Patent Publication Number: US-10326588-B2

Title: Ensuring information security in data transfers by dividing and encrypting data blocks

Description:
CROSS-REFERENCE TO RELATED APPLICATION(S) 
     This application is a continuation-in-part of and claims the benefit of priority to U.S. patent application Ser. No. 14/710,813, filed May 13, 2015, and entitled “SECURING PHYSICAL-STORAGE-MEDIA DATA TRANSFERS,” which is hereby incorporated by reference in its entirety for all purposes. 
    
    
     BACKGROUND 
     While improvements in computer networking have diminished the need for transferring computer data via physical storage media, transferring data via physical storage media continues to be preferable for certain types of data transfers. For example, certain data transfers may be too large for efficient network transfer. Additionally, data transfers may involve confidential, sensitive, or proprietary information, and transferring such data via physical storage media may prove more secure than available network-transfer alternatives. Similarly, certain types of third-party data transfers may be required to be made via physical storage media (e.g., regulatory submissions, discovery productions, and the like). Thus, while many organizations appreciate that there are data-leakage risks associated with providing users of their computing systems with the ability to transfer data via physical storage media, they also recognize that a need exists to provide at least some users of their computing systems with the ability to transfer data via physical storage media but desire to secure such physical-storage-media data transfers. Accordingly, a need exists for securing physical-storage-media data transfers. 
     SUMMARY 
     The following presents a simplified summary in order to provide a basic understanding of some aspects of the disclosure. This summary is not an extensive overview of the disclosure. It is intended neither to identify key or critical elements of the disclosure nor to delineate the scope of the disclosure. The following summary merely presents some concepts of the disclosure in a simplified form as a prelude to the description below. 
     Aspects of the disclosure provide effective, efficient, scalable, and convenient technical solutions that address and overcome technical problems associated with securing physical-storage-media data transfers. For example, some aspects of the disclosure relate to ensuring information security in data transfers. In some embodiments, data to be transferred may be divided into different data blocks, and each data block may be separately encrypted. The different data blocks may be transmitted separately to a recipient, and the recipient may use a reassembly engine to decrypt the data blocks and piece together the original data. In some instances, the data may be transmitted physically and different data blocks may be included on different physical storage media that are separately sent to the recipient. In other instances, the data may be transmitted via a network or cloud in distinct, encrypted data blocks. 
     In accordance with one or more embodiments, a computing system may receive physical-storage-media identifiers stored on physical storage media approved for use by an organization. The computing system may generate, for each of the physical storage media, a log entry comprising a physical-storage-media identifier, of the physical-storage-media identifiers, stored on the physical storage medium. The computing system may receive, from a computing device, a request to write secure data to a physical storage medium. Responsive to determining that the request comprises a physical-storage-media identifier that is amongst the physical-storage-media identifiers: the computing system may either instruct the computing device to write the secure data to the physical storage medium or fail to instruct the computing device to write the secure data to the physical storage medium; and may update a log entry comprising the physical-storage-media identifier to reflect whether the computing system instructed the computing device to write the secure data to the physical storage medium. 
     For example, in some embodiments, the computing system may receive physical-storage-media identifiers stored on physical storage media approved for use by an organization associated with the computing system. For each physical storage medium of the physical storage media approved for use by the organization, the computing system may generate, in a log stored in a memory of the computing system, an entry comprising a physical-storage-media identifier, of the physical-storage-media identifiers, stored on the physical storage medium. The computing system may receive, from a first computing device, a request to write a first portion of secure data stored in the memory of the computing system to a first physical storage medium and may receive, from a second computing device, a request to write a second portion of the secure data to a second physical storage medium. The computing system may determine that the request to write the first portion of the secure data to the first physical storage medium comprises a first physical-storage-media identifier that is amongst the physical-storage-media identifiers and may determine that the request to write the second portion of the secure data to the second physical storage medium comprises a second physical-storage-media identifier that is amongst the physical-storage-media identifiers. 
     Responsive to determining that the request to write the first portion of the secure data to the first physical storage medium comprises the first physical-storage-media identifier, the computing system may instruct the first computing device to write the first portion of the secure data to the first physical storage medium and may update an entry, of the log stored in the memory, comprising the first physical-storage-media identifier to reflect that the computing system instructed the first computing device to write the first portion of the secure data to the first physical storage medium. Responsive to determining that the request to write the second portion of the secure data to the second physical storage medium comprises the second physical-storage-media identifier, the computing system may fail to instruct the second computing device to write the second portion of the secure data to the second physical storage medium and may update an entry, of the log stored in the memory, comprising the second physical-storage-media identifier to reflect that the computing system failed to instruct the second computing device to write the second portion of the secure data to the second physical storage medium. 
     In some embodiments, the computing system may determine, based on the second physical-storage-media identifier, that the second physical storage medium has been tampered with and may fail to instruct the second computing device to write the second portion of the secure data to the second physical storage medium in response to determining that the second physical storage medium has been tampered with. For example, in some embodiments, generating the entry comprising the physical-storage-media identifier may comprise generating an entry comprising one or more properties of the physical storage medium (e.g., a number of times the physical storage medium has been written to, an available amount of storage on the physical storage medium, a total storage capacity of the physical storage medium, a manufacture of the physical storage medium, a number of times that the physical-storage-media identifier has been read from the physical storage medium, or the like), and the request to write the second portion of secure data stored in the memory to the second physical storage medium may comprise one or more properties of the second physical storage medium (e.g., a number of times the second physical storage medium has been written to, an available amount of storage on the second physical storage medium, a total storage capacity of the second physical storage medium, a manufacture of the second physical storage medium, a number of times that the second physical-storage-media identifier has been read from the second physical storage medium, or the like). In such embodiments, the computing system may determine that the second physical storage medium has been tampered with by identifying, in the log stored in the memory, an entry comprising the second physical-storage-media identifier and determining that the entry comprises one or more properties that are different from the one or more properties of the second physical storage medium. Additionally or alternatively, the computing system may determine that a portion of the secure data has previously been written to a different physical storage medium comprising the second physical-storage-media identifier. 
     In some embodiments, responsive to determining that the request to write the second portion of the secure data stored in the memory to the second physical storage medium comprises the second physical-storage-media identifier, the computing system may generate, based on the entry comprising the second physical-storage-media identifier, a message indicating that that the computing system failed to instruct the second computing device to write the second portion of the secure data to the second physical storage medium and may communicate the message to a computing device associated with a physical-storage-media administrator of the organization. 
     In some embodiments, the computing system may write, to each physical storage medium of the physical storage media approved for use by the organization, a different physical-storage-media identifier of the physical-storage-media identifiers. For example, in some embodiments, the physical storage media approved for use by the organization may include optical media, and the computing system may write, for each optical medium of the optical media, a different physical-storage-media identifier of the physical-storage-media identifiers to the optical medium. In some embodiments, each of the optical media may include a portion reserved for physical-storage-media identifiers associated with the physical storage media approved for use by the organization, and the computing system may write the different physical-storage-media identifier to the portion of the optical medium reserved for physical-storage-media identifiers associated with the physical storage media approved for use by the organization. In some embodiments, the computing system may write the physical-storage-media identifier to the optical medium, during a first optical-media-writing session for the optical medium. In such embodiments, responsive to the computing system instructing a computing device to write a portion of the secure data to the optical medium, the computing device may write the portion of the secure data to the optical medium during a second optical-media-writing session for the optical medium. 
     Additionally or alternatively, the physical storage media approved for use by the organization may include solid-state-memory devices, and the computing system may write, for each solid-state-memory device of the solid-state-memory devices, a different physical-storage-media identifier of the physical-storage-media identifiers to the solid-state-memory device. In some embodiments, each of the solid-state-memory devices may include a portion (e.g., a physically and/or logically separate memory, or the like) reserved for physical-storage-media identifiers associated with the physical storage media approved for use by the organization. In such embodiments, the computing system may write the different physical-storage-media identifier to the portion of the solid-state-memory device reserved for physical-storage-media identifiers associated with the physical storage media approved for use by the organization. 
     In some embodiments, the computing system may configure each physical storage medium of the physical storage media approved for use by the organization to prevent the portion of the physical storage medium reserved for physical-storage-media identifiers associated with physical storage media approved for use by the organization from being displayed in a user-viewable portion of an operating system file system. 
     In accordance with one or more additional embodiments, a computing platform having at least one processor, a communication interface, and memory may receive, via the communication interface, from a data source computing device, a source data collection for a secure physical-storage-media data transfer. Based on receiving the source data collection for the secure physical-storage-media data transfer from the data source computing device, the computing platform may identify one or more transmission parameters associated with the secure physical-storage-media data transfer. Subsequently, the computing platform may divide the source data collection received from the data source computing device into two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer. Then, the computing platform may separately encrypt the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer to produce two or more encrypted data blocks for the secure physical-storage-media data transfer. After separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer, the computing platform may store the two or more encrypted data blocks on two or more physical media, and each encrypted data block of the two or more encrypted data blocks may be stored on a different physical medium of the two or more physical media. 
     In some embodiments, based on storing the two or more encrypted data blocks on the two or more physical media, the computing platform may generate a notification indicating that the two or more physical media are ready to be transferred to a destination system. Subsequently, the computing platform may send, via the communication interface, to a data transfer administrative computing device, the notification indicating that the two or more physical media are ready to be transferred to the destination system to initiate a physical transfer of the two or more physical media. 
     In some embodiments, the one or more transmission parameters associated with the secure physical-storage-media data transfer may specify a quantity of physical media to be used in the secure physical-storage-media data transfer. In some embodiments, the one or more transmission parameters associated with the secure physical-storage-media data transfer may specify an encryption method to be used in the secure physical-storage-media data transfer. 
     In some embodiments, dividing the source data collection received from the data source computing device into the two or more data blocks may include adding one or more block header tags to each data block of the two or more data blocks, and the one or more block header tags may uniquely identify each data block of the two or more data blocks to facilitate reassembly of the source data collection by a data reassembly computing platform. 
     In some instances, separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer may include encrypting the one or more block header tags added to each data block of the two or more data blocks. In some instances, separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer may include failing to encrypt the one or more block header tags added to each data block of the two or more data blocks. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more compact discs. In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more flash drives. In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more hard drives. In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more magnetic tapes. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more separately shippable physical media, and the two or more encrypted data blocks may be configured to be decrypted and reassembled into the source data collection by a data reassembly computing platform. 
     Other details and features will be described in the sections that follow. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The present disclosure is pointed out with particularity in the appended claims. Features of the disclosure will become more apparent upon a review of this disclosure in its entirety, including the drawing figures provided herewith. 
       Some features herein are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, in which like reference numerals refer to similar elements, and wherein: 
         FIG. 1  depicts an illustrative operating environment in which various aspects of the present disclosure may be implemented in accordance with one or more example embodiments; 
         FIG. 2  depicts an illustrative block diagram of workstations and servers that may be used to implement the processes and functions of certain aspects of the present disclosure in accordance with one or more example embodiments; 
         FIG. 3  depicts an illustrative computing environment for securing physical-storage-media data transfers in accordance with one or more example embodiments; 
         FIG. 4  depicts an illustrative event sequence for securing physical-storage-media data transfers in accordance with one or more example embodiments; 
         FIG. 5  depicts an illustrative method for securing physical-storage-media data transfers in accordance with one or more example embodiments; 
         FIGS. 6A and 6B  depict an illustrative computing environment for ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments; 
         FIGS. 7A, 7B, 7C, 7D, and 7E  depict an illustrative event sequence for ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments; 
         FIGS. 8 and 9  depict illustrative graphical user interfaces associated with ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments; and 
         FIG. 10  depicts an illustrative method for ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments. 
     
    
    
     DETAILED DESCRIPTION 
     In the following description of various illustrative embodiments, reference is made to the accompanying drawings, which form a part hereof, and in which is shown, by way of illustration, various embodiments in which aspects of the disclosure may be practiced. It is to be understood that other embodiments may be utilized, and structural and functional modifications may be made, without departing from the scope of the present disclosure. 
     It is noted that various connections between elements are discussed in the following description. It is noted that these connections are general and, unless specified otherwise, may be direct or indirect, wired or wireless, and that the specification is not intended to be limiting in this respect. 
       FIG. 1  depicts an illustrative operating environment in which various aspects of the present disclosure may be implemented in accordance with one or more example embodiments. Referring to  FIG. 1 , computing system environment  100  may be used according to one or more illustrative embodiments. Computing system environment  100  may include computing device  101  having processor  103  for controlling overall operation of computing device  101  and its associated components, including random-access memory (RAM)  105 , read-only memory (ROM)  107 , communications module  109 , and memory  115 . Computing device  101  may include a variety of computer readable media. Computer readable media may be any available media that may be accessed by computing device  101 , may be non-transitory, and may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer-readable instructions, object code, data structures, program modules, or other data. Examples of computer readable media may include random access memory (RAM), read only memory (ROM), electronically erasable programmable read only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device  101 . 
     In some instances, some aspects described herein may be embodied as a method, a data processing system, or as a computer-readable medium storing computer-executable instructions. For example, a computer-readable medium storing instructions to cause a processor to perform steps of a method in accordance with aspects of the disclosed embodiments is contemplated. For example, aspects of the method steps disclosed herein may be executed on a processor on computing device  101 . Such a processor may execute computer-executable instructions stored on a computer-readable medium. 
     Software may be stored within memory  115  and/or storage to provide instructions to processor  103  for enabling computing device  101  to perform various functions. For example, memory  115  may store software used by computing device  101 , such as operating system  117 , application programs  119 , and associated database  121 . Also, some or all of the computer executable instructions for computing device  101  may be embodied in hardware or firmware. 
     Although not shown, RAM  105  may include one or more applications representing the application data stored in RAM  105  while computing device  101  is on and corresponding software applications (e.g., software tasks), are running on computing device  101 . 
     Communications module  109  may include a microphone, keypad, touch screen, and/or stylus through which a user of computing device  101  may provide input, and may also include one or more of a speaker for providing audio output and a video display device for providing textual, audiovisual and/or graphical output. Computing system environment  100  may also include optical scanners. 
     Computing device  101  may operate in a networked environment supporting connections to one or more remote computing devices, such as computing devices  141 ,  151 , and  161 . Computing devices  141 ,  151 , and  161  may be personal computing devices or servers that include any or all of the elements described above relative to computing device  101 . Computing device  161  may be a mobile device (e.g., smart phone) communicating over wireless carrier channel  171 . 
     The network connections depicted in  FIG. 1  may include local area network (LAN)  125  and wide area network (WAN)  129 , as well as other networks. When used in a LAN networking environment, computing device  101  may be connected to LAN  125  through a network interface or adapter in communications module  109 . When used in a WAN networking environment, computing device  101  may include a modem in communications module  109  or other means for establishing communications over WAN  129 , such as Internet  131  or other type of computer network. The network connections shown are illustrative and other means of establishing a communications link between the computing devices may be used. Various protocols such as transmission control protocol/Internet protocol (TCP/IP), Ethernet, file transfer protocol (FTP), hypertext transfer protocol (HTTP) and the like may be used, and the system can be operated in a client-server configuration to permit a user to retrieve web pages from a web-based server. One or more web browsers can be used to display and manipulate data on web pages. 
       FIG. 2  depicts an illustrative block diagram of workstations and servers that may be used to implement the processes and functions of certain aspects of the present disclosure in accordance with one or more example embodiments. Referring to  FIG. 2 , illustrative system  200  may be used for implementing example embodiments according to the present disclosure. As illustrated, system  200  may include one or more workstation computers  201 . Workstation  201  may be, for example, a desktop computer, a smartphone, a wireless device, a tablet computer, a laptop computer, and the like. Workstations  201  may be local or remote, and may be connected by one of communications links  202  to computer network  203  that is linked via communications link  205  to server  204 . In system  200 , server  204  may be a server, processor, computer, or data processing device, or combination of the same. Server  204  may be used to process the instructions received from, and the transactions entered into by, one or more participants. 
     Computer network  203  may be a computer network including the Internet, an intranet, a wide-area network (WAN), a local-area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), or any combination of any of the same. 
     Communications links  202  and  205  may be links configured to enable communications between workstations  201  and server  204 , such as network links, dial-up links, wireless links, hard-wired links, and the like. 
       FIG. 3  depicts an illustrative computing environment for securing physical-storage-media data transfers in accordance with one or more example embodiments. Referring to  FIG. 3 , computing environment  300  may be associated with one or more organizations (e.g., corporations, universities, government entities, healthcare providers, financial institutions, or the like) and may include one or more computing devices. For example, computing environment  300  may include computing device(s)  302 ,  304 ,  306 , and  308 . Computing device(s)  302 ,  304 ,  306 , and  308  may include one or more of any type of computing device (e.g., desktop computer, laptop computer, tablet computer, smart phone, server, server blade, mainframe, virtual machine, or the like) configured to perform one or more of the functions described herein. As will be described in greater detail below, one or more of computing device(s)  302 ,  304 ,  306 , or  308  may store secure data associated with the organization. For example, computing device(s)  308  may store secure data  310 . Computing environment  300  may also include one or more networks. For example, computing environment  300  may include network(s)  312 , which may include one or more sub-networks (e.g., LANs, WANs, VPNs, or the like) and may interconnect one or more of computing device(s)  302 ,  304 ,  306 , and  308 . 
     Computing environment  300  may also include one or more computing systems. For example, computing environment  300  may include computing system  314 . Computing system  314  may include one or more of any type of computing device (e.g., desktop computer, laptop computer, tablet computer, smart phone, server, server blade, mainframe, virtual machine, or the like) configured to perform one or more of the functions described herein. In some embodiments, computing system  314  may include one or more of computing device(s)  302 ,  304 ,  306 , or  308 . Computing system  314  may include one or more processor(s)  316 , memory  318 , communication interface  320 , and/or data bus  322 . Data bus  322  may interconnect processor(s)  316 , memory  318 , and/or communication interface  320 . Communication interface  320  may be a network interface configured to support communications between computing system  314  and network(s)  312  (or one or more sub-networks thereof) (e.g., communications between computing system  314  and one or more of computing device(s)  302 ,  304 ,  306 , or  308 ). Memory  318  may include one or more program modules comprising instructions that when executed by processor(s)  316  cause computing system  314  to perform one or more functions described herein. For example, memory  318  may include program module(s)  324 , which may comprise instructions that when executed by processor(s)  316  cause computing system  314  to perform one or more functions described herein. As will be described in further detail below, computing environment  300  may further include one or more physical storage media  326 . Physical storage media  326  may include one or more physically distinct media for storing computer data. Physical storage media  326  may include computer-data-storage media intended for repetitive or long-term use by a particular one of computing device(s)  302 ,  304 , or  306  (e.g., fixed media, such as an integrated disk drive (e.g., a “hard” drive, one or more reusable disks or platters, solid-state-memory devices, or the like), or similar media), as well as computer-data-storage media intended for one-time or periodic short-term use by one or more of computing device(s)  302 ,  304 , or  306  (e.g., removable media, such as diskettes (e.g., “floppy” diskettes, or the like), optical media (e.g., compact disk-recordable (CD-R) disks, compact disk-rewritable (CD-RW) disks, digital versatile (or video) disk (DVD) disks, or the like), solid-state-memory devices (e.g., solid-state-memory devices equipped with a universal serial bus (USB) interface, memory or flash cards, other volatile-memory devices, or the like), removable disk drives (e.g., external or peripheral disk drives, hot-swappable disk drives, or the like), or similar media). 
       FIG. 4  depicts an illustrative event sequence for securing physical-storage-media data transfers in accordance with one or more example embodiments. Referring to  FIG. 4 , at step  1 , computing device(s)  306  may provision physical storage media  326  with physical-storage-media identifiers. For example, computing device(s)  306  may be associated with a physical-storage-media administrator of the organization associated with computing environment  300 , physical storage media  326  may comprise physical storage media approved for use by the organization, and the physical-storage-media administrator may utilize computing device(s)  306  to write a different (or unique) physical-storage-media identifier to each of physical storage media  326 , each of which may store its respective physical-storage-media identifier. 
     In some embodiments, physical storage media  326  may include optical media, and computing device(s)  306  may write a different physical-storage-media identifier to each of the optical media. In some embodiments, each of the optical media may include a portion reserved for physical-storage-media identifiers associated with physical storage media  326  (e.g., physical storage media approved for use by the organization associated with computing environment  300 ), and computing device(s)  306  may write the different physical-storage-media identifier to the portion of the optical medium reserved for the physical-storage-media identifiers. In some embodiments, computing device(s)  306  may write the physical-storage-media identifier to the optical medium, during a first optical-media-writing session for the optical medium. 
     Additionally or alternatively, physical storage media  326  may include solid-state-memory devices, and computing device(s)  306  may write a different physical-storage-media identifier to each of the solid-state-memory devices. In some embodiments, each of the solid-state-memory devices may include a portion (e.g., a physically and/or logically separate memory, or the like) reserved for physical-storage-media identifiers associated with physical storage media  326 . In such embodiments, computing device(s)  306  may write the different physical-storage-media identifier to the portion of the solid-state-memory device reserved for physical-storage-media identifiers. 
     In some embodiments, computing device(s)  306  may configure each physical storage medium of physical storage media  326  to prevent the portion of the physical storage medium reserved for physical-storage-media identifiers associated with physical storage media  326  from being displayed in a user-viewable portion of an operating system file system (e.g., to hide the reserved portion (or data contained therein) from view within the file system, prevent accidental access, modification, or manipulation of the reserved portion (or data contained therein), or the like). 
     At step  2 , computing device(s)  306  may communicate (e.g., via network(s)  312 , as indicated by the shaded box over the line extending downward from network(s)  312 ) the physical-storage-media identifiers associated with physical storage media  326  to computing system  314 , which may receive (e.g., via communication interface  320 ) the physical-storage-media identifiers associated with physical storage media  326  and may generate, in a log stored in memory  318  an entry for each of physical storage media  326 . Each entry may comprise the physical-storage-media identifier written by computing device(s)  306  to its corresponding physical storage medium. In some embodiments, computing device(s)  306  may communicate to computing system  314  one or more properties of each physical storage medium of physical storage media  326  (e.g., a number of times the physical storage medium has been written to, an available amount of storage on the physical storage medium, a total storage capacity of the physical storage medium, a manufacture of the physical storage medium, a number of times that the physical-storage-media identifier has been read from the physical storage medium, or the like), and each of the entries generated by computing system  314  may comprise the properties of its corresponding physical storage medium. 
     At step  3 , computing device(s)  302  may generate a request to write a portion of secure data  310  to a physical storage medium. For example, secure data  310  may include data that the organization associated with computing environment  300  has identified as presenting a heightened data-leakage risk, and computing device(s)  302  and  304  may be among a limited number of computing device(s) within computing environment  300  authorized to write portions of secure data  310  to physical storage media  326 ; however, the authorization of computing device(s)  302  and  304  to write portions of secure data  310  to physical storage media  326  may be subject to case-by-case authorization from computing system  314 . At step  4 , computing device(s)  302  may communicate, to computing system  314 , the request to write the portion of secure data  310  to the physical storage medium, and computing system  314  may receive (e.g., via communication interface  320 ) the request from computing device(s)  302 . At step  5 , computing system  314  may determine to grant the request received from computing device(s)  302 . For example, the request to write the portion of secure data  310  to the physical storage medium may comprise a physical-storage-media identifier stored on the physical storage medium and read by computing device(s)  302  from the physical storage medium, and computing system  314  may identify, in the log stored in memory  318 , an entry comprising the physical-storage-media identifier (e.g., amongst the entries generated by computing system  314 , as described above with respect to step  2 ) and may determine to grant the request based on identifying the entry comprising the physical-storage-media identifier (e.g., based on determining that the physical-storage-media identifier is amongst the physical-storage-media identifiers associated with physical storage media  326  (e.g., physical storage media approved for use by the organization associated with computing environment  300 )). 
     At step  6 , computing system  314  may request the portion of secure data  310  from computing device(s)  308  (e.g., computing device(s)  302  and  304  may be unable to directly access secure data  310  due to their being among the limited number of computing device(s) within computing environment  300  authorized to write portions of secure data  310  to physical storage media  326 ), and, at step  7 , computing device(s)  308  may communicate the requested portion of secure data  310  to computing system  314 , which may receive (e.g., via communication interface  320 ) the requested portion of secure data  310  and, at step  8 , may communicate, to computing device(s)  302  the requested portion of secure data  310 , as well as instructions (and/or authorization) to write the requested portion of secure data  310  to the physical storage medium. At step  9 , computing device(s)  302  may write the requested portion of secure data  310  to the physical storage medium. As indicated above, in some embodiments, the physical storage medium may comprise an optical medium, and computing device(s)  306  may have written the physical-storage-media identifier during a first optical-media-writing session for the optical medium. In such embodiments, computing device(s)  302  may write the requested portion of secure data  310  to the optical medium during a second optical-media-writing session for the optical medium. 
     At step  10 , computing device(s)  302  may communicate log data (e.g., data indicating that the requested portion of secure data  310  was written to the physical storage medium and/or one or more updated properties of the physical storage medium (e.g., an updated number of times the physical storage medium has been written to, an updated amount of available storage on the physical storage medium, an updated number of times that the physical-storage-media identifier has been read from the physical storage medium, or the like)) to computing system  314 , which may receive (e.g., via communication interface  320 ) the log data from computing device(s)  302  and, at step  11 , may update the log entry comprising the physical-storage-media identifier (e.g., to reflect that computing system  314  instructed computing device(s)  302  to write the portion of secure data  310  to the physical storage medium, an updated number of times the physical storage medium has been written to, an updated amount of available storage on the physical storage medium, an updated number of times that the physical-storage-media identifier has been read from the physical storage medium, one or more associated timestamps or environment variables, or the like). 
     At step  12 , computing device(s)  304  may generate a request to write a portion of secure data  310  to a physical storage medium. At step  13 , computing device(s)  304  may communicate, to computing system  314 , the request to write the portion of secure data  310  to the physical storage medium, and computing system  314  may receive (e.g., via communication interface  320 ) the request from computing device(s)  304 . At step  14 , computing system  314  may determine to deny the request received from computing device(s)  304  and may thus fail to instruct (and/or authorize) computing device(s)  304  to write the portion of secure data  310  to the physical storage medium. For example, in some embodiments, the request to write the portion of secure data  310  to the physical storage medium may comprise a physical-storage-media identifier stored on the physical storage medium and read by computing device(s)  304  from the physical storage medium, and computing system  314  may fail to identify, in the log stored in memory  318 , an entry comprising the physical-storage-media identifier (e.g., amongst the entries generated by computing system  314 , as described above with respect to step  2 ) and may determine to deny the request based on failing to identify an entry comprising the physical-storage-media identifier (e.g., based on determining that the physical-storage-media identifier is not amongst the physical-storage-media identifiers associated with physical storage media  326  (e.g., physical storage media approved for use by the organization associated with computing environment  300 )). 
     Alternatively, computing system  314  may identify, in the log stored in memory  318 , an entry comprising the physical-storage-media identifier (e.g., amongst the entries generated by computing system  314 , as described above with respect to step  2 ) and may determine to deny the request based on identifying the entry comprising the physical-storage-media identifier (e.g., based on determining that the physical-storage-media identifier is amongst the physical-storage-media identifiers associated with physical storage media  326  (e.g., physical storage media approved for use by the organization associated with computing environment  300 )). In some embodiments, computing system  314  may determine, based on the physical-storage-media identifier, that the physical storage medium has been tampered with. For example, the request received from computing device(s)  304  may comprise one or more properties of the physical storage medium determined by computing device(s)  304  (e.g., a number of times the physical storage medium has been written to, an available amount of storage on the physical storage medium, a total storage capacity of the physical storage medium, a manufacture of the physical storage medium, a number of times that the physical-storage-media identifier has been read from the physical storage medium, or the like). 
     As indicated above, in some embodiments, each of the entries generated by computing system  314  may comprise one or more properties of its corresponding physical storage medium (e.g., a number of times the physical storage medium has been written to, an available amount of storage on the physical storage medium, a total storage capacity of the physical storage medium, a manufacture of the physical storage medium, a number of times that the physical-storage-media identifier has been read from the physical storage medium, or the like). In such embodiments, computing system  314  may determine that the physical storage medium has been tampered with by determining that one or more of the properties of the physical storage medium included in the request received from computing device(s)  304  differs from one or more of the properties included in the entry comprising the physical-storage media identifier (e.g., that the request indicates that computing device(s)  304  determined a number of times the physical storage medium has been written to that differs from a number of times the physical storage medium has been written to indicated by the entry comprising the physical-storage-media identifier included in the request, that the request indicates that computing device(s)  304  determined an available amount of storage on the physical storage medium that differs from an available amount of storage of the physical storage medium indicated by the entry comprising the physical-storage-media identifier included in the request, that the request indicates that computing device(s)  304  determined a total storage capacity of the physical storage medium that differs from a total storage capacity of the physical storage medium indicated by the entry comprising the physical-storage-media identifier included in the request, that the request indicates that computing device(s)  304  determined a manufacture of the physical storage medium that differs from a manufacture of the physical storage medium indicated by the entry comprising the physical-storage-media identifier included in the request, that the request indicates that computing device(s)  304  determined a number of times that the physical-storage-media identifier has been read from the physical storage medium that differs from a number of times that the physical-storage-media identifier has been read from the physical storage medium indicated by the entry comprising the physical-storage-media identifier included in the request, or the like). 
     At step  15 , computing system  314  may update the log entry comprising the physical-storage-media identifier (e.g., to reflect that computing system  314  failed to instruct computing device(s)  304  to write the portion of secure data  310  to the physical storage medium. At step  16 , computing system  314  may generate (e.g., based on one or more of the log entries updated in steps  11  and  15 ) a message indicating whether computing system  314  instructed computing device(s)  302  and/or  304  to write the requested portions of secure data  310  to the physical storage media and may communicate the message to computing device(s)  306 . For example, in some embodiments, the message may comprise a report indicating that computing system  314  instructed computing device(s)  302  to write the requested portion of secure data  310  to the physical storage medium and failed to instruct computing device(s)  304  to write the requested portion of secure data  310  to the physical storage medium. Additionally or alternatively, the message may comprise an alert generated by computing system  314  in response to the request received from computing device(s)  304  and may indicate that computing system  314  failed to instruct computing device(s)  304  to write the requested portion of secure data  310  to the physical storage medium. 
       FIG. 5  depicts an illustrative method for securing physical-storage-media data transfers in accordance with one or more example embodiments. Referring to  FIG. 5 , at step  502 , physical storage media approved for use by an organization may be provisioned with physical-storage-media identifiers. For example, computing device(s)  306  may write a different physical-storage-media identifier to each of physical storage media  326 . At step  504 , a request to write secure data to a physical storage medium may be received. For example, computing system  314  may receive a request to write a portion of secure data  310  to a physical storage medium from computing device(s)  302  or  304 . At step  506 , a determination may be made whether to write the secure data to the physical storage medium. For example, computing system  314  may determine that computing device(s)  302  should write the requested portion of secure data  310  to the physical storage medium and/or that computing device(s)  304  should not write the requested portion of secure data  310  to the physical storage medium. Responsive to determining that the secure data should be written to the physical storage medium, at step  508 , the secure data may be requested, and, at step  510 , the secure data may be written to the physical storage medium. For example, responsive to determining that computing device(s)  302  should write the requested portion of secure data  310  to the physical storage medium, computing system  314  may request the portion of secure data  310  from computing device(s)  308  and communicate the portion of secure data  310  to computing device(s)  302 , which may write the portion of secure data  310  to the physical storage medium. Similarly, responsive to determining that computing device(s)  304  should not write the requested portion of secure data  310  to the physical storage medium, computing system  314  may fail to request the portion of secure data  310  from computing device(s)  308 . At step  512 , a log may be updated to reflect whether the requested portion of the secure data was written to the physical storage medium. For example, computing system  314  may update the log to reflect that computing device(s)  302  wrote the requested portion of secure data  310  to the physical storage medium and/or that computing device(s)  304  failed to write the requested portion of secure data  310  to the physical storage medium. 
       FIGS. 6A and 6B  depict an illustrative computing environment for ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments. Referring to  FIG. 6A , computing environment  600  may include one or more computer systems and/or computing devices. For example, computing environment  600  may include a data source computing device  610 , a data separation computing platform  620 , a data transfer administrative computing device  630 , a data reassembly computing platform  640 , a first data recipient computing device  650 , and a second data recipient computing device  660 . 
     Data source computing device  610  may be a computing device (e.g., a desktop computing device, a laptop computing device, and/or the like) that is used by a first user of an organization (e.g., a financial institution). As illustrated below, data source computing device  610  may store a source data collection, and the user of data source computing device  610  may initiate a secure data transfer of the source data collection to one or more recipient computer systems and/or devices via physical media, via electronic transmission, and/or via another mode of transfer. 
     As illustrated below, data separation computing platform  620  may include one or more computing devices configured to perform one or more of the functions described herein. For example, data separation computing platform  620  may include one or more computers (e.g., laptop computers, desktop computers, servers, server blades, or the like) configured to perform one or more of the functions described herein, as discussed in greater detail below. 
     Data transfer administrative computing device  630  may be a computing device (e.g., a desktop computing device, a laptop computing device, and/or the like) that is used by a second user of an organization (e.g., a financial institution), such as an administrative user who is tasked with and/or responsible for facilitating and/or monitoring secure data transfers. As illustrated below, data transfer administrative computing device  630  may receive and present notifications and/or other user interfaces associated with secure data transfers, and in some instances, data transfer administrative computing device  630  may send commands to other systems and/or devices included in computing environment  600  (e.g., based on input received from a user of data transfer administrative computing device  630 ) to facilitate and/or control one or more parameters of various secure data transfers. 
     Data reassembly computing platform  640  may include one or more computing devices configured to perform one or more data reassembly functions and/or other functions described herein. For example, data reassembly computing platform  640  may include one or more computers (e.g., laptop computers, desktop computers, servers, server blades, or the like) configured to execute and/or otherwise provide a data reassembly engine and/or other functions, such as decrypting various data blocks and/or reassembling a data collection associated with such data blocks, as discussed in greater detail below. 
     Data recipient computing device  650  may be a computing device (e.g., a desktop computing device, a laptop computing device, and/or the like) that is used by a third user of an organization (e.g., a financial institution). As illustrated below, data recipient computing device  650  may receive a data collection via a secure data transfer initiated by and/or facilitated by one or more other systems and/or devices included in computing environment  600 . Similarly, data recipient computing device  660  may be a computing device (e.g., a desktop computing device, a laptop computing device, and/or the like) that is used by a fourth user of an organization (e.g., a financial institution). In addition, and as illustrated below, data recipient computing device  660  may receive a data collection via a secure data transfer initiated by and/or facilitated by one or more other systems and/or devices included in computing environment  600 . 
     In some arrangements, data source computing device  610 , data separation computing platform  620 , data transfer administrative computing device  630 , data reassembly computing platform  640 , data recipient computing device  650 , and data recipient computing device  660  may be any type of computing device capable of receiving a user interface, receiving input via the user interface, and communicating the received input to one or more other computing devices. For example, data source computing device  610 , data separation computing platform  620 , data transfer administrative computing device  630 , data reassembly computing platform  640 , data recipient computing device  650 , and data recipient computing device  660  may, in some instances, be and/or include server computers, desktop computers, laptop computers, tablet computers, smart phones, or the like that may include one or more processors, memories, communication interfaces, storage devices, and/or other components. As noted above, and as illustrated in greater detail below, any and/or all of data source computing device  610 , data separation computing platform  620 , data transfer administrative computing device  630 , data reassembly computing platform  640 , data recipient computing device  650 , and data recipient computing device  660  may, in some instances, be special-purpose computing devices configured to perform specific functions. 
     Computing environment  600  also may include one or more networks, which may interconnect one or more of data source computing device  610 , data separation computing platform  620 , data transfer administrative computing device  630 , data reassembly computing platform  640 , data recipient computing device  650 , and data recipient computing device  660 . For example, computing environment  600  may include network  690 , which may include one or more public networks, private networks, and/or sub-networks (e.g., local area networks (LANs), wide area networks (WANs), or the like). 
     Referring to  FIG. 6B , data separation computing platform  620  may include one or more processors  621 , one or more memories  622 , and one or more communication interfaces  623 . A data bus may interconnect the one or more processors  621 , the one or more memories  622 , and the one or more communication interfaces  623 . Communication interface  623  may be a network interface configured to support communication between data separation computing platform  620  and one or more networks (e.g., network  690  or the like). Memory  622  may include one or more program modules having instructions that when executed by processor  621  cause data separation computing platform  620  to perform one or more functions described herein and/or one or more databases and/or other libraries that may store and/or otherwise maintain information which may be used by such program modules and/or processor  621 . 
     In some instances, the one or more program modules and/or databases may be stored by and/or maintained in different memory units of data separation computing platform  620  and/or by different computing devices that may form and/or otherwise make up data separation computing platform  620 . For example, memory  622  may have, store, and/or include a data separation module  622   a  and a data separation database  622   b . Data separation module  622   a  may include executable instructions that enable and/or cause data separation computing platform  620  to divide a data collection into various data blocks, encrypt the data blocks, initiate a secure transfer of the encrypted data blocks via physical media, and/or perform other functions, as illustrated in greater detail below. Data separation database  622   b  may store and/or otherwise maintain information that may be used by data separation computing platform  620  in dividing a data collection into various data blocks, in encrypting the data blocks, in initiating a secure transfer of the encrypted data blocks via physical media, and/or in performing other functions, as illustrated in greater detail below. 
       FIGS. 7A, 7B, 7C, 7D, and 7E  depict an illustrative event sequence for ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments. Referring to  FIG. 7A , at step  701 , data source computing device  610  may receive input requesting a secure data transfer. In some instances, the input requesting the secure data transfer may be received by data source computing device  610  via one or more graphical user interfaces displayed and/or otherwise presented by data source computing device  610 . For example, at step  701 , data source computing device  610  may present one or more graphical user interfaces, such as one or more graphical user interfaces similar to graphical user interface  800 , which is depicted in  FIG. 8 . As seen in  FIG. 8 , graphical user interface  800  may include one or more controls and/or other elements that enable a user of data source computing device  610  to request a secure data transfer and/or specify one or more parameters of the secure data transfer, such as the data collection to be transferred, one or more specific recipients to receive the data collection to be transferred, a specific type of physical media to be used in completing the secure data transfer, a specific quantity of physical media to be used in completing the secure data transfer, a specific encryption method to be used in completing the secure data transfer, and/or other parameters. Any and/or all of these parameters may be sent to data separation computing platform  620  by data source computing device  610  to initiate and/or facilitate the secure data transfer of the data collection, as illustrated below. 
     At step  702 , data source computing device  610  may identify a source data collection to be transferred (e.g., based on the input requesting the secure data transfer). For instance, data source computing device  610  may access and/or store a plurality of data collections and, at step  702 , may identify a source data collection to be transferred by selecting the source data collection from the plurality of data collections accessible to and/or stored by data source computing device  610 . At step  703 , data source computing device  610  may send the source data collection to data separation computing platform  620 . 
     At step  704 , data separation computing platform  620  may receive the source data collection to be transferred from data source computing device  610 . For example, at step  704 , data separation computing platform  620  may receive, via the communication interface (e.g., communication interface  623 ), from a data source computing device (e.g., data source computing device  610 ), a source data collection for a secure physical-storage-media data transfer. In some instances, in receiving the source data collection for the secure physical-storage-media data transfer from data source computing device  610 , data separation computing platform  620  may establish a connection with data source computing device  610  via communication interface  623 , and data separation computing platform  620  may receive the source data collection for the secure physical-storage-media data transfer from data source computing device  610  while the connection with data source computing device  610  is established. 
     Referring to  FIG. 7B , at step  705 , data separation computing platform  620  may identify one or more transmission parameters for the secure data transfer. For example, at step  705 , based on receiving the source data collection for the secure physical-storage-media data transfer from the data source computing device (e.g., data source computing device  610 ), data separation computing platform  620  may identify one or more transmission parameters associated with the secure physical-storage-media data transfer. In some instances, data separation computing platform  620  may identify one or more transmission parameters for the secure data transfer based on specifications and/or other information received from data source computing device  610 , and these specifications and/or other information received from data source computing device  610  may include the one or more parameters specified by the user of data source computing device  610  via the one or more graphical user interfaces discussed above. Additionally or alternatively, data separation computing platform  620  may identify one or more transmission parameters for the secure data transfer based on information maintained by data separation computing platform  620  identifying the capabilities and/or supported encryption standards and/or data types of one or more recipient systems and/or devices (e.g., data reassembly computing platform  640 , data recipient computing device  650 , data recipient computing device  660 ). For instance, data separation computing platform  620  may select specific encryption standards and/or data types to use in the secure data transfer based on the capabilities and/or supported encryption standards and/or data types of one or more recipient systems and/or devices (e.g., data reassembly computing platform  640 , data recipient computing device  650 , data recipient computing device  660 ). 
     In some embodiments, the one or more transmission parameters associated with the secure physical-storage-media data transfer may specify a quantity of physical media to be used in the secure physical-storage-media data transfer. For example, the one or more transmission parameters associated with the secure physical-storage-media data transfer (which may, e.g., be identified by data separation computing platform  620 ) may specify a quantity of physical media to be used by data separation computing platform  620  in the secure physical-storage-media data transfer. 
     In some embodiments, the one or more transmission parameters associated with the secure physical-storage-media data transfer may specify an encryption method to be used in the secure physical-storage-media data transfer. For example, the one or more transmission parameters associated with the secure physical-storage-media data transfer (which may, e.g., be identified by data separation computing platform  620 ) may specify an encryption method to be used by data separation computing platform  620  in the secure physical-storage-media data transfer. 
     At step  706 , data separation computing platform  620  may divide the source data collection in a plurality of data blocks (e.g., based on the one or more transmission parameters). For example, at step  706 , data separation computing platform  620  may divide the source data collection received from the data source computing device (e.g., data source computing device  610 ) into two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer. In dividing the source data collection based on the one or more transmission parameters, data separation computing platform  620  may, for instance, divide the source data collection in accordance with one or more transmission parameters specifying a quantity of physical media to be used by data separation computing platform  620  in the secure physical-storage-media data transfer, as the quantity of physical media to be used by data separation computing platform  620  in the secure physical-storage-media data transfer may equal and/or otherwise correspond to the number of data blocks to be used by data separation computing platform  620  in the secure physical-storage-media data transfer. 
     In some embodiments, dividing the source data collection received from the data source computing device into the two or more data blocks may include adding one or more block header tags to each data block of the two or more data blocks, and the one or more block header tags may uniquely identify each data block of the two or more data blocks to facilitate reassembly of the source data collection by a data reassembly computing platform. For example, in dividing the source data collection received from the data source computing device (e.g., data source computing device  610 ) into the two or more data blocks, data separation computing platform  620  may add one or more block header tags to each data block of the two or more data blocks. In addition, the one or more block header tags (which may, e.g., be generated and added by data separation computing platform  620  to each data block of the two or more data blocks) may uniquely identify each data block of the two or more data blocks to facilitate reassembly of the source data collection by a data reassembly computing platform (e.g., data reassembly computing platform  640 ). For instance, the one or more block header tags (which may, e.g., be generated and added by data separation computing platform  620  to each data block of the two or more data blocks) may include a serial number for each data block (e.g., “Block  1 ”), a total number of data blocks into which the source data collection has been divided (e.g., “5 Blocks Total”), information identifying a source device from which the source data collection originated (e.g., a unique identifier associated with data source computing device  610 ), information identifying the division-encryption system (e.g., a unique identifier associated with data separation computing platform  620 ), and/or other information that may enable data reassembly computing platform  640  to identify and decrypt each data block and/or reassemble the source data collection from the plurality of data blocks. 
     At step  707 , data separation computing platform  620  may encrypt the data blocks created by data separation computing platform  620  in dividing the source data collection. For example, at step  707 , data separation computing platform  620  may separately encrypt the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer to produce two or more encrypted data blocks for the secure physical-storage-media data transfer. In some instances, in separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer, data separation computing platform  620  may, for instance, encrypt the two or more data blocks in accordance with one or more transmission parameters specifying an encryption method to be used by data separation computing platform  620  in the secure physical-storage-media data transfer. In addition, in some instances, data separation computing platform  620  may encrypt the block header tags and/or other metadata added by data separation computing platform  620  to the data blocks, while in other instances, data separation computing platform  620  might not encrypt the block header tags and/or other metadata added by data separation computing platform  620  to the data blocks. 
     In some embodiments, separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer may include encrypting the one or more block header tags added to each data block of the two or more data blocks. For example, in separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer, data separation computing platform  620  may encrypt the one or more block header tags added to each data block of the two or more data blocks. 
     In some embodiments, separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer may include failing to encrypt the one or more block header tags added to each data block of the two or more data blocks. For example, in separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer, data separation computing platform  620  may fail to encrypt the one or more block header tags added to each data block of the two or more data blocks (e.g., so as to not encrypt the block header tags and/or other metadata added by data separation computing platform  620  to the data blocks). 
     At step  708 , data separation computing platform  620  may store the encrypted data blocks on physical media (e.g., to facilitate the secure data transfer of the source data collection to one or more recipients). For example, at step  708 , after separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer, data separation computing platform  620  may store the two or more encrypted data blocks on two or more physical media, and each encrypted data block of the two or more encrypted data blocks may be stored on a different physical medium of the two or more physical media. For instance, data separation computing platform  620  may store each encrypted data block of the two or more encrypted data blocks on a different physical medium of the two or more physical media, such that each encrypted data block is stored on a dedicated medium different from the other encrypted data block(s). By storing the encrypted data blocks on different media, data separation computing platform  620  may increase the security of the data being transferred, since not only may the data blocks be encrypted, but a system or device might need to receive and decrypt all of the encrypted data blocks (and thus all of the different physical media) to reassemble the data collection and subsequently access any portion of the data collection. In some instances, in storing the encrypted data blocks on physical media, data separation computing platform  620  may store the encrypted data blocks on any type of physical media, include any of the various types of physical media discussed above. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more compact discs. For example, in storing the two or more encrypted data blocks on the two or more physical media, data separation computing platform  620  may store the two or more encrypted data blocks on two or more compact discs. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more flash drives. For example, in storing the two or more encrypted data blocks on the two or more physical media, data separation computing platform  620  may store the two or more encrypted data blocks on two or more flash drives. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more hard drives. For example, in storing the two or more encrypted data blocks on the two or more physical media, data separation computing platform  620  may store the two or more encrypted data blocks on two or more hard drives. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more magnetic tapes. For example, in storing the two or more encrypted data blocks on the two or more physical media, data separation computing platform  620  may store the two or more encrypted data blocks on two or more magnetic tapes. 
     In some embodiments, storing the two or more encrypted data blocks on the two or more physical media may include storing the two or more encrypted data blocks on two or more separately shippable physical media, and the two or more encrypted data blocks may be configured to be decrypted and reassembled into the source data collection by a data reassembly computing platform. For example, in storing the two or more encrypted data blocks on the two or more physical media, data separation computing platform  620  may store the two or more encrypted data blocks on two or more separately shippable physical media, and the two or more encrypted data blocks may be configured to be decrypted and reassembled into the source data collection by a data reassembly computing platform (e.g., data reassembly computing platform  640 ), as illustrated below. The two or more separately shippable physical media may, for instance, be different physical media that may be separately transferable to a recipient, such as different discs, tapes, drives, and/or the like, which may be packaged in separate shipping containers, such as different envelopes, boxes, crates, or the like. In this way, each encrypted data block may be separately shipped on its own dedicated physical medium to a recipient system (e.g., data reassembly computing platform  640 ) that may decrypt and reassemble the source data collection from all of the separate physical media and the corresponding set of encrypted data blocks. 
     Referring to  FIG. 7C , at step  709 , data separation computing platform  620  may generate a notification indicating that the physical media are ready for transfer. For example, at step  709 , based on storing the two or more encrypted data blocks on the two or more physical media, data separation computing platform  620  may generate a notification indicating that the two or more physical media are ready to be transferred to a destination system (e.g., data reassembly computing platform  640 ). At step  710 , data separation computing platform  620  may send the notification to data transfer administrative computing device  630 . For example, at step  710 , data separation computing platform  620  may send, via the communication interface (e.g., communication interface  623 ), to a data transfer administrative computing device (e.g., data transfer administrative computing device  630 ), the notification indicating that the two or more physical media are ready to be transferred to the destination system (e.g., data reassembly computing platform  640 ) to initiate a physical transfer of the two or more physical media. 
     At step  711 , data transfer administrative computing device  630  may receive the notification from data separation computing platform  620 . In addition, in response to receiving the notification from data separation computing platform  620 , data transfer administrative computing device  630  may automatically initiate the physical shipping and/or sending of the physical media to the destination system (e.g., data reassembly computing platform  640 ). Additionally or alternatively, in response to receiving the notification from data separation computing platform  620 , data transfer administrative computing device  630  may present one or more graphical user interfaces (which may, e.g., include the notification and/or information generated by data transfer administrative computing device  630  based on the notification) to a user of data transfer administrative computing device  630  who may facilitate the physical shipping and/or sending of the physical media to the destination system (e.g., data reassembly computing platform  640 ). 
     At step  712 , data reassembly computing platform  640  may receive physical media. For example, at step  712 , data reassembly computing platform  640  may receive the two or more physical media on which the two or more encrypted data blocks were stored by data separation computing platform  620 . Data reassembly computing platform  640  may, for instance, receive the physical media as a result of and/or after completion of the physical shipping process initiated and/or facilitated by data separation computing platform  620  and/or data transfer administrative computing device  630 . Additionally or alternatively, in receiving the physical media, data reassembly computing platform  640  may receive and/or load the physical media via one or more slots, readers, and/or input devices (e.g., disc readers, tape readers, drive ports, and/or the like). 
     Referring to  FIG. 7D , at step  713 , data reassembly computing platform  640  may load the encrypted data blocks from the physical media. For example, at step  713 , data reassembly computing platform  640  may load the two or more encrypted data blocks from the two or more physical media. At step  714 , data reassembly computing platform  640  may decrypt the encrypted data blocks. For example, at step  714 , data reassembly computing platform  640  may execute one or more decryption methods, corresponding to the one or more encryption methods used by data separation computing platform  620  to encrypt the data blocks, so as to decrypt each of the two or more encrypted data blocks loaded from the two or more physical media. 
     At step  715 , data reassembly computing platform  640  may reassemble the source data collection from the decrypted data blocks. For example, at step  715 , data reassembly computing platform  640  may reassemble the source data collection from the decrypted data blocks by arranging the decrypted data blocks in a specific order (e.g., in their original order in the source data collection) so as to reproduce the source data collection. In some instances, data reassembly computing platform  640  may arrange and/or otherwise order the decrypted data blocks based on the block tags and/or other metadata that may have been added by data separation computing platform  620  and/or otherwise included with the data blocks. For instance, data reassembly computing platform  640  might not receive or decrypt the data blocks in their original order, and thus data reassembly computing platform  640  might need to use the block tags and/or other metadata added by data separation computing platform  620  to arrange the data blocks in order to reproduce the source data collection. 
     At step  716 , data reassembly computing platform  640  may store the reassembled source data collection. For example, at step  716 , data reassembly computing platform  640  may store the reassembled source data collection in one or more databases and/or memory units maintained by and/or associated with data reassembly computing platform  640 . 
     Referring to  FIG. 7E , at step  717 , data reassembly computing platform  640  may identify one or more data recipients. For example, at step  717 , data reassembly computing platform  640  may identify one or more data recipients with which data reassembly computing platform  640  may share the data collection itself and/or access to the data collection (which may, e.g., be stored on and/or hosted by data reassembly computing platform  640 ). In some instances, data reassembly computing platform  640  may identify the one or more data recipients based on the tags and/or other metadata that may have been added by data separation computing platform  620  and/or otherwise included with the data blocks (e.g., based on specifications and/or other information provided by a source device, such as data source computing device  610 ). At step  718 , data reassembly computing platform  640  may send the data collection to data recipient computing device  650  and/or data recipient computing device  660 . Additionally or alternatively, data reassembly computing platform  640  may host the data collection, may send one or more invites to access the data collection to data recipient computing device  650  and/or data recipient computing device  660 , and/or may provide access to the data collection to data recipient computing device  650  and/or data recipient computing device  660 . 
     At step  719 , data recipient computing device  650  may receive the data collection from data reassembly computing platform  640 . For example, at step  719 , data recipient computing device  650  may receive part or all of the data collection from data reassembly computing platform  640  and/or may receive access to part or all of the data collection from data reassembly computing platform  640  (e.g., in instances in which data reassembly computing platform  640  hosts the data collection). At step  720 , data recipient computing device  650  may present one or more graphical user interfaces associated with the data collection received from data reassembly computing platform  640 . For example, at step  720 , data recipient computing device  650  may present one or more graphical user interfaces, such as one or more graphical user interfaces similar to graphical user interface  900 , which is depicted in  FIG. 9 . As seen in  FIG. 9 , graphical user interface  900  may include one or more controls and/or other elements that identify the data collection that has been received, along with the source of the data collection (e.g., data source computing device  610 ) and the decryption/reassembly platform (e.g., data reassembly computing platform  640 ), as well as one or more controls and/or other elements that enable a user of data recipient computing device  650  to access and/or view the data collection. 
     Subsequently, one or more steps of the example event sequence may be repeated with the same and/or different systems and/or devices to facilitate the secure transfer of one or more other data collections. In one or more alternative arrangements, features similar to those described above may be extended to provide cloud-based secure data transfer functions. For instance, in such cloud-based embodiments, a data collection may be divided and encrypted to produce a plurality of distinct, encrypted data blocks, similar to how such data blocks may be created by data separation computing platform  620  from a source data collection in the example event sequence discussed above. Subsequently, such distinct, encrypted data blocks may be transmitted via a network or cloud-based connection to one or more recipient systems and/or devices, such as data reassembly computing platform  640 , to facilitate a secure data transfer. 
       FIG. 10  depicts an illustrative method for ensuring information security in data transfers by dividing and encrypting data blocks in accordance with one or more example embodiments. Referring to  FIG. 10 , at step  1005 , a computing platform having at least one processor, a communication interface, and memory storing instructions may receive, via the communication interface, from a data source computing device, a source data collection for a secure physical-storage-media data transfer. At step  1010 , based on receiving the source data collection for the secure physical-storage-media data transfer from the data source computing device, the computing platform may identify one or more transmission parameters associated with the secure physical-storage-media data transfer. At step  1015 , the computing platform may divide the source data collection received from the data source computing device into two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer. At step  1020 , the computing platform may separately encrypt the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer to produce two or more encrypted data blocks for the secure physical-storage-media data transfer. At step  1025 , after separately encrypting the two or more data blocks based on the one or more transmission parameters associated with the secure physical-storage-media data transfer, the computing platform may store the two or more encrypted data blocks on two or more physical media, and each encrypted data block of the two or more encrypted data blocks may be stored on a different physical medium of the two or more physical media. 
     One or more aspects of the disclosure may be embodied in computer-usable data or computer-executable instructions, such as in one or more program modules, executed by one or more computers or other devices to perform the operations described herein. Generally, program modules include routines, programs, objects, components, data structures, and the like that perform particular tasks or implement particular abstract data types when executed by one or more processors in a computer or other data processing device. The computer-executable instructions may be stored as computer-readable instructions on a computer-readable medium such as a hard disk, optical disk, removable storage media, solid-state memory, RAM, and the like. The functionality of the program modules may be combined or distributed as desired in various embodiments. In addition, the functionality may be embodied in whole or in part in firmware or hardware equivalents, such as integrated circuits, application-specific integrated circuits (ASICs), field programmable gate arrays (FPGA), and the like. Particular data structures may be used to more effectively implement one or more aspects of the disclosure, and such data structures are contemplated to be within the scope of computer executable instructions and computer-usable data described herein. 
     Various aspects described herein may be embodied as a method, an apparatus, or as one or more computer-readable media storing computer-executable instructions. Accordingly, those aspects may take the form of an entirely hardware embodiment, an entirely software embodiment, an entirely firmware embodiment, or an embodiment combining software, hardware, and firmware aspects in any combination. In addition, various signals representing data or events as described herein may be transferred between a source and a destination in the form of light or electromagnetic waves traveling through signal-conducting media such as metal wires, optical fibers, or wireless transmission media (e.g., air or space). In general, the one or more computer-readable media may be and/or include one or more non-transitory computer-readable media. 
     As described herein, the various methods and acts may be operative across one or more computing servers and one or more networks. The functionality may be distributed in any manner, or may be located in a single computing device (e.g., a server, a client computer, and the like). For example, in alternative embodiments, one or more of the computing platforms discussed above may be combined into a single computing platform, and the various functions of each computing platform may be performed by the single computing platform. In such arrangements, any and/or all of the above-discussed communications between computing platforms may correspond to data being accessed, moved, modified, updated, and/or otherwise used by the single computing platform. Additionally or alternatively, one or more of the computing platforms discussed above may be implemented in one or more virtual machines that are provided by one or more physical computing devices. In such arrangements, the various functions of each computing platform may be performed by the one or more virtual machines, and any and/or all of the above-discussed communications between computing platforms may correspond to data being accessed, moved, modified, updated, and/or otherwise used by the one or more virtual machines. 
     Aspects of the disclosure have been described in terms of illustrative embodiments thereof. Numerous other embodiments, modifications, and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure. For example, one or more of the steps depicted in the illustrative figures may be performed in other than the recited order, and one or more depicted steps may be optional in accordance with aspects of the disclosure.