater security but using more processing power. It is further understood that the particular modular operations applied and the order in which they are applied may vary from implementation to implementation. Also, which and how many columns are sorted in database 113 are variable and based on the fields of database 113 that contain sensitive information that should be separated from their associated records.

[0050]

[0050] Thus, as mentioned above, the permutation is controlled by application of an algorithm implementing one of a family of mathematical functions. This may be considered appropriate to describe as random permutation in two senses: (a) a malicious individual who obtains the protected database 113 but does not obtain either the algorithm or the parameters of the function will observe a permutation of all or most of the columns of the data table that cannot be identified as random; and (b) in fact it is possible (though not necessary) to have the parameters (of the particular function used to isolate the cells) themselves chosen randomly, resulting in a random permutation. PERMUTED Once sorted, the desired data can be queried and accessed therefrom, as described below, thus providing a more convenient way to access the unsorted database 113. CLEAR It is understood that it is not necessary to keep the unsorted database 113 if necessary, e.g., offline and in a location inaccessible to hackers. CLEAR It is possible to maintain a copy of the

[0051]

[0051] The following describes some embodiments of retrieving desired content from the reordering database 113. By using the functionality described herein, the database 113 PERMUTED A query against the permutation database can be processed to obtain the requested data without unprotecting the database 113 or any particular column or each particular column that may be involved in satisfying the query. PERMUTED When protected, the data is still stored in the protected database 113 because the data itself is not changed, but only rearranged. PERMUTED The data resides in the unprotected database 113 and is available for query processing. CLEAR Therefore, as opposed to being protected, the sorting database 113 PERMUTEDThere is a small performance cost associated with locating and retrieving specific data in the database 113. However, the performance overhead is minimal compared to decryption. More specifically, to retrieve data to be sent in response to a query, a preliminary step of modular arithmetic is utilized to find the correct row for the queried column. Such modular arithmetic steps add up for all aspects of processing a query, such that the decryption is performed in the database 113. ENCRYPTED The encrypted database 113, whether as a whole or separately for each field (i.e., if "structure-preserving encryption" is used), ENCRYPTED The performance cost is significantly smaller than that of decoding the permutation database 113. PERMUTED does not involve reordering the entire sorted database or any of its sorted columns.

[0052]

[0052] After the data responsive to the query has been found, its transmission to the querying computer (e.g., client 103 interacting with database management system 111) may be secured by essentially the same logic as described above. For example, a query for specific data for a specific supplier may result in one record containing eight fields. A ratio of real data to irrelevant data may then be employed to secure the data transmission. The ratio used is a variable design feature and may be selected, for example, by the database licensee, database administrator, publisher of the reordering-based data protection system 101, etc. In an exemplary scenario where the ratio is 4:1, four records of irrelevant data (or entirely fictitious data) are assembled, each of these four records containing the same number and type of fields as the real records (e.g., eight fields per record in this example). The resulting grid of five records, each of eight fields, may then be subjected to the same reordering algorithm using time-dependent parameters. Thus, a single record containing the response to the query is reordered with the four irrelevant records. After reordering, this grid of five records is sent to the querying computer. The actual result of the query is sorted with the other four records so that the transmission is secured, and the querying computer can use the same parameters to unsecure the five records by inverse modular operations and select the one requested record which may then be displayed to the requesting device or used as desired.

[0053] In some embodiments, protection or deprotection of any kind of file that is generally a rectangular structure (e.g., a data table in database 113) or that is adapted to a rectangular structure (e.g., by treating each byte of the file as if it were a single datum in database 113, as described below in conjunction with FIG. 3) can be accomplished by repeated use of two basic subroutines. Finding, modifying, adding, and removing data may all rely on the same two subroutines. The subroutines provide results that depend on various parameters used in the corresponding adaptive sorting algorithms, as described above, which are typically situation specific. In this specification, these two subroutines are referred to as FindCell 201 and FindRecord 203, although it is understood that this naming is not important and that in other embodiments the subroutines may have different names (and / or more or different subroutines may be used).

[0054]

[0054] Subroutine FindCell 201 locates a particular cell associated with a particular record in a sort field. Because the field has been sorted, the particular cell is not located in the particular record to which it is associated. In one embodiment where fields are stored in columns and records are stored in rows, FindCell 201 locates a particular cell in the sort column associated with a given row, but is not located in that row because of the sort. More specifically, FindCell 201 performs a modular operation to locate a particular cell in a sort field by applying one or more parameters used to apply the sort algorithm, an identifier of a particular record in which the particular cell of the sort field is located, and an identifier of a particular sort field.

[0055] A rectangular structure (e.g., a database or other file type) will (usually) (but not necessarily) have a "primary field." In some embodiments, this will be the left-most column (in instantiations where fields are stored in columns). Subroutine FindCell 201 takes as input an array (different embodiments will have different configurations) of the parameter(s) used to sort database 113, the row number of the primary column (or other identifier of the record with which a particular cell of the sort field is associated), and the desired column, expressed as, for example, a column number or column header (or other identifier of the desired field). Subroutine FindCell 201 applies the parameter(s) and performs a modular operation to output the corresponding row of the desired column. For example, suppose quantities shipped to various customers last month are in the "Qm-1" column, and that data is requested for customer 1234. 1234 now appears in row 567 of the primary column. Subroutine FindCell201 then takes the relevant parameter(s) (in the example with one parameter, say 8910) and adds 567+8910=9477, outputting 9477, which is the desired row in the "Qm-1" column where this customer's last month's shipment can be found. For example, if the rectangular structure only has 7000 rows, then the desired row is 9477-7000=2477, which can be found automatically by adding modulo 7000.

[0056]

[0056] Subroutine FindRecord 203 locates a particular record with which a particular cell in a sort field is associated. Because the field is sorted, the particular cell is not located in the particular record to which it is associated. In one embodiment where fields are stored in columns and records in rows, FindRecord 203 locates a row associated with a particular cell in the sort column. The particular cell is associated with a particular row, but is not located there because of the sort. More specifically, FindRecord 203 performs a modular operation to locate a particular record with which a sort field is associated by applying one or more parameters used in applying the sort algorithm, an identification of a particular record in which a particular cell of the sort field is located but is not associated, and an identification of the particular sort field.

[0057] Assume the requested data are the customer numbers and distances from the shipping plant location for all customers who have shipped between 100 and 200 units in the last month. Furthermore, assume that the contents of the cell in row 9477 of column "Qm-1" falls within that range. In this type of scenario, subroutine FindRecord 203 is used, which is essentially the inverse of subroutine FindCell 201. FindRecord 203 takes as input the same array of parameter(s), column "Qm-1", and row 9477 where the shipped quantity that fits the range was found. In the one parameter example, FindRecord 203 takes the same parameters and subtracts 9477-8910, outputting 567, which is the row in the main column where this customer's customer number 1234 was found. In this example, the distance shipped is not considered confidential information unless the customer is identified, so that data is in row 9477 in the column “Distance” and is indicated by the parameters in that column matching the parameters in column “Qm-1.”

[0058]

[0058] The most frequent use of almost all databases 113 is to query information. Using the reordering-based data protection system 101 as described above, queries can be accommodated without decrypting the database 113, whereas traditional encryption-based systems require the encrypted database 113 to be decrypted for querying. Not having to decrypt the encrypted database 113 to an unprotected state that can be queried significantly reduces performance costs. Typically less frequent than querying the database 113, but still regularly supported, is updating the content of existing records (i.e., updating one or more specific fields of a given record to indicate information such as whether a given person has renewed a subscription, or a given customer has paid a particular amount).

[0059]

[0059] Another database operation that is supported, although relatively infrequently, is the addition of a new record, which is performed, for example, when a new customer opens an account at a bank. Deletion of an existing record is another operation that is supported relatively infrequently, such as when a patient decides to see a different doctor outside of a given facility and requests deletion after providing information to the new doctor. It is also possible to edit the existing schema of database 113 by adding one or more new fields, for example, when a new product is introduced to the market, a new franchisee is added, etc. In some embodiments, support for these additions and deletions to an existing database 113 in the context of reordering-based data protection system 101 is provided when database 113 is first reordered.

[0060]

[0060] More specifically, several additional fields may be added to the database 113 prior to sorting. One is for system use, as described below, and the other is to allow new fields to be added later without unsorting and resorting the database 113. Any data may be initially stored in the introduced fields for future use. In one embodiment, data that duplicates or mimics existing fields may be stored to make interpretation by unauthorized persons more difficult. The particular number of fields added for future use is a variable design choice. It is also possible to add many unused records to the database prior to the initial sorting. This is to allow new records to be added later without unsorting and resorting the database 113 each time a record is added. As with the unused fields, the number of unused records added and the contents stored therein are variable design choices, although existing records may be duplicated in the unused records for added security. The new fields for system use described above may be used to encode whether the record contains real data or is merely a placeholder for adding a new record. The placeholder records are sorted along with the actual data records in the database 113, all of which contain the placeholder fields.

[0061]

[0061] When a new record is added, the real data of that record is replaced with the fictitious placeholder data of the placeholder record and the coding cells showing the fictitious data are switched to coding showing the real data. When a real record is removed, the reverse operation is performed (i.e. the real data is replaced with fictitious data and the coding fields are updated accordingly). As with other records, the placeholder record found to be replaced by a new record in the add operation or the real record found to be replaced by fictitious data in the delete operation is located using modular arithmetic as described above since the records are reordered and not stored straight across rows in the database 113.

[0062]

[0062] As shown in Figure 3, in some embodiments, the reordering-based data protection system 101 may be adapted to protect files in formats other than databases 113. In such embodiments, any file of any type containing proprietary or confidential information may be protected by application of the corresponding functionality described herein. This functionality may be used to protect document files, text files, or any other files containing alphanumeric content (e.g., words, abbreviations, spaces, numbers, etc.), image files, audio files, animations, movies, or other forms of video files, any file type in any one of a variety of formats with widespread or narrow use (e.g., .docx, .txt, .html, .xls, .pdf, .gif, .jpg, .mp3, .alac, .wav, .flac, .mp4, .mov, .avi, etc.). Additionally, application of the functionality described herein may protect any file that can be represented as a header followed by a series of binary and / or hexadecimal numbers (essentially, any file type). It should be noted that, unlike the above-described exemplary embodiment of protecting database 113, for protected files of other formats, successful deprotection is visually identifiable to a hacker, since all failed attempts to un-order the data are incoherent, while successful attempts using the correct parameters result in content that appears to be of a particular type of file. Nevertheless, without this particular advantage, the resulting protection is still very strong compared to encryption, and the computational overhead is still low.

[0063]

[0063] To reorder any type of file, the reordering-based data protection system 101 may determine (301) a "cell size" for a particular file of a given type. A cell size could be, for example, a single character in a document, a single character (a phonetic character), a number, a punctuation mark, a space, a paragraph end indicator, a single hexadecimal character, a single byte, a group of n consecutive bytes, a grid of n by n pixels, 0.2 seconds worth of sound or animation, or any other size designation. The reordering-based data protection system 101 may divide (303) the file into a linear arrangement of cells, each of the size determined in step 301. The reordering-based data protection system 101 then arranges (305) the linear arrangement into a rectangle, filling first the top row, then the next row, and repeats this for all data in the file. The reordering based data protection system 101 may then apply a particular mathematical bijective function to reorder (307) the cells in a given column, for all columns, nearly all columns, or a given subset of columns, as desired, to remove ties between adjacent cells in a row to protect this structure. Although non-database files have been described as being organized into column-based fields and row-based records, it is understood that row-based fields and column-based records may be used in other embodiments. In any event, the subroutines FindCell 201 and FindRecord 203 may be used in the context of non-database file types, as described above in the context of a database implementation.

[0064]

[0064] As a specific example of how the reordering-based data protection system 101 can be used to improve security by protecting the most common type of data transmission, consider a digital transaction in which a credit card number is transmitted for authentication purposes. More specifically, when a purchaser performs a credit card transaction, the credit card number, other identifying information about the cardholder (e.g., the purchaser's name, a three-digit card verification value (CVV), expiration date), and information about the transaction are transmitted to the card issuer or a third-party authentication service, which approves or denies the transaction. Traditionally, the credit card number and CCV in such transmissions are simply hashed, which is not very secure, since access to the hashed credit card numbers allows one to determine the hash algorithm used and access the actual information (after all, a credit card only has 16 decimal digits and a CVV only has 3 digits).

[0065]

[0065] The reordering based data protection system 101 system described herein can obtain much higher security by treating the information sent for authentication as records, adding irrelevant records to the data, and reordering the actual records of interest with the irrelevant records. As a simple example, the format of the data sent for credit card authentication may include name, dollar-cent amount, 16-digit card number, CVV code, and possibly card expiration date (month / year) (actual format may vary). Using an example ratio of 4:1, four irrelevant records of the same format may be added to the actual record containing information about the transaction to be authenticated, for a total of five records with each field reordered. Adding the irrelevant records incurs a very small additional performance cost since not much data is sent for credit card authentication. However, it is much more difficult for a hacker or other malicious party wishing to intercept the transaction to unprotect the data and gain access to the purchaser's credit card information. The authentication service can then reorder the received data as described above.

[0066]

[0066] The techniques described herein for protecting both databases 113 and other types of files provide a very robust level of protection against intrusion. For a hacker, the difficulty of decrypting a database or file permuted as described herein far exceeds its encryption, even if the encryption key is quite long. The hacking task is proportional to the length of the encryption key. Larger files provide more clues to narrow down the possible encryption keys. The decryption task of the functions described herein is a factorial of the number of rows in a rectangular representation of any file type. For as few as 25 rows, it takes 10 25 Any one of the permutations over the streets can be the only correct permutation (for comparison, 1 trillion is 10 12). This already makes the hacker's task harder than the 10 million row database protected by the longest encryption key used by Amazon AWS.113 With 50 rows (still a very small file), 10 64 Permutations over the street, 100 rows, 10 157 There are more than 100 permutations. Applying this protection method to a moderately sized database, a large high-resolution image, or a few minutes of video clips, can easily reach a million rows, but this is only 8.26*10 5,565,708 There are more than 1000 possible permutations (which is roughly the number of hydrogen atoms estimated to exist in the universe) 50,000 (which is likely the largest integer ever computed for purposes other than abstract number theory.) Because this level of security is unattainable using cryptography, securing content stored in databases 113 and / or other formats of files against unauthorized access by malicious parties by applying the reordering-based functions described herein would be a major improvement in the field of computer security, as well as an improvement in the operation of server farms, data centers, and secure storage technologies in general.

[0067] 4 is a block diagram of an exemplary computer system 610 suitable for implementing the reordering-based data protection system 101. Both the client 103 and the server 105 may be implemented in the form of such a computer system 610. As shown, components of the computer system 610 include a bus 612. The bus 612 communicates with at least one processor 614, a system memory 617 (e.g., random access memory (RAM), read-only memory (ROM), flash memory), an input / output (I / O) controller 618, an audio output interface 622 communicatively coupled to an audio output device such as a speaker 620, a display adapter 626 communicatively coupled to a video output device such as a display screen 624, one or more interfaces such as a universal serial bus (USB) receptacle 628, a serial port 630, a parallel port (not shown), a keyboard controller 633 communicatively coupled to a keyboard 632, one or more hard disks 644 (or other form of storage medium(s)), and / or a network interface 650 (or other form of storage medium(s)). Communicatively couples other components of computer system 610, such as an coupled storage interface 634, a host bus adapter (HBA) interface card 635A configured to connect to a Fibre Channel (FC) network 690, an HBA interface card 635B configured to connect to a SCSI bus 639, an optical disk drive 640 configured to receive an optical disk 642, a mouse 646 (or other pointing device) coupled to bus 612, e.g., via a USB receptacle 628, a modem 647 coupled to bus 612, e.g., via a serial port 630, and one or more wired and / or wireless network interfaces 648 coupled, e.g., directly to bus 612.

[0068]

[0068] Other components (not shown) (e.g., a document scanner, digital camera, printer, etc.) may be connected as well. Conversely, not all of the components shown in Figure 4 need be present (e.g., smart phones and tablets typically do not have optical disk drives 640, external keyboards 632, or external pointing devices 646, but various external components may be coupled to the mobile computing device, e.g., via USB receptacles 628). Also, the various components may be interconnected in different ways than shown in Figure 4.

[0069]

[0069] The bus 612 allows data communication between the processor 614 and the system memory 617, which may include RAM as well as ROM and / or flash memory as described above. The RAM is typically the main memory into which the operating system 650 and application programs are loaded. The ROM and / or flash memory may include, among other code, a basic input-output system (BIOS) that controls certain basic hardware operations. The application programs may be stored locally on a computer-readable medium (e.g., hard disk 644, optical disk 642) and loaded into the system memory 617 for execution by the processor 614. The application programs may also be loaded into the system memory 617 from a remote location (i.e., a remotely located computer system 610), for example, via a network interface 648 or modem 647. Although FIG. 4 illustrates the reordering-based data protection system 101 as residing in the system memory 617, in some embodiments, parts of the system 101 may be located elsewhere, for example, on the hard disk 644 or other storage mechanism.

[0070]

[0070] Storage interface 634 is coupled to one or more hard disks 644 (and / or other standard storage media). The hard disk(s) 644 may be part of computer system 610 or may be physically separate and accessed through another interface system.

[0071]

[0071] The network interface 648 and / or modem 647 may be communicatively coupled directly or indirectly to a network 107, such as the Internet. Such coupling may be wired or wireless.

[0072]

[0072] As will be appreciated by those skilled in the art, the subject matter described herein may be embodied in other specific forms without departing from the spirit or overall characteristics thereof. Similarly, the specific naming and division of parts, modules, agents, managers, components, functions, procedures, operations, layers, features, attributes, methods, data structures, and other aspects is not required or important, and the entities used to implement the subject matter described herein may have different naming, division, and / or format. The foregoing description is for illustrative purposes and is described with reference to specific embodiments. However, the exemplary discussion above is not intended to be exhaustive or to be limited to the precise forms disclosed. Many modifications and variations are possible in light of the above teachings. The above embodiments were selected and described to best explain the relevant principles and their practical applications, thereby enabling others skilled in the art to best utilize the various embodiments, with or without modifications that may be adapted to the particular use contemplated.

[0073]

[0073] At times, various implementations may be presented herein in terms of algorithms and symbolic representations of operations on data bytes within a computer memory. An algorithm is here generally conceived as a self-consistent set of operations leading to a desired result. The operations involve physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transformed, combined, compared and otherwise manipulated. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, bytes, values, elements, symbols, characters, terms, numbers, or the like.

[0074]

[0074] It should be borne in mind, however, that all of these and similar terms are associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless otherwise specifically stated, as will become apparent from the discussion below, it should be understood that throughout this disclosure, discussions utilizing terms including "processing," "computing," "calculating," "configuring," "determining," "displaying," and the like, refer to operations and processes of a computer system or similar electronic apparatus that manipulate and convert data represented as physical (electronic) quantities in the registers and memory of a computer system into other data also represented as physical quantities in the memory or registers of the computer system, or other such information storage, transmission, or display device.

[0075]

[0075] Finally, the structure, algorithms, and / or interfaces presented herein are not inherently related to any particular computer or other apparatus. Various general-purpose systems may be used in conjunction with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to execute the method blocks. The structure for a variety of these systems will be apparent from the above description. Additionally, no particular programming language is referenced in this specification. It will be appreciated that a variety of programming languages ​​may be used to implement the teachings as described herein.

[0076]

[0076] From the foregoing, this disclosure is by way of example only and is not intended to be limiting in any way. [Item of invention] [Item 1] 1. A method for protecting sensitive content of a database from unauthorized access by hiding relationships between said sensitive content and other fields of associated database records, comprising: reordering the cells of a particular field of the database by applying a reordering algorithm using modular arithmetic to the cells of the particular field, the reordering changing the order of the cells of the particular field without changing the content of any individual cell; A method in which the sorted field still contains all of the original cells in sorted order, thereby hiding relationships between the cells of the sorted field and the associated database records. [Item 2] The database stores fields in columns and records in rows; 2. The method of claim 1, further comprising applying the sorting algorithm using modular arithmetic to the cells of a particular column of the database, the particular column including the cells of the particular field. [Item 3] The database stores fields in rows and records in columns; 2. The method of claim 1, further comprising applying the sorting algorithm using modular arithmetic to the cells of a particular row of the database, the particular row containing the cells of the particular field. [Item 4] reordering the cells of a plurality of particular fields of the database by applying the reordering algorithm using modular arithmetic to the cells of each of the plurality of particular fields, the reordering changing the order of the cells of each particular field without altering the content of any individual cell; 2. The method of claim 1, wherein each sorted field still contains all of the original cells in sorted order, thereby hiding the relationship between the cells of each sorted field and the associated database records. [Item 5] applying a sorting algorithm using modular arithmetic, 2. The method of claim 1, further comprising reordering the cells of the particular field of the database by application of a bijective function using modular arithmetic. [Item 6] applying a sorting algorithm using modular arithmetic, Item 10. The method of item 1, further comprising applying a reordering algorithm that uses modular addition and modular subtraction, in any order. [Item 7] applying a sorting algorithm using modular arithmetic, 2. The method of claim 1, further comprising applying a sorting algorithm that uses modular arithmetic involving multiple parameters. [Item 8] applying a sorting algorithm using modular arithmetic, 2. The method of claim 1, further comprising applying a sorting algorithm that uses modular arithmetic with a single parameter. [Item 9] applying a sorting algorithm using modular arithmetic, 2. The method of claim 1, further comprising applying a sorting algorithm that uses modular arithmetic to fill the cells of the sorted field via the projection field. [Item 10] applying a sorting algorithm using modular arithmetic, Item 10. The method of item 1, further comprising applying a sorting algorithm using modular arithmetic with at least one pseudorandom selection parameter. [Item 11] applying a sorting algorithm using modular arithmetic, Item 10. The method of item 1, further comprising applying a sorting algorithm that uses modular arithmetic with at least one purposeful selection parameter. [Item 12] 2. The method of claim 1, further comprising the step of locating in the sorted field a particular cell that is associated with a particular record but is not located within the particular record by applying in a modular operation one or more parameters used in the step of applying the sorting algorithm. [Item 13] locating a particular cell in the sorted field by applying in a modular operation one or more parameters used in the step of applying the sorting algorithm, 13. The method of claim 12, further comprising locating the particular cell in the sorted field by applying the one or more parameters, an identification of the particular record with which the particular cell of the sorted field is associated, and an identification of the particular sorted field in the modular operation. [Item 14] 2. The method of claim 1, further comprising the step of locating a particular record with which a particular cell in the sorted field is associated by applying one or more parameters used in the step of applying the sorting algorithm in a modular operation, the particular cell not being located in the particular record with which it is associated. [Item 15] locating a particular record with which a particular cell in the sorted field is associated by applying one or more parameters used in the step of applying the sorting algorithm in a modular operation, 15. The method of claim 14, further comprising locating the particular record with which the particular cell in the sorted field is associated by applying the one or more parameters, an identification of the particular record in which the particular cell of the sorted field is located but is not associated, and an identification of the particular sorted field in the modular operation. [Item 16] adding a plurality of placeholder records to the database prior to the sorting step; prior to said sorting step, adding a status field to each record of said database, said status field of a given record having content indicating whether said given record is a placeholder record; adding the new record to the database after the reordering step, without back-sorting or re-sorting the database, by locating the reordered placeholder record, replacing the contents of the fields of the reordered placeholder record with the contents of the fields of a new record, and updating the status field of the new record to indicate that it is not a placeholder record; The method of claim 1, further comprising: [Item 17] prior to said sorting step, adding a status field to each record of said database, said status field of a given record having content indicating whether said given record is a placeholder record; after said reordering step, without unsorting or reordering said database, locating an existing reordered record in said database, replacing the contents of the fields of said existing reordered record with placeholder content, and erasing said existing reordered record by updating said status field of said existing record to indicate that it is a placeholder record; The method of claim 1, further comprising: [Item 18] adding a plurality of placeholder fields to each record in the database prior to the sorting step; adding the new field to the database by adding the contents of the new field to a placeholder field of each record of the database without back-sorting or re-sorting the database after the sorting step; The method of claim 1, further comprising: [Item 19] 1. A method for protecting content of a particular type of file from unauthorized access by hiding relationships between units of content of said file, comprising: determining one or more segment sizes for said files of said particular type; partitioning said file into a linear arrangement of segments of said one or more determined sizes; processing the linear structure as a series of rows and columns, the segments filling the cells of the columns of the rows; reordering the cells in a particular column or row by applying a reordering algorithm using modular arithmetic to the cells in the particular column or row, the reordering changing the order of the cells without changing the content of any individual cell; Including, wherein the reordered column or the reordered row still contains all of the original cells in reordered order, thereby hiding relationships between the cells in the reordered column or the reordered row and other cells of the file. [Item 20] reordering the cells of a plurality of particular columns or rows of the file by applying the reordering algorithm using modular arithmetic to the cells of each of the plurality of particular columns or rows, the reordering changing the order of the cells of each particular column or row without changing the content of any individual cell; 20. The method of claim 19, wherein each sorted column or row still contains all of the original cells in sorted order, thereby hiding relationships between the cells of each sorted column or row and other content of the file. [Item 21] applying a sorting algorithm using modular arithmetic, 20. The method of claim 19, further comprising reordering the cells in the particular column or row of the file by application of a bijective function using modular arithmetic. [Item 22] applying a sorting algorithm using modular arithmetic, 20. The method of claim 19, further comprising applying a reordering algorithm that uses modular addition and modular subtraction, in any order. [Item 23] applying a sorting algorithm using modular arithmetic, 20. The method of claim 19, further comprising applying a sorting algorithm that uses modular arithmetic involving multiple parameters. [Item 24] applying a sorting algorithm using modular arithmetic, 20. The method of claim 19, further comprising applying a sorting algorithm that uses modular arithmetic with a single parameter. [Item 25] applying a sorting algorithm using modular arithmetic, 20. The method of claim 19, further comprising applying a sorting algorithm that uses modular arithmetic to fill the cells of the sorted columns or sorted rows via the projection field. [Item 26] The one or more segment sizes are: 20. The method of claim 19, further comprising different sizes of the segments resulting in cells of different columns. [Item 27] 1. A method of protecting content transmitted from a first computing device to a second computing device from unauthorized access by hiding relationships between units of content, comprising: obtaining, by the first computing device, a data record to be transmitted to a second computing device, the data record including a plurality of fields; obtaining a certain number of additional data records of the same type as the transmitted data record, the additional records including data excess to the transmitted record; processing the submitted record and the additional record as a data grid including a plurality of records, each record of the data grid including a plurality of fields; reordering cells of at least one field of the data grid by applying a reordering algorithm using modular arithmetic to the cells of the at least one field, the reordering changing the order of the cells without changing the content of any individual cells; transmitting the sorted data grid to the second computing device; Including, wherein the at least one sorted field still contains all of the original cells in sorted order, thereby hiding relationships between the cells of the sorted field and other cells of the data grid. [Item 28] applying a sorting algorithm using modular arithmetic, 28. The method of claim 27, further comprising reordering the cells of the particular field of the data grid by application of a bijective function using modular arithmetic. [Item 29] applying a sorting algorithm using modular arithmetic, 28. The method of claim 27, further comprising applying a reordering algorithm that uses modular addition and modular subtraction in any order. [Item 30] The data record transmitted to a second computing device, 28. The method of claim 27, further comprising transmitting a credit card number and associated data to authorize the credit card transaction.

Claims

1. 1. A method for protecting the contents of a file of a particular type from unauthorized access by hiding relationships between units of the content of said file, comprising the steps of: a first computing device partitioning said file into a linear arrangement of segments of a particular size; processing, by the first computing device, the linear configuration as a series of rows and columns; said first computing device filling cells of said columns of said rows with said segments; the first computing device converting the file into a protected file by rearranging cells in a particular column or row; Sorting cells in a specific column or row applying a sorting algorithm using modular arithmetic to cells in a particular column or row across multiple columns or rows; the reordering changes the order of the cells without changing the content of any individual cell; the sorted column or the sorted row still contains all of the original cells in sorted order, thereby hiding relationships between the cells of the sorted column or the sorted row and other cells of the file; a converting step, wherein the converted and protected file protects the sensitive content from unauthorized access by hiding relationships between the sensitive content and other related content; transmitting, by the first computing device, the protected file to a second computing device in response to a request from the second computing device; A method comprising:

2. reordering the cells of a plurality of particular columns or rows of the file by applying the reordering algorithm using modular arithmetic to the cells of each of the plurality of particular columns or rows, the reordering changing the order of the cells of each particular column or row without changing the content of any individual cell; 2. The method of claim 1 , wherein each reordered column or row still contains all of the original cells in a reordered order, thereby hiding relationships between cells in each reordered column or row and other content of the file.

3. applying a sorting algorithm using modular arithmetic, 2. The method of claim 1, further comprising reordering the cells in the particular column or row of the file by application of a bijective function using modular arithmetic.

4. applying a sorting algorithm using modular arithmetic, The method of claim 1 , further comprising applying a reordering algorithm that uses modular addition and modular subtraction, in any order.

5. applying a sorting algorithm using modular arithmetic, The method of claim 1 , further comprising applying a sorting algorithm that uses modular arithmetic involving multiple parameters.

6. applying a sorting algorithm using modular arithmetic, The method of claim 1 , further comprising applying a sorting algorithm that uses modular arithmetic with a single parameter.

7. applying a sorting algorithm using modular arithmetic, The method of claim 1 , further comprising applying a reordering algorithm that uses modular arithmetic to fill the cells of the reordered columns or the reordered rows via the projection field.

8. 1. A method of protecting content designated for transmission from a first computing device to a second computing device from unauthorized access by hiding relationships between units of content, comprising: obtaining, by the first computing device, a data record designated for transmission to a second computing device, the data record including a plurality of fields; obtaining, by the first computing device, a number of additional data records of the same type as the data record designated for transmission, the additional data records including data not responsive to a query that returned the record designated for transmission; processing, by the first computing device, the data records designated for transmission and the additional data records as a data grid including a plurality of records, each record of the data grid including a plurality of fields; converting, by the first computing device, the data grid into a secured data grid by reordering cells of at least one field of the data grid; Sorting cells of at least one field of the data grid includes: and wherein the first computing device applies a sorting algorithm using modular arithmetic to cells of at least one field of the data grid; a transforming step, wherein the reordering changes the order of the cells of the data grid across multiple records without changing the content of any individual cells; the first computing device transmitting the sorted data grid to the second computing device; Including, the at least one sorted field still contains all of the original cells in sorted order, thereby hiding relationships between the cells of the sorted field and other cells of the data grid; The transformed and secured data grid protects sensitive content from unauthorized access by hiding relationships between the sensitive content and other fields of associated data grid records.

9. The step of applying, by the first computing device, a reordering algorithm using modular arithmetic, further comprising:

9. The method of claim 8, further comprising the first computing device reordering the cells of the at least one field of the data grid by application of a bijective function using modular arithmetic.

10. The step of applying, by the first computing device, a reordering algorithm using modular arithmetic, further comprising:

9. The method of claim 8, further comprising the first computing device applying a reordering algorithm that uses modular addition and modular subtraction in any order.

11. the data record designated for transmission by the first computing device to the second computing device, 10. The method of claim 8, further comprising a credit card number and associated data designated for transmission to authorize a credit card transaction.

Images