SECURE DATA STORAGE BASED ON DISTRIBUTION OBSCREEN

Abstract

Aspects of the present invention disclose a method for securely storing data. The method comprises one or more computer processors that receive a data storage request from one or more computer processors, wherein the data contains a plurality of elements. The method further comprises generating a plurality of encoded data elements by applying one or more encoding algorithms to the data, wherein a set of the plurality of encoded data elements is equal to a set of the plurality of data elements. The method further comprises distributing the plurality of encoded data elements among two or more subgroups of the encoded data without duplication. The method further comprises transferring the two or more subgroups of the encoded data to a corresponding set of two or more storage systems.

Description

BACKGROUND OF THE INVENTION

[0001] The present invention relates generally to the field of data security and, more particularly, to obfuscating data by encrypting it and distributing portions of the encrypted data to different cloud storage locations.

[0002] Cloud computing is an information technology paradigm that provides unrestricted access to shared pools of configurable computer system resources over the Internet. Some users (e.g., companies, organizations, government agencies) of cloud computing services may own multiple computing systems but use cloud computing services to provide additional computing resources (e.g., elastic scalability) to reduce costs. Other users of cloud computing services use the cloud as an interface between users and a company, to provide improved response times by distributing applications and functionality closer to users, to reduce network congestion that can occur at individual computing sites, and to enhance the customer experience.In addition to handling various business functions, cloud computing providers can provide high-capacity cloud storage solutions to individuals, internet-based service providers, and businesses through an Infrastructure as a Service (IaaS) model. In one example, a company might host a website internally but outsource storage to an IaaS provider.

[0003] Cloud storage is a model of computer data storage in which digital data is stored in logical pools. Physical storage may span multiple servers (sometimes in multiple locations), and the physical environment is typically owned and managed by a hosting company (i.e., a service provider). Additionally, cloud computing providers employ a variety of security measures to secure stored information and data, such as authentication and access control, firewalls, user segregation, unauthorized access detection and prevention, and security information and event logging systems.Thus, cloud storage providers offer large amounts of storage capacity, just-in-time capacity management, security and durability, as well as anywhere, anytime access to data for data owners seeking geographical and provider diversity for data storage.

[0004] In this context, there are already published documents: The document US 2013 / 0 111 166 A1 describes a method for copying data into a distributed storage network without data replication. First, one or more sets of slice names with at least a decoding threshold are identified for one or more sets of encoded data slices of the data object, and one or more sets of new slice names with at least a decoding threshold are generated. Finally, encoded data slices are concatenated, creating a non-replicated copy of the data object. Furthermore, a block cipher method is described at https: / / en.wikipedia.org / w / index.php?title=Block_\cipher&oldid=885152613 [accessed on September 21, 2023], which operates with a fixed number of bits—i.e., blocks. This method uses a symmetric key. Finally, the Wikipedia article - as of April 27, 2019 - describes https: / / en.wikipedia.org / w / index.php?title=Block_\cipher_mode_of_operation&oldid=894404646 also a block cipher method. The method is described as a repeated application of single-block transformations to encrypt data sets larger than one block.

[0005] The concept presented here is based on the task of improving existing encryption techniques, particularly for use in distributed cloud computing environments. SUMMARY

[0006] This problem is solved by the subject matter of the independent claims. Further embodiments are specified by the respective dependent claims.

[0007] Aspects of the present invention disclose a method, a computer program product, and a system for securely storing data. The method comprises receiving, by at least one computer processor, a request for storing data, wherein the data includes a plurality of items. The method further comprises generating, by at least one computer processor, a plurality of items of encoded data by applying one or more encoding algorithms to the data, wherein a quantity of the plurality of items of the encoded data is equal to a quantity of the plurality of elements of the data. The method further comprises distributing, by at least one computer processor, the plurality of items of encoded data between two or more subsets of the encoded data without duplication.The method further comprises transmitting the two or more subsets of encoded data by at least one computer processor to a corresponding set of two or more storage systems. BRIEF DESCRIPTION OF THE DRAWINGS Fig. 1 is a functional block diagram of a portion of a cloud computing environment according to an embodiment of the present invention. Fig. 2 is a flowchart illustrating process steps of a secure data distribution program according to an embodiment of the present invention. Fig. 3 is a flowchart illustrating process steps of a secure data recovery program according to an embodiment of the present invention. Fig. 4 is an illustrative example of encoding data using a data key, distributing the encoded data into blocks before storing the encoded data, and using metadata to associate information with the blocks of encoded data, in accordance with at least one embodiment of the present invention. Fig. 5 is a block diagram of components of a computer according to an embodiment of the present invention. Fig. 6 illustrates a cloud computing environment according to an embodiment of the present invention. Fig. 7 illustrates a set of functional abstraction layers of a cloud computing environment according to an embodiment of the present invention. DETAILED DESCRIPTION

[0008] Embodiments of the present invention recognize that cloud computing enables companies to avoid or minimize capital expenditures on information technology (IT) infrastructure. Additionally, embodiments of the present invention recognize that more companies are migrating applications to the cloud and that various companies are using multi-cloud platforms and multiple service providers for data and applications. However, data owners may not want to be tied to a particular service provider. Data owners want the flexibility to switch to another provider without losing data or incurring significant data migration efforts.In response to the increasing criticality of stored data, data owners' expectations are evolving, requiring more reliable mechanisms to ensure the availability and durability of stored data. Embodiments of the present invention recognize that cloud service providers already store public data in the cloud, such as published government statistics, mapping information, socially shared information, weather data, news, etc. However, embodiments of the present invention also recognize that private data is generally not stored in public clouds due to security issues, trust issues, privacy requirements, regulations, etc.In this context, instead of storing data within a single cloud, data owners are trying to store data across multiple cloud platforms to ensure greater security, redundancy, and reduce the potential risk of data compromise.

[0009] Embodiments of the present invention provide a solution to securely store data in a trusted form based on a secure distributed format among multiple cloud platforms, such as cloud storage systems, public cloud, and / or hybrid cloud systems. The secure distributed format for the data described herein is referred to as blocks, or more precisely, as blocks of encoded data. Each block of encoded data is a subset (e.g., a smaller group) of elements of data that are uniquely distributed from the larger set of encoded elements of data. Embodiments of the present invention encode the data for secure distributed storage before distributing the elements of encoded data across two or more blocks of encoded data.Embodiments of the present invention encode the elements of the data using one or more intra-data dependencies, recursive actions, and / or incremental (i.e., indexed) use of at least one element of the original data and / or at least one previous element of encoded data. Some embodiments of the present invention also employ a data key comprised of other information used by one or more encoding algorithms to further obfuscate the original data. Embodiments of the present invention use reversible functions to encode and decode data.

[0010] Embodiments of the present invention may further secure the data by distributing the encoded data across blocks of encoded data such that if a single block of encoded data is lost, corrupted, or not retrieved, the entire original cannot be recovered (e.g., reproduced, recreated) and decoded. In additional embodiments, individual blocks of encoded data cannot be decoded on their own. Various embodiments of the present invention utilize one or more intra-data element dependencies and recursive operations (e.g., actions, calculations) as opposed to global operations to make recovery of the entire original data impossible unless all blocks of encoded data are retrieved and the distribution algorithms for the encoded data are known in addition to the encoding and decoding algorithms.

[0011] Thus, some embodiments of the present invention make it impossible to recover the entire original data in response to the loss or corruption of even a single byte or element of encoded data. An example of an intra-data element dependency is where the encoding value for a current element of data is based on the current value for an element of data and at least one previous value of an element of encoded data. Any additional dependency, such as including at least one previous original data value to encode a current data value, further strengthens the security aspects of the present invention in conjunction with encoding and distributing the original data across blocks of encoded data.Decoding encoded data also includes intra-data element dependencies, such as the current value for an element of encoded data and at least one previous value of an element of encoded data. Each additional dependency, such as using at least one previous value of an element of decoded data to decode a value of a current element of encoded data, further strengthens the security of a decoding algorithm.

[0012] Various embodiments of the present invention further enhance the security of the private data by distributing a block of encrypted data among each of the various locations and / or cloud storage providers selected to store the blocks of encrypted data corresponding to the original data. In one example, two blocks of encrypted data may be stored in the same city if at least two cloud storage providers within the city have free storage capacity.

[0013] Some embodiments of the present invention utilize duplication of blocks of encoded data for disaster recovery, such as when one or more cloud storage providers do not offer data backup, or to ensure that if a site is affected by a problem (e.g., natural disaster, power outage, network failure, etc.), the original data can still be recovered in a timely manner based on access to a secondary storage location. Embodiments of the present invention utilize one or more data checks known in the art, such as a checksum or a hash function, to ensure the integrity of the retrieved blocks of encoded data and / or the decoded data.

[0014] An embodiment of embodiments of the invention may take a variety of forms and exemplary embodiment details are discussed below with reference to the figures.

[0015] The present invention will now be described in detail with reference to the figures. Fig. 1 is a functional block diagram illustrating a portion of a cloud computing environment, generally referred to as environment 100, according to a single embodiment of the present invention, such as a cloud computing node 10 (which may be described with reference to Fig. 6). One embodiment of the environment 100 includes: a system 102 and a plurality of cloud storage locations (e.g., a storage 120A through a storage 120N), all interconnected via a network 130. Fig. Figure 1 illustrates only a single embodiment and does not imply any limitations on the environments in which various embodiments may be practiced. Many modifications to the illustrated environment may be made by those skilled in the art without departing from the scope of the invention as defined by the claims.

[0016] In further embodiments, Fig. 1 is a functional block diagram illustrating a portion of a networked computing environment or storage architecture distinct from a cloud computing environment, generally referred to as environment 100. In one example, one or more of storage 120A through 120N may represent various types of storage systems, such as network-attached storage (NAS) systems or devices, storage area networks (SANs), and / or other storage devices.

[0017] System 102 and memory 120A through 120N may be laptop computers, tablet computers, netbook computers, personal computers (PCs), desktop computers, personal digital assistants (PDAs), smartphones, wearable devices (e.g., smart glasses, a smartwatch, etc.), or any programmable computer systems known in the art. In certain embodiments, system 102 and memory 120A through 120N represent computer systems that utilize clustered computers and components (e.g., database server computers, application server computers, etc.) that function as a single pool of seamless resources when accessed through network 130, as is common in data centers and cloud computing applications.The system 102 and the memory 120A through memory 120N may include components according to embodiments of the present invention, as described with reference to FIG. Fig. 5 and described in more detail. In general, memory 120A through memory 120N represents any programmable electronic device or combination of programmable electronic devices capable of executing machine-readable program instructions and communicating with system 102 via network 130.

[0018] The system 102 includes: a storage 103, a secure data distribution program 200, and a secure data recovery program 300. The system 102 also includes various programs such as a website interface; one or more web daemons; a database management system; a network mapping program; a network transfer program; various functions and / or programs for performing various mathematical and statistical conversions, etc. In a single embodiment, the system 102 represents one or more data processing systems within a cloud computing system. In another embodiment, the system 102 represents one or more data processing systems of an organization, such as a company, university, enterprise, etc.In some embodiments, system 102 uses network 130 and one or more transmission programs and / or protocols to query storage 120A through storage 120N and obtain information related to the availability of storage locations, such as physical locations, storage provider information, storage costs, service level agreements (SLAs), data backup capabilities, etc. System 102 may store the information within storage information 107 for subsequent access by secure data distribution program 200.

[0019] In a single embodiment, storage 103 contains data 104, data keys 105, security algorithms 106, and storage information 107. Storage 103 may also contain various tables, lists, associative arrays, databases, and / or other programs (not shown). Data 104 comprises a plurality of data associated with one or more entities (e.g., users, programs, companies, organizations, etc.) that utilize system 102 for secure distributed storage of data based on obfuscation by encoding the data for distributed storage and distributing the encoded data into blocks of encoded data. In various embodiments, data within data 104 is uploaded or transferred to system 102 by various entities and / or executing programs (not shown) over network 130.In another embodiment, data within data 104 is generated within system 102 by one or more executing programs (not shown).

[0020] The data keys 105 include a plurality of keys used by a security algorithm to encode and decode distributed stored data. In one embodiment, the data keys 105 include data keys of different structures and / or formats. In one example, a data key within the data keys 105 may be based on random numeric values, alphabetic characters, symbols, or a combination thereof. In another example, a data key may be a password or passphrase entered by a user or program accessing the system 102. In a particular embodiment, a data key within the data keys 105 is based on a rule, such as the first ten digits of π, √2, or a fraction. In some embodiments, the distribution program 200 executes one or more programs (e.g.,Functions) to convert information within a data key of the data keys 105 into indexed numeric values. In one case, a converted data key is stored within the data keys 105 and associated with the original data key. In another case, a converted data key is stored within the storage information 107 and associated with other information related to the data for distributed storage, such as storage location IDs, block IDs, sequence data associated with a plurality of blocks of encoded data.

[0021] The security algorithms 106 include a plurality of algorithms used to prepare data for secure distributed storage. The security algorithms 106 include algorithms to: encode data, distribute the encoded data among a plurality of blocks of encoded data, recover (i.e., reconstruct) the encoded data from a plurality of retrieved blocks of encoded data, and decode the encoded data. An example set of algorithms for practicing the current invention is set forth below and described with reference to Fig. 4. Security algorithms within security algorithms 106 may be developed by the administrators of system 102 and / or developed by a user of system 102 and used in conjunction with data associated with the user.

[0022] In various embodiments, data encoding algorithms within security algorithms 106 are invertible functions (i.e., algorithms) that utilize the composition of the source data to perform various transformations (e.g., encodings). In a single embodiment, one or more algorithms within security algorithms 106 utilize a data key within data keys 105 to further obfuscate elements of data during encoding of the data. In one embodiment, security algorithms 106 also include one or more programs (e.g., functions) to convert information within a data key into indexed numeric values ​​and / or to generate a data key.

[0023] In some embodiments, algorithms include one or more constraints. In one case, a data encoding algorithm includes a constraint, such as a variable (e.g., max_val) that must be at least a value of 1 greater than the maximum value of any element of data within the data to be stored. In one example, with reference to storing binary data, max_val = 256 if that value of an element of data can be 0 to 255. In another case, when a data encoding algorithm recursively encodes data and bases a current encoding value on a value corresponding to one or more previously encoded elements of data (e.g., an intra-data element dependency), a data distribution algorithm is constrained to store elements of encoded data that interact in different blocks of encoded data.In one embodiment, the security algorithms 106 include one or more additional criteria (e.g., rules) that affect whether and how an item of data is encoded. In one example, a criterion included in an encoding algorithm may state that if K[i] = 0, then E[i] = D[i].

[0024] Still referring to the security algorithms 106, set forth below is an exemplary embodiment of a set of security algorithms for: encoding a plurality of items of data included in the data for distributed storage; distributing the encoded items of data among blocks of encoded data; and, in response to needing to access the distributed stored data, retrieving and reconstructing the encoding data from a plurality of stored blocks of encoded data and subsequently decoding the recovered encoded data to reproduce the data.

[0025] In the following example algorithms, a symbol "%" represents a modulo operation (i.e., modulus operation). For example, a pair of encoding algorithms includes: E[0] = (D[0] + K[0]) % max_val (referred to herein as algorithm ED1). Where E[0] represents the encoding value for the first element (index value [i] = 0) of the data. As used herein, index positions and index values ​​are interchangeable. K[0] is the first value (index value [i] = 0) for the data key of the data keys 105 assigned to the data for secure distributed storage. With reference to the modulo operation (i.e., %) used herein, the value corresponding to the element on the left side (i.e., (D[0] + K[0])) of the symbol % is the dividend. The value corresponding to the element on the right side (i.e., max_val) of the % symbol is the divisor, and E[0] is equal to the remainder produced by the modulo operation on the first element of the data.In one embodiment, encoding algorithms generate a set of elements of encoded data that corresponds to (e.g., is equal to) the set of elements of data of the data for secure distributed storage.

[0026] For data values ​​corresponding to elements of data after the first data value (e.g., index values ​​of i > 0): E[i] = (E[i-1] + D[i-1] + D[i] +K[i % key_size]) % max_val (herein referred to as Algorithm ED2). Algorithm ED2 includes encoding constraints (e.g., intra-data element dependencies) and / or at least one recursive action. A current encoding value of an element, E[i], for the corresponding element of the data value D[i], is changed by an element of the data key (e.g., K[i % key_size]); and is further changed by both the previous encoding value, E[i-1], and the previous data value, D[i-1]. Within the ED2 algorithm, the term K[i % key_size] generates a cyclic selection of elements from a data key to be applied to the elements of data to be encoded, based on generating a range of index values ​​from 0 to (key_size - 1) in response to key_size < data_size.Data_size is a value corresponding to the number (i.e. amount) of elements of the data for secure distributed storage.

[0027] Still referring to the security algorithms 106, and based on the constraints associated with the example encoding algorithm, a related data chunking algorithm is discussed below. In one embodiment, and based on the number (i.e., amount) of locations selected to receive the encoded data for distributed storage, the amount of chunks generated (nb_chunks) is >=2 and less than or equal to the amount of available storage locations for the data. In one example, a set of data chunking and data item distribution algorithms includes a size value corresponding to a set of items contained within a block (“chunk,” i.e., C) consisting of a portion of the encoded data, represented by: size[c] = (data_size + nb_chunks -1 - c) div nb_chunks (referred to herein as Algorithm CD1). Where c = an index value corresponding to a block.Within the discussed algorithms, the function “div” represents an integer division of the value of the dividend (i.e. (data_size + nb_chunks -1 - c)) and the value of the divisor (i.e. nb_chunks).

[0028] In one embodiment, distributing encoded data elements among blocks relies on an algorithm that cyclically generates index values ​​corresponding to each block and data elements within a respective block. In response, encoded data elements corresponding to the generated index values ​​are distributed among the blocks or assigned to the blocks. In one example, C[c][j] = E[c + j*nb_chunks] (referred to herein as Algorithm CD2) allocates the encoded information among blocks, where 0 <= c < nb_chunks and 0 <= j < size[c]; and where "c" represents the index value of a block of encoded data and "j" represents the index value corresponding to an encoded data element within a block of encoded data. In some embodiments, the index value of "c" for each block is associated with an identifier (ID) corresponding to a block. Furthermore, in some cases, a block ID corresponds to a sequence (e.g., 1, 2, 3, ...).) regarding the distribution of the encoded data across the blocks. In other cases, the sequence of blocks of encoded data can be indirectly assigned to the block IDs, for example, via an associative array.

[0029] Continuing the current set of security algorithms, in one embodiment, a corresponding algorithm for recovering (e.g., reproducing, reversing the distribution algorithm) the encoded data from the plurality of elements of data distributed among the blocks is represented by: E[i] = C[i % nb_chunks][i div nb_chunks] (referred to herein as Algorithm RE1) for 0 <= i < datasize. Where the term [i % nb_chunks] of Algorithm 3) corresponds to a block index and / or an associated block ID, and [i div nb_chunks] corresponds to a set of index values ​​of elements within a block (previously discussed with reference to "j", where 0 <= j < size[c]).

[0030] The exemplary set of data security algorithms is completed by a pair of corresponding decoding algorithms applied to the recovered encoded data. Where the value for max_val is the same value of max_val used to encode the data, and where the index values ​​correspond to the elements of the recovered encoded data. For example, D[0] = (E[0] - K[0] + max_val) % max_val (herein referred to as Algorithm DE1) is used to decode the initial element (i.e., the first element) of the recovered encoded data. Furthermore, to decode subsequent elements of the recovered encoded data, D[i] = (E[i] - E[i-1] - D[i-1] - K[i % key_size] + nb_chunks * max_val) % max_val (herein referred to as Algorithm DE2) for 0 < i < data_size.As previously discussed with reference to backing up the data, the DE2 algorithm contains at least one recursive action or intra-data dependency, which makes the entire original data unrecoverable if a block of encoded data is missing or corrupted.

[0031] The storage information 107 includes information related to a plurality of data prepared for distributed storage and / or already stored as blocks of encoded data between the memory 120A through the memory 120N. In a single embodiment, the storage information 107 includes information related to the data for distributed storage, such as one or more entities that store the data and / or have access to the distributed data, storage location IDs, block IDs, a sequence associated with a plurality of blocks of encoded data (e.g., a block ID sequence based on a distribution algorithm), a data key used during encoding of the data, data integrity verification / information, etc.In some embodiments, information within storage information 107 is stored within a data structure, such as one or more tables and / or databases. In various embodiments, metadata relating to blocks of encoded data (referring to FIG. Fig. 4 described in more detail) within the storage information 107 and further associated with the original data or a reference associated with the original data for distributed storage.

[0032] In another embodiment, some information within storage information 107 is obtained by system 102 querying a plurality of storage providers over network 130 to obtain information related to storage 120A through storage 120N, such as physical locations, storage provider information, storage costs, etc. In one embodiment, storage location IDs are further associated with a storage provider and / or a corresponding physical location (e.g., site) of a storage system. In some cases, storage IDs are assigned by system 102. In other cases, storage IDs correspond to information provided to system 102 by the storage provider associated with each of storage 120A through storage 120N.

[0033] In some embodiments, the secure data distribution program 200 and the secure data recovery program 300 are services that an owner and / or developer of an app subscribes to in order to enable multiple version support for the app. The secure data distribution program 200 and the secure data recovery program 300 may be implemented via one of the functions of a management layer 80 of a cloud computing environment 50, such as a security 86 (referring to Fig. 6 and Fig. 7 in more detail). Alternatively or additionally, the secure data distribution program 200 and the secure data recovery program 300 may be executed via one of the virtualized aspects of a workload layer 90 of the cloud computing environment 50, such as a data security 96 (referring to Fig. 6 and Fig. 7). In another embodiment, the secure data distribution program 200 and the secure data recovery program 300 are executed within a storage environment that is different from and / or in addition to a public cloud storage environment operating within a different architecture, such as a mainframe computer, a networked computing environment, and / or a distributed computing environment, to store blocks of encoded data at additional internal storage locations associated with the system 102.

[0034] The secure data distribution program 200 is a program that prepares data for secure storage within the cloud, such as a public cloud storage environment. Various aspects of the secure data distribution program 200 can be executed to operate within other storage environments. In a single embodiment, the secure data distribution program 200 encodes elements of data in a numeric format for distributed storage using one or more encoding algorithms. The secure data distribution program 200 can use a data key to further obscure the encoding of the elements of the data. In various embodiments, the secure data distribution program 200 uses one or more distribution algorithms to distribute the encoded elements of data among blocks of encoded data.In an exemplary embodiment, by distributing the encoded data into blocks of encoded data, the secure data distribution program 200 may render the entire original data unrecoverable unless all blocks of encoded data belonging to the original data are retrieved and unless the distribution order of the encoded elements of data into the blocks of encoded data is also known.

[0035] In another embodiment, if the secure data distribution program 200 determines that the data has been previously stored for distributed storage and the current version of the data has changed, the secure data distribution program 200 deletes the blocks of encoded data within the distributed storage based on the absence of a backup policy before storing the blocks of encoded data corresponding to the current version of the data. The secure data distribution program 200 may reuse one or more storage locations to store the blocks of encoded data corresponding to the current version of the data, or the secure data distribution program 200 may select a different storage set to store the blocks of encoded data corresponding to the current version of the data.In one embodiment, the secure data distribution program 200 migrates data for distributed storage into the RAM (not shown) of the system 102 to improve the performance of one or more security algorithms prior to transferring the blocks of encoded data to a set of storage locations.

[0036] The secure data recovery program 300 is a program that identifies data that has been stored in a distributed manner, retrieves the plurality of blocks of encoded data comprising the distributed data, and decodes the encoded data after recovering the encoded data from the plurality of retrieved blocks of encoded data. In a single embodiment, the secure data recovery program 300 is operable to recover data from a plurality of blocks of encoded data that are distributed across two or more cloud storage locations. In some embodiments, the secure data recovery program 300 is automatically executed by a security program, function, and / or API in response to a user and / or program indicating access to the distributed data.

[0037] In various embodiments, secure data recovery program 300 uses replicated or backed-up blocks of encoded data to recover the encoded data. Secure data recovery program 300 may use one or more data integrity verification methods to ensure that a replicated block of encoded data is an exact duplicate of a missing or corrupted block of encoded data. In one embodiment, secure data recovery program 300 stores the retrieved blocks of encoded data and / or the recovered encoded data within RAM (not shown) of system 102 to enhance the performance of one or more security algorithms.

[0038] In a single embodiment, the system 102 exchanges data with the storage 120A through the storage 120N through the network 130. In another embodiment, the network 130 may also connect the system 102 with one or more nodes of the cloud computing environment 50 (referring to Fig. 6 discussed in more detail) that provides one or more services such as monitoring of software agreements (with reference to Fig. 7). In one example, network 130 may include a network agent / daemon process that forwards network traffic associated with apps licensed to use one or more embodiments of the present invention to system 102. Alternatively, network 130 may forward network traffic associated with apps not licensed to use embodiments of the present invention to another node within cloud computing environment 50.

[0039] The network 130 may, for example, be a local area network (LAN), a telecommunications network, a wireless local area network (WLAN), such as an intranet, a wide area network (WAN), such as the Internet, or any combination of the foregoing, and may include wired, wireless, or fiber optic connections. In general, the network 130 may be any combination of connections and protocols that support transfers between the system 102 and the memory 120A through memory 120N in accordance with embodiments of the present invention. In various embodiments, the network 130 operates locally over wired, wireless, or optical connections and may include any combination of connections and protocols (e.g.,Personal Area Network (PAN), Near Field Communication (NFC), laser, infrared, ultrasonic, etc.). In some embodiments, an instance of network 130 is a virtual LAN (VLAN) that connects two or more virtualized entities (not shown) of cloud computing environment 50. In further embodiments, network 130 represents one or more LANs and / or VLANs within an instance of environment 100, which is a networked computing environment that enables transfers between system 102 and storage 120A through storage 120N.

[0040] In a single embodiment, storage 120A through storage 120N represent a plurality of storage systems from respective different locations. In various embodiments, one or more of storage 120A through storage 120N are included within cloud storage systems and / or cloud computing environments. In some embodiments, the cloud storage systems and / or cloud computing environments hosting respective instances of storage 120 correspond to two or more different vendors or cloud service providers. In another embodiment, storage 120A through storage 120N represent a plurality of storage systems and / or storage units of a networked computing environment, a distributed computing environment, etc., associated with system 102.

[0041] Fig. Figure 2 is a flowchart illustrating the process steps of secure data distribution program 200, a program that securely stores data by encoding data, distributing the encoded data into smaller sets of data, and transferring the smaller sets of data to a plurality of storage locations, in accordance with embodiments of the present invention. In various embodiments, some of the information determined and / or updated by secure data distribution program 200 is subsequently used by aspects of secure data recovery program 300 to retrieve and recover the distributed data.

[0042] In step 202, the secure data distribution program 200 determines data for distributed storage. In a single embodiment, the secure data distribution program 200 determines data within the data 104 for distributed storage based on information obtained from a user, a program, a security function, and / or based on security rules associated with the data. In some embodiments, the secure data distribution program 200 determines additional information associated with the data for secure distributed storage, such as a value or range of values ​​corresponding to the set of storage locations across which the data is to be distributed, a rule associated with a data key (e.g., key length, key ID, rules related to data keys, etc.), a maximum value determined among the elements comprising the data to be stored, etc.In another embodiment, the secure data distribution program 200 determines information associated with the secure distributed storage data within the data keys 105, security algorithms 106, and / or storage information 107. The secure data distribution program 200 may determine constraints associated with the secure distributed storage data, such as cost constraints or regulatory requirements.

[0043] In one embodiment, secure data distribution program 200 may utilize various functions and / or programs (not shown) installed on system 102 to perform various mathematical, statistical conversions, etc., to obtain information related to the data for distributed storage, such as a size corresponding to the data, max_val related to the data, index values ​​for elements of keys and the data, and generation tables / associative arrays that link information related to the data for distributed storage. In various embodiments, secure data distribution program 200 also determines a set of algorithms to be used in connection with the data for distributed storage, such as data encoding, data chunking, and data distribution algorithms.

[0044] In step 204, the secure data distribution program 200 determines a set of locations for the distributed storage of the data. In one embodiment, the secure data distribution program 200 determines a set of locations and / or storage IDs for the distributed storage of data based on information available within the storage information 107. The secure data distribution program 200 may then include and / or update further information related to the distributed storage of the data within the storage information 107.In various embodiments, secure data distribution program 200 uses a network 130 to query one or more cloud storage providers to determine locations, such as storage 120N through 120N, available for storing the blocks of encoded data comprising the distributed storage data. In a single embodiment, secure data distribution program 200 determines a set of locations (at step 202) based on information regarding the set of storage locations associated with the distributed storage data.

[0045] In another embodiment, the secure data distribution program 200 determines a set of locations for distributed storage of the data based on the set of available locations determined in response to querying the one or more cloud storage providers. In some embodiments, the secure data distribution program 200 determines one or more storage locations in addition to the set of storage locations prescribed by information associated with the data for distributed storage. The secure data distribution program 200 then uses one or more constraints or rules to determine the set of locations for distributed storage of the data.In further embodiments, the secure data distribution program 200 determines a set of storage locations for distributed storage of the data based on one or more storage architectures that differ from the cloud storage environment.

[0046] In step 206, the secure data distribution program 200 encodes the data for distributed storage. The secure data distribution program 200 uses one or more encoding algorithms to generate a plurality of items of encoded data, each associated with the plurality of items of the original data for distributed storage. In a single embodiment, the secure data distribution program 200 encodes the data for distributed storage using one or more encoding algorithms within the security algorithms 106 prescribed by information associated with the data for secure distributed storage. In another embodiment, the secure data distribution program 200 encodes the data for distributed storage using one or more encoding algorithms selected from the security algorithms 106.

[0047] In some embodiments, the secure data distribution program 200 uses one or more encoding algorithms that further obfuscate the encoded data by applying one or more numeric values ​​from a data key (referring to Fig. 4). If the secure data distribution program 200 determines that a data key is based on one or more rules and / or contains non-numeric characters, the secure data distribution program 200 uses one or more conversions and / or rules to generate a version of a data key that contains numeric values. In various embodiments, the secure data distribution program 200 updates information associated with the data for secure distributed storage based on the determined information related to encoding the data for distributed storage, such as a max_val variable, a data key from the data keys 105, information identifying the one or more encoding algorithms used, a numeric version of a data key, a checksum or hash value corresponding to the encoded data, etc.

[0048] In step 208, the secure data distribution program 200 distributes the encoded data among a plurality of blocks of encoded data. In one embodiment, the secure data distribution program 200 distributes the encoded data among a plurality of blocks (e.g., nb_chunks) of encoded data corresponding to the set of storage locations within the determined set of storage locations. The secure data distribution program 200 may further determine and / or assign information, such as an ID, sequence information, and a size value, corresponding to the blocks of encoded data (referring to Fig. 4 discussed in more detail), a checksum or hash value for each block of encoded data, etc.

[0049] In some embodiments, the secure data distribution program 200 distributes the encoded data using one or more data chunking and distribution algorithms within the security algorithms 106 and as prescribed by information associated with the data for distributed storage (previously discussed with reference to the security algorithms 106). In another embodiment, the secure data distribution program 200 distributes the encoded data using one or more data chunking and distribution algorithms selected from the security algorithms 106. If the secure data distribution program 200 determines that an encoding algorithm being used contains an intra-data element dependency, the secure data distribution program 200, in various embodiments, uses a data distribution algorithm compatible with the intra-data element dependency (with reference to Fig. 4 discussed in more detail).

[0050] In step 210, the secure data distribution program 200 transmits the plurality of blocks of encoded data for storage within a set of locations. In various embodiments, the secure data distribution program 200 executes one or more transmission protocols to connect and authenticate (e.g., access) the determined set of cloud-based storage locations (e.g., between storage 120A through storage 120N) that store the blocks of encoded data via the network 130. In a single embodiment, in response to the secure data distribution program 200 receiving confirmations that each of the transmitted blocks of encoded data has been successfully stored, the secure data distribution program 200 deletes the original data from the data 104.In some embodiments, if the secure data distribution program 200 cannot store a block of encoded data within one storage location from the determined set of storage locations (e.g., an authentication failure, a timeout, connectivity issues, a problem, another availability issue, etc.), the secure data distribution program 200 selects a different storage location for the block of encoded data from the determined one or more additional (e.g., alternative) storage locations.

[0051] In one embodiment, in response to the secure data distribution program 200 receiving acknowledgments that each of the transmitted blocks of encoded data has been successfully stored, the secure data distribution program 200 updates the storage information 107 that determines the locations corresponding to a block of encoded data. The secure data distribution program 200 updates the storage information 107 based on information related to the distributed storage of the data, such as updating metadata information and / or other data structures (e.g., a database, a table, an associative array, etc.) that store information related to the distributed storage of the data.

[0052] Fig. 3 is a flowchart illustrating process steps of the secure data recovery program 300 according to embodiments of the present invention, a program that recovers the data distributed for secure storage by retrieving, reassembling, and decoding the plurality of blocks of encoded data distributed for secure storage among a plurality of locations.

[0053] In step 302, the secure data recovery program 300 determines information related to distributed data. The secure data recovery program 300 may respond to a request to the system 102 to retrieve and restore distributed data based on receiving the request from one or more entities using the system 102, such as a user, software applications, and / or system functions. In one embodiment, the secure data recovery program 300 determines information related to distributed data based on information within the storage information 107. In one example, the secure data recovery program 300 determines information within the storage information 107 related to the distributed data, such as block IDs, a sequence related to the blocks of encoded data (e.g.,a block ID sequence), storage locations corresponding to blocks of encoded data, a set of security algorithms used to prepare the data for distributed storage, a data key used during encrypting the data, etc. Secure data recovery program 300 may also determine a specified location for storing the recovered data. In some embodiments, secure data recovery program 300 also determines other information about the distributed data, such as whether secure data distribution program 200 used a backup (e.g., replication) strategy to distribute extra copies of the blocks of encoded data, data integrity verification information, and information related to the storage of the extra copies of the blocks of encoded data.

[0054] In step 304, the secure data recovery program 300 retrieves the blocks of encoded data corresponding to the distributed data. The secure data recovery program 300 uses the determined information regarding distributed data within the storage information 107 to determine the storage locations corresponding to blocks of encoded data corresponding to the distributed data. In a particular embodiment, the secure data distribution program 300 executes one or more transmission protocols to establish a connection and authenticate (e.g., access) over the network 130 to the instances of the storage 120 that store the blocks of encoded data to be retrieved.In various embodiments, the secure data recovery program 300 retrieves the blocks of encoded data from the determined cloud storage locations from the storage 120A through the storage 120N (e.g., different locations).

[0055] In another embodiment, in response to the secure data recovery program 300 successfully retrieving the blocks of encoded data corresponding to the distributed data, the secure data recovery program 300 deletes the blocks of encoded data from respective storage locations. Alternatively, the secure data recovery program 300 may leave the blocks of encoded data within respective storage locations based on information related to the distributed data.

[0056] In one embodiment, if the secure data recovery program 300 determines that one or more locations storing the blocks of encoded data corresponding to the distributed data are inaccessible (e.g., network problems, server problems, etc.), the secure data recovery program 300 determines whether the secure data distribution program 200 used a replication strategy to distribute the blocks of encoded data corresponding to the distributed data. In response to determining that the secure data distribution program 200 used a replication strategy, the secure data recovery program 300 identifies one or more other (e.g., secondary, alternate) locations from memory 120A through memory 120N that store a block of encoded data that cannot be retrieved from a primary storage location.

[0057] Still referring to step 304, in further embodiments, the secure data recovery program 300 uses various transfer methods to establish access to one or more instances of storage 120A through 120N that store the blocks of encoded data at other or in addition to cloud storage locations, such as various storage nodes, servers, SAN systems, and / or NAS systems. In one embodiment, one or more of the additional instances of storage 120A through 120N may be located at the same site and / or physical location.

[0058] In step 306, the secure data recovery program 300 recovers the encoded data from the retrieved blocks of encoded data. In one embodiment, the secure data recovery program 300 uses one or more data recovery algorithms contained within the security algorithms 106 and information related to the distributed data to recover the encoded data from the plurality of pieces of encoded data distributed among the blocks of encoded data. In a single embodiment, the secure data recovery program 300 uses the block IDs and / or block sequence information to recover (e.g., reassemble, recreate, reproduce) the encoded data corresponding to the distributed data.In another embodiment, secure data recovery program 300 uses metadata associated with the blocks of encoded data to recover encoded data corresponding to the distributed data. In various embodiments, secure data recovery program 300 uses one or more recovery algorithms that reverse the processes of the data chunking and data distribution algorithms applied to the original encoded data corresponding to the distributed data.

[0059] In step 308, the secure data recovery program 300 decodes the recovered encoded data. The secure data recovery program 300 decodes the recovered encoded data corresponding to the distributed storage data. In various embodiments, the secure data recovery program 300 determines further information obtained in step 302 related to decoding the encoded data corresponding to the distributed storage data. In one example, the secure data recovery program 300 determines the data key used to encode the data for distributed storage, information related to the data key (e.g., key size, data key generation rules, etc.), and a decoding algorithm corresponding to the encoding algorithm used to encode the data for distributed storage.In a single embodiment, secure data recovery program 300 decodes the recovered encrypted data using the determined data key stored within data keys 105 and the corresponding decoding algorithm contained within security algorithms 106. In another embodiment, secure data recovery program 300 decodes the recovered encrypted data using the determined data key and / or a data key generation rule contained in storage information 107 and associated with the distributed data.

[0060] Fig. 4 is an illustrative example of preparation of data including a plurality of items of data for secure distributed storage based on using a set of security algorithms (e.g., algorithms ED1, ED2, CD1, CD2, RE1, DE1, and DE2) to encode the plurality of items of data and subsequently distribute the encoded items of blocks of encoded data, in accordance with embodiments of the present invention. Fig. 4 also shows the output of various aspects of some of the security algorithms applied to the data for secure distributed storage.

[0061] Data 401 is an example of data for secure distributed storage. In one embodiment, data 401 has associated metadata (not shown) related to a name or other identifier (e.g., data ID), such as "A." Metadata associated with data 401 may be included in storage information 107. In the illustrative example, data 401 consists of fifteen elements of data. In the illustrative example, row 402 represents the index positions (e.g., index values), ranging from 0 to 14, that correspond to elements of data within data 401. In the illustrated example, the value of the corresponding element of data within data 401 at index position i = 0 is "14," and at i = 10, the value of the corresponding element of data is "1."In one embodiment, the secure data distribution program 200 determines (in step 202) that max_val = 24 for encoding data for the data 401 (e.g., 23+1). Further, the secure data distribution program 200 determines a value corresponding to the number of data elements within the data 401 (e.g., data_size = 15).

[0062] Furthermore, based on information associated with the data 401, such as a rule associated with a data key, the secure data distribution program 200 also determines that the encoding algorithm assigned to the data 401 prescribes a key of key_size = 3. In the illustrated example, the key 403 consists of three elements: 3, 1, and 9, with respective index positions of 0, 1, and 2. In one embodiment, the secure data distribution program 200 determines that no additional conversions or manipulation of information within the key 403 are necessary because the three elements of the key 403 are numeric values.

[0063] In one embodiment, the secure data distribution program 200 determines (at step 202) to use the algorithm ED1 and the algorithm ED2 (previously described with reference to the security algorithms 106), E[0] = (D[0] + K[0]) % max_val and E[i] = (E[i-1] + D[i-1] + D[i] + K[i % key_size]) % max_val, to encode the data 401 for secure distributed storage.

[0064] In one example, the secure data distribution program 200 encodes (at step 206) the data 401. In one embodiment, the term K[i % key_size] of the example encoding function cyclically applies a value from the data key 403 among the elements of the data 401 to be encoded. In the illustrative example, the string 404 is the output of the term K[i % key_size] applied to the key 403. Based on the terms K[0] and K[i] within the pair of example encoding algorithms, each element of the string 404 is respectively applied to a data value of an element of the data 401 with a corresponding index value. For example, when i = 6, K[6] = 3 and is used in response to encoding an element of data D[6] of the data 401 (i.e., 17).

[0065] In the illustrative example, the encoded data 410 represents the output of the secure data distribution program 200 encoding the data 401 using the key 403 and the algorithm ED1 and the algorithm ED2. In one embodiment, the index values ​​of elements of data of the data 401 also correspond to the index values ​​of the elements of data of the encoded data 410. In some embodiments, the secure data distribution program 200 also determines (in step 206) that at least one of the prescribed encoding algorithms includes an intra-data element dependency. For example, the above encoding algorithms include intra-data element dependencies associated with a previous encoding value (i.e., E[i-1]) and a corresponding previous value for an element of data (i.e., D[i-1]).

[0066] In one embodiment, the secure data distribution program 200 determines (at step 204) that the value corresponding to the set of locations that are to receive the distributed data to be stored (i.e., the data 401) is four; therefore, the set of subsets of data or chunks to be generated is four (e.g., nb_chunks = 4). Further, in response to the secure data distribution program 200 determining that an algorithm used to encode the data 401 (i.e., algorithm ED2) contains one or more intra-data element dependencies, the secure data distribution program 200 determines that the encoded data 410 is distributed across four chunks and that each chunk of data is prevented from containing data elements with corresponding index values ​​that are sequential, such as E[5] and E[6] of the encoded data 410.In some embodiments, the index value "c" of a block is associated with an identifier (ID) corresponding to the block of data for distributed storage, such as the block IDs of element 420.

[0067] In the illustrative example, block ID 1 is associated with block 430A, block ID 2 is associated with block 430B, block ID 3 is associated with block 430C, and block ID 4 is associated with block 430D. In some embodiments, secure data distribution program 200 determines that a set of security algorithms associated with distributed data storage 401 includes at least one or more data chunking algorithms. One aspect of a data chunking algorithm determines a size value corresponding to a set of elements contained within a "block ID" based on an index value corresponding to the block. In one exemplary embodiment, a size corresponding to a block is determined by algorithm CD1.In one example, the block ID 2 associated with block 430B has a block index value = 1 and a corresponding size value = 4, indicating that four elements of the encoded data 410 are assigned to block 430B.

[0068] In one embodiment, the secure data distribution program 200 cyclically distributes encoded data 410 across four blocks of encoded data. In the illustrated example, the secure data distribution program 200 uses a data chunking algorithm to cyclically determine index values ​​corresponding to the elements of encoded data within the encoded data 410 for distribution across the four blocks of data. In response, the secure data distribution program 200 distributes (at step 208) the elements of encoded data corresponding to the determined index values ​​across the block corresponding to the block IDs. In the illustrative example, the secure data distribution program 200 uses the CD2 algorithm to distribute the encoded data 410 across blocks with corresponding IDs of 1, 2, 3, and 4; where "c" corresponds to the index value of a block and "j" represents the index value corresponding to an element within a block.For example, entering the index values ​​for the last element of the third block of data (i.e., block 430C) into the CD2 algorithm results in C[2][3] = E[2+3*4] = E

[14] , which corresponds to the value of 21 within the encoded data 410.

[0069] In the illustrative example, the cyclic distribution of encoded data 410 is represented by shading corresponding to block IDs associated with element 420. In some embodiments, secure data distribution program 200 uses block IDs that indicate the order of the blocks of encoded data associated with data 401. In one example, elements of encoded data 410 shown without shading correspond to block ID 1 (i.e., encoding values ​​17, 15, 20, and 2), those shown with speckled shading correspond to block ID 2 (i.e., encoding values ​​10, 7, 22, and 19), those shown with hatched shading correspond to block ID 3 (i.e., encoding values ​​22, 12, 0, and 21), and those shown with high-density speckled shading correspond to block ID 4 (i.e., encoding values ​​9, 9, and 14).

[0070] In the illustrative example, block 430A represents the set of encoded data elements and a corresponding order of encoded data elements 410 of block ID 1. Similarly, block 430B represents the set of encoded data elements and a corresponding order of encoded data elements 410 of block ID 2, block 430C represents the set of encoded data elements and a corresponding order of encoded data elements 410 of block ID 3, and block 430D represents the set of encoded data elements and a corresponding order of encoded data elements 410 of block ID 4.

[0071] In various embodiments, secure data distribution program 200 generates metadata associated with data 401 regarding the distributed storage of encoded data 410. In the illustrative example, metadata 431A represents metadata related to block 430A. Similarly, metadata 431B represents metadata related to block 430B, metadata 431C represents metadata related to block 430C, and metadata 431D represents metadata related to block 430D. In one embodiment, secure data distribution program 200 generates metadata indicating a data ID corresponding to the original data (e.g., data 401), a block ID identifier, and a location identifier. Metadata 431 represents an example of a metadata schema.In the illustrated example, metadata 431B is "A2+25," indicating that block 430B is associated with data ID "A" and block ID "2"; and "+" is an example of a data descriptor, with the information to the right of the descriptor indicating storage identifier "25" associated with storing the corresponding block of encoded data. In various embodiments, a storage identifier corresponds to a storage ID and / or a storage location within storage information 107 determined to store a block of encoded data (in . Fig. 2 step 204 and / or step 208). In one embodiment, metadata relating to blocks of encoded data is included within the storage information 107 and further associated with the original data for secure distributed storage.

[0072] It should be understood at the outset that, although this disclosure includes a detailed description of cloud computing, the implementation of the teachings herein is not limited to a cloud computing environment. Rather, embodiments of the present invention may be practiced in conjunction with any other type of computing environment now known or later invented.

[0073] Cloud computing is a service delivery model for enabling seamless, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a service provider. This cloud model can include at least five characteristics, at least three service models, and at least four implementation models.

[0074] The properties are as follows: On-demand self-service: A cloud user can unilaterally and automatically provision data processing functions such as server time and network storage as needed, without requiring human interaction with the service provider. Broad Network Access: Functions are available over a network and accessed through standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs). Resource pooling: The provider's computing resources are pooled to serve multiple users using a multi-tenant model, with various physical and virtual resources dynamically allocated and reassigned as needed. There is a perceived location independence, as the user generally has no control or knowledge over the exact location of the provided resources, but may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center). Rapid Elasticity: Features can be deployed quickly and elastically for rapid horizontal scaling out, in some cases automatically, and released quickly for rapid scale-in. To the user, the features available for deployment often appear unlimited, and they can be purchased in any quantity at any time. Measured Service: Cloud systems automatically control and optimize resource usage by leveraging a measurement function at a certain level of abstraction appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, creating transparency for both the provider and the user of the service.

[0075] The service models are as follows: Software as a Service (SaaS): The functionality provided to the user is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices via a thin client interface such as a web browser (e.g., web-based email). The user does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The functionality provided to the user is to deploy applications created or obtained by the user, using programming languages ​​and tools supported by the provider, into the cloud infrastructure. The user does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly over configurations of the application hosting environment. Infrastructure as a Service (IaaS): The functionality provided to the user consists of providing processing, storage, networking, and other basic computing resources, allowing the user to deploy and run any software, including operating systems and applications. The user does not manage or control the underlying cloud infrastructure, but has control over operating systems, storage, deployed applications, and possibly limited control over selected network components (e.g., host firewalls).

[0076] The deployment models are as follows: Private Cloud: The cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can be located on its own premises or on a third-party site. Community Cloud: The cloud infrastructure is shared by multiple organizations and supports a specific user community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organizations or a third party and can be located on their own premises or on third-party premises. Public Cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services. Hybrid Cloud: Cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain separate entities but are interconnected by a standardized or proprietary technology that enables data and application portability (e.g., cloud targeting for load balancing between clouds).

[0077] A cloud computing environment is service-oriented, focusing on state independence, low coupling, modularity, and semantic interoperability. At the heart of cloud computing lies an infrastructure consisting of a network of interconnected nodes.

[0078] Fig. 5 represents various computing units of cloud computing node 10 (this discussion merely provides an example of a suitable cloud computing node and is not intended to limit the scope of use or functionality of embodiments of the invention described herein). Regardless, cloud computing node 10 may be implemented and / or perform any functionality of embodiments of the invention described herein.

[0079] Notwithstanding the foregoing, the cloud computing node 10 may be executed and / or perform any of the functionality set forth above. In exemplary embodiments, the cloud computing node 10 represents the system 102. In various embodiments, the cloud computing node 10 may represent physical hardware instances of hardware elements and / or computing devices (e.g., RISC-based servers 62, servers 63, etc.) and / or a virtualized instance of hardware elements, computing devices (e.g., virtual servers 71, virtual storage 72, virtual networks 73, etc.), which may be described with reference to Fig. 7 will be discussed in more detail.

[0080] As in Fig. 5, the computer system 500 in the cloud computing node 10 is shown, in some embodiments, in the form of a general-purpose computing device, such as system 102. In further embodiments, the computer system 500 represents one or more computing devices connected to the cloud computing environment 50, such as memory 120A through memory 120N. The computer system 500 is an example of a system including software and data 510. The computer system 500 includes processor(s) 501, main memory 502, cache 503, persistent storage 505, a communications unit 507, input / output (I / O) interface(s) 506, and a communications fabric 504.

[0081] Transfer fabric 504 provides transfers between main memory 502, cache 503, persistent memory 505, transfer unit 507, and input / output (I / O) interface(s) 506. Transfer fabric 504 may be implemented using any architecture designed to transfer data and / or control information between processors (such as microprocessors, transfer and network processors, etc.), system memory, peripheral devices, and any other hardware components within a system. For example, transfer fabric 504 may be implemented using one or more buses, such as a Peripheral Component Interconnect (PCI) bus or a crossbar switch.

[0082] Main memory 502 and persistent memory 505 are computer-readable storage media. In this embodiment, main memory 502 includes random access memory (RAM). In general, main memory 502 may include any suitable volatile or non-volatile computer-readable storage media. Cache 503 is a fast memory that improves the performance of processor(s) 501 by retaining recently accessed and nearly recently accessed data from main memory 502.

[0083] Program instructions and data used to practice embodiments of the present invention may be stored in persistent memory 505 and main memory 502 for execution by one or more of the respective processors 501 via cache 503. In one embodiment, persistent memory 505 includes a magnetic hard disk drive. Alternatively, or in addition to a magnetic hard disk drive, persistent memory 505 may include a solid-state hard disk drive, a semiconductor storage device, read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, or any other computer-readable storage medium capable of storing program instructions or digital information. In one embodiment, memory 103 is included in persistent memory 505.

[0084] The storage media used by persistent storage 505 may also be removable. For example, a removable hard disk drive may be used for persistent storage 505. Other examples include optical and magnetic disks, thumb drives, and smart cards that are inserted into a drive for transfer to another computer-readable storage medium that is also part of persistent storage 505. Software and data 510 are stored in persistent storage 505 for access and / or execution by one or more of the respective processors 501 via cache 503 and one or more main memories of main memory 502.With reference to system 102, software and data 510 includes data 104, data keys 105, security algorithms 106, storage information 107, secure data distribution program 200, secure data recovery program 300, and various programs (not shown). With reference to memory 120A through memory 120N, software and data 510 each include various programs and data (not shown).

[0085] The transfer unit 507 in these examples enables transfers with other data processing systems or devices, including resources of system 102 and memory 120A through memory 120N. In these examples, the transfer unit 507 includes one or more network interface cards. The transfer unit 507 may provide transfers using physical or wireless, or both physical and wireless, data links. Program instructions and data used to practice embodiments of the present invention may be downloaded into the persistent storage 505 by the transfer unit 507.

[0086] The I / O interface(s) 506 enable the input and output of data with other devices that may be connected to any data processing system, such as an instance of the node 10. For example, the I / O interface(s) 506 may provide a connection to external device(s) 508, such as a keyboard, keypad, touchscreen, and / or other suitable input device. The external device(s) 508 may also include removable, computer-readable storage media, such as thumb drives, removable optical or magnetic disks, and memory cards. The software and data 510 used to practice embodiments of the present invention may be stored on such removable, computer-readable storage media and loaded into the persistent storage 505 via I / O interface(s) 506.The I / O interface(s) 506 is / are also connected to the display 509.

[0087] The I / O interface(s) 506 also enable one or more devices to communicate with the computer system / server 500; and / or any devices (e.g., network card, modem, etc.) that enable the computer system / server 500 to communicate with one or more other computing devices. Such communication may occur via the I / O interface(s) 506. However, the computer system / server 500 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), and / or a public network (e.g., the Internet), via the communications device 507. It should be understood that other hardware and / or software components could be used in conjunction with the computer system / server 500, although not shown.Examples include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archiving storage systems, etc.

[0088] Screen 509 provides a mechanism for displaying data to a user and may, for example, be a computer monitor. Screen 509 may also function as a touch-sensitive screen, such as the screen of a tablet computer or a smartphone.

[0089] Fig. 6 depicts an illustrative example of cloud computing environment 50. As shown, cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud users, such as a personal digital assistant (PDA) or cellular phone 54A, a desktop computer 54B, a laptop computer 54C, and / or an automotive computer system 54N, can communicate. Nodes 10 can communicate with each other. They can be physically or virtually grouped into one or more networks, such as private, community, public, or hybrid clouds (not shown), as described above, or a combination thereof. This enables cloud computing environment 50 to provide infrastructure, platforms, and / or software as a service, for which a cloud user does not need to maintain resources on a local computing device.It should be noted that the types of in . Fig. 6 are intended to be merely illustrative, and that the computing nodes 10 and the cloud computing environment 50 may communicate with any type of computer-based device via any type of network and / or via any type of network-accessible connection (e.g., using a web browser). Furthermore, according to embodiments of the present invention, an instance of the cloud computing node 10 and the computing units 54A to N may include components described with reference to Fig. 5 previously presented and described in more detail.

[0090] Fig. Figure 7 illustrates a set of functional abstraction layers implemented by the cloud computing environment 50 ( Fig. 6) are provided. It should be clear from the outset that the Fig. The components, layers, and functions shown in Figure 7 are intended to be illustrative only, and embodiments of the invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0091] A hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframe computers 61; servers based on the RISC (Reduced Instruction Set Computer) architecture 62; servers 63; blade servers 64; storage devices 65; and networks and network components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0092] A virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be deployed: virtual servers 71; virtual storage 72; virtual networks 73, including virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0093] In one example, the management layer 80 may provide the functions described below. Resource provisioning 81 provides for the dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 82 provides for cost tracking of using resources within the cloud computing environment, as well as billing or invoicing for the consumption of those resources. In one example, these resources may include application software licenses. A user portal 83 provides users and system administrators with access to the cloud computing environment. Service scope management 84 provides for the allocation and management of cloud computing resources so that the required service objectives are met.Service Level Agreement (SLA) planning and fulfillment 85 provides for the pre-arranging and procurement of cloud computing resources anticipated to be needed in the future, according to an SLA. Security 86 provides identity verification for cloud users and tasks, as well as protection for data and other resources. In various embodiments, security 86 includes one or more system-based functions and / or subscribed services (e.g., secure data distribution program 200 and secure data recovery program 300) that protect a user's or enterprise's data by distributing encoded and chunked data across a plurality of servers or storage systems of the hardware and software layer 60 at various physical locations.In some embodiments, security 86 uses additional aspects of management layer 80 to gain access to resources within hardware and software layer 60 from various vendors or cloud storage providers to store a user's or enterprise's encoded and chunked data.

[0094] A workload layer 90 provides examples of the functionality for which the cloud computing environment may be used. Examples of workloads and functions that may be provided by this layer include: mapping and navigation 91; software development and lifecycle management 92; providing virtual classroom education 93; data analytics processing 94; transaction processing 95; and security 96. In various embodiments, data security 96 includes, alternatively or in addition to security 86, one or more software applications, such as secure data distribution program 200 and secure data recovery program 300, that a user invokes to secure data within the cloud by distributing encoded and chunked data among a plurality of servers or storage systems of hardware and software layer 60 at various physical locations.

[0095] The programs described herein are identified based on the application for which they are implemented in a particular embodiment of the invention. However, it should be understood that any particular program nomenclature is used herein merely for convenience, and thus the invention should not be limited to exclusive use in a particular application identified and / or implied by such nomenclature.

[0096] The present invention may be a system, a method, and / or a computer program product. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions embodied thereon for causing a processor to perform aspects of the present invention.

[0097] The computer-readable storage medium may be any physical device capable of retaining and storing instructions for use by an instruction-executing system. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer-readable storage medium includes the following: a portable computer diskette, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM).Flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD), memory stick, floppy disk, mechanically encoded device such as punched cards or raised structures in a groove on which instructions are stored, and any suitable combination thereof. A computer-readable storage medium, as used herein, shall not be construed as carrying transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., pulses of light traveling through fiber optic cables), or electrical signals conveyed through a wire.

[0098] Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to respective computing / processing units or to an external computer or storage unit via a network such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper transmission cables, fiber optic transmission lines, wireless transmission, routers, firewalls, switching units, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing unit receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium within the respective computing / processing unit.

[0099] Computer-readable program instructions for performing operations of the present invention may be assembly language instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, or the like, as well as conventional procedural programming languages ​​such as the C programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server.In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, over the Internet using an Internet service provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute the computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuits to perform aspects of the present invention.

[0100] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowcharts and / or block diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, may be implemented by computer-readable program instructions.

[0101] These computer-readable program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, produce a means for implementing the functions / steps defined in the flowchart block(s) and / or block diagrams.These computer-readable program instructions may also be stored on a computer-readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer-readable storage medium having instructions stored thereon comprises an article of manufacture, including instructions that implement aspects of the function / step specified in the flowchart block(s) and / or block diagrams.

[0102] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of process steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-executable process such that the instructions executing on the computer, other programmable apparatus, or other device implement the functions / steps defined in the block(s) of flowcharts and / or block diagrams.

[0103] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions comprising one or more executable instructions for performing the particular logical function(s). In some alternative implementations, the functions indicated in the block may occur in a different order than shown in the figures. For example, two blocks shown in succession may actually execute substantially concurrently, or the blocks may sometimes execute in reverse order depending on the corresponding functionality.It is further understood that each block of the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by special purpose hardware-based systems that perform the specified functions or steps, or by combinations of special purpose hardware and computer instructions.

[0104] The descriptions of the various embodiments of the present invention have been presented for the purpose of illustration, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the invention. The terminology used herein has been chosen to best explain the principles of the embodiment, practical application, or technical improvement over existing technology, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

[1] A method for securely storing data (104), the method comprising: Receiving, by one or more computer processors (501), a request to store data (104), the data (104) comprising a plurality of elements; converting, by the one or more computer processors (501), the plurality of elements of the data (104) into a plurality of corresponding numerical values, wherein the plurality of corresponding numerical values ​​are each associated with index values, and wherein the index value [i] begins at an index value of zero; Generating (206), by one or more computer processors (501), a plurality of elements of encoded data values ​​by applying one or more encoding algorithms to the plurality of corresponding numerical values ​​of the converted plurality of elements of the data, based on one or more dictations, wherein (i) the set of the plurality of elements of encoded data is equal to a set of the plurality of transformed elements of the data; (ii) the majority of the elements of the encoded data values ​​are expressed as numeric values; (iii) a first encoding algorithm excludes from a first dictation a first element of the plurality of elements of encoded data values ​​associated with an index value of [i]=0; (iv) the first dictation instructs the first encoding algorithm to use the numerical value of an encoded data element value associated with the index value [i-1] and the numerical value of a transformed element of the data from the plurality of elements of the data associated with the index value [i-1] to generate an encoded data value corresponding to a transformed element of the data from the plurality of elements of the data associated with the index value [i]; Distributing (208), by one or more computer processors (501), the plurality of elements of the encoded data (410) into two or more subsets of encoded data values ​​without duplication; and Transmitting (210), by one or more computer processors (501), the two or more subsets of the encoded data values ​​to a corresponding set of two or more storage systems (120A, 120N), wherein distributing (208) the plurality of elements of the encoded data values ​​among the two or more subsets of the encoded data values ​​without duplication further comprises: Determining, by one or more computer processors (501), based on a structure of at least one first encoding algorithm, that a value corresponding to a previous element of the encoded data is used to encode a subsequent element of the data of the plurality of elements of the data; and Distributing, by one or more computer processors, the plurality of elements of the encoded data values ​​among the two or more subsets of the encoded data values ​​such that the subsequent element of the encoded data values ​​is assigned to a subset of encoded data values ​​that is different from another subset of the encoded data values ​​that includes the previous element of the encoded data values ​​used to encode the subsequent element of the plurality of elements of the encoded data values. [2] The method of claim 1, further comprising: determining, by one or more computer processors (501), based on a security policy, to further obscure the encoding of the plurality of elements of the data (104); Selecting, by one or more computer processors (501), a data key (403) to be applied during encoding the plurality of elements of the data, wherein the data key (403) has two or more elements, and wherein a number of numerical values ​​included in the data key (403) is less than the number of data elements included in the converted plurality of elements of the data; and Applying, by one or more computer processors, a numerical value cyclically selected from the data key to the converted plurality of values ​​of the data by applying the first encoding algorithm, wherein cyclically selecting the numerical value from the data key (403) further comprises generating an element E[i] from the plurality of encoded data values ​​with index [i] according to the following formula: E[i] = (E[i-1] + D[i-1] + D[i] + K[i % key_size]) % max_value, where: E[i]: encoded data element value for index [i], D[i]: data element value to be encoded for index [i], K[i]: Key element value for index [i] and max_value: a numeric value that is at least 1 greater than a maximum value of any element of data element values ​​to be encoded. [3] The method of claim 1, wherein distributing the plurality of elements of the encoded data values ​​among the two or more subsets of the encoded data values ​​without duplication further comprises: Distributing, by one or more computer processors (501), in a cyclic manner, subsequent elements of the plurality of elements of the encoded data values ​​(410) to the two or more subgroups of the encoded data values ​​(410). [4] The method of claim 1, wherein the two or more storage systems (120A, 120N) are storage systems (120A, 120N) at different locations. [5] A computer program product for securely storing data, the computer program product comprising: one or more computer-readable storage media (500) and program instructions stored on the one or more computer-readable storage media, the program instructions being readable by one or more computer processors (501) to carry out the method according to any one of claims 1 to 4. [6] A computer system (500) for securely storing data (104), the computer system (500) comprising: one or more computer processors (501); one or more computer-readable storage media; and Program instructions stored on the computer-readable storage media for execution by at least one of the one or more computer processors (501) to carry out the method according to any one of claims 1 to 4.

Images