Secure Compute Nodes for Encrypted Data Processing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Performing computations on storage systems in networks is problematic due to data distribution across multiple nodes and security concerns, particularly in cloud environments where infiltration of storage nodes can lead to data exfiltration.
Innovation Solution
Implementing secure compute nodes that retrieve encrypted data from storage systems, decrypt it using specific encryption keys, and perform computations on the decrypted data, ensuring that the storage systems do not have access to the computations or decrypted data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If computations are performed on storage systems in networks, then data processing capability is improved, but security risks increase due to data distribution across multiple nodes
Solution Approach 1:
The system segments the computation function by implementing separate compute nodes that are distinct from storage nodes. Each compute node is dedicated to performing computations on encrypted data without accessing the storage system directly, thereby separating security functions from computation functions and reducing the attack surface.
Solution Approach 2:
The patent introduces compute nodes as intermediary components between client devices and storage systems. These compute nodes retrieve encrypted data from storage, perform computations on the encrypted data, and return results without the storage system needing to know about or access the computations, thus mediating between data storage and computation requirements while maintaining security.
2Adaptability or versatility
If storage systems perform computations on distributed data, then computation functionality is improved, but data exposure increases
Solution Approach 1:
The patent extracts the computation function from the storage system by implementing dedicated compute nodes that handle all computational operations. The storage system only stores and retrieves encrypted data without performing computations, thereby removing the source of data exposure while preserving computation functionality through the separate compute node infrastructure.
Solution Approach 2:
The system uses encrypted copies of data that are retrieved from storage and processed in memory at compute nodes. The actual plaintext data never resides at the storage system or is exposed to unauthorized access, as computations are performed on encrypted copies that are temporarily held in volatile memory at the compute nodes.
3Object-affected harmful factors
If client devices store all data locally, then data security is improved, but storage resource utilization deteriorates
Solution Approach 1:
The patent merges storage and computation functions into a coordinated system where compute nodes are closely integrated with storage systems. Compute nodes retrieve encrypted data from storage, perform computations, and return results, effectively combining the benefits of centralized storage with distributed computation while maintaining security through encryption and key management.
Solution Approach 2:
The compute nodes serve multiple functions: they retrieve encrypted data from storage systems, perform various computations on the encrypted data, and return results to client devices. This multi-functional design allows the system to provide both secure storage and computation capabilities without requiring client devices to maintain large local storage capacities.
Data Source
AI summary
A computer-implemented method (CIM), according to one approach, includes causing a first compute function to be performed on a first secure compute node that is configured to retrieve data from a storage system. Performing the first compute function includes retrieving encrypted first data from the storage system, causing a first encryption key to be used to decrypt at least some of the encrypted first data, and running predetermined code on the decrypted data. The method further includes providing a first client site with first data that includes results of running the predetermined code on the decrypted data. A computer program product (CPP), according to another embodiment, includes a set of one or more computer-readable storage media, and program instructions, collectively stored in the set of one or more storage media, for causing a processor set to perform the foregoing method.