Homomorphic encryption-enabled parallel file system

1 . A computer-implemented method, comprising:

receiving, from a client device, by a parallel file system, a write request to store data in the parallel file system, wherein the parallel file system stores data across multiple storage nodes;

responsive to receiving the write request, determining a distribution map for storing the data, the distribution map identifying a plurality of storage nodes and comprising a mapping from portions of data to storage nodes of the plurality of storage nodes;

sending the distribution map to the client device;

receiving a plurality of chunks of encrypted data, wherein the plurality of chunks of encrypted data are encrypted using homomorphic encryption, wherein encrypting the plurality of chunks comprises homomorphic encryption of a stripe of data, the stripe comprising one or more chunks of parity data;

storing, by the parallel file system, each of the plurality of chunks in a storage node according to the distribution map;

receiving, by the parallel file system, a request to perform a computation;

performing, by the parallel file system, the computation in parallel on the plurality of storage nodes, wherein the computation is performed on the encrypted data without decrypting the encrypted data; and

sending a result of computation.

2 . The computer-implemented method of claim 1 , wherein the distribution map comprises an erasure coding layout to be used for storing the data.

3 . The computer-implemented method of claim 2 , wherein the distribution map is determined by a director node of the parallel file system and encrypting the plurality of chunks is performed by the director node.

4 . The computer-implemented method of claim 1 , wherein encrypting the plurality of chunks comprises homomorphic encryption of each chunk independently.

5 . The computer-implemented method of claim 1 , wherein encrypting the plurality of chunks is performed by the client device.

6 . The computer-implemented method of claim 1 , wherein the computation comprises at least one of:

compression;

deduplication;

data mining; or

collaborative processing of shared data.

7 . The computer-implemented method of claim 1 , wherein the parallel file system includes a director node, wherein performing the computation on the encrypted data comprises:

for each storage node:

performing computation on an encrypted chunk of data stored in the storage node to determine a partial result, and

sending the partial result to the director node; and

combining, by the director node, partial results received from the storage nodes to determine the result of the computation.

8 . The computer-implemented method of claim 1 , wherein the distribution map is determined based on server loading information received from the plurality of storage nodes.

9 . A non-transitory computer readable storage medium storing instructions that when executed by one or more computer processors, cause the one or more computer processors to perform steps comprising:

receiving, from a client device, by a parallel file system, a write request to store data in the parallel file system, wherein the parallel file system stores data across multiple storage nodes;

responsive to receiving the write request, determining a distribution map for storing the data, the distribution map identifying a plurality of storage nodes and comprising a mapping from portions of data to storage nodes of the plurality of storage nodes;

sending the distribution map to the client device;

receiving a plurality of chunks of encrypted data, wherein the plurality of chunks of encrypted data are encrypted using homomorphic encryption, wherein encrypting the plurality of chunks comprises homomorphic encryption of a stripe of data, the stripe comprising one or more chunks of parity data;

storing, by the parallel file system, each of the plurality of chunks in a storage node according to the distribution map;

receiving, by the parallel file system, a request to perform a computation;

performing, by the parallel file system, the computation in parallel on the plurality of storage nodes, wherein the computation is performed on the encrypted data without decrypting the encrypted data; and

sending a result of computation.

10 . The non-transitory computer readable storage medium of claim 9 , wherein the distribution map comprises an erasure coding layout to be used for storing the data.

11 . The non-transitory computer readable storage medium of claim 9 , wherein encrypting the plurality of chunks comprises homomorphic encryption of each chunk independently.

12 . The non-transitory computer readable storage medium of claim 9 , wherein the computation comprises at least one of:

compression;

deduplication;

data mining; or

collaborative processing of shared data.

13 . The non-transitory computer readable storage medium of claim 9 , wherein the parallel file system includes a director node, wherein instructions for performing the computation on the encrypted data cause the one or more computer processors to perform steps comprising:

for each storage node:

performing computation on an encrypted chunk of data stored in the storage node to determine a partial result, and

sending the partial result to the director node; and

combining, by the director node, partial results received from the storage nodes to determine the result of the computation.

14 . The non-transitory computer readable storage medium of claim 9 , wherein the distribution map is determined based on server loading information received from the plurality of storage nodes.

15 . A computer system comprising:

one or more computer processors; and

a non-transitory computer readable storage medium storing instructions that when executed by the one or more computer processors, cause the one or more computer processors to perform steps comprising:

receiving, from a client device, by a parallel file system, a write request to store data in the parallel file system, wherein the parallel file system stores data across multiple storage nodes;

responsive to receiving the write request, determining a distribution map for storing the data, the distribution map identifying a plurality of storage nodes and comprising a mapping from portions of data to storage nodes of the plurality of storage nodes;

sending the distribution map to the client device;

receiving a plurality of chunks of encrypted data, wherein the plurality of chunks of encrypted data are encrypted using homomorphic encryption, wherein encrypting the plurality of chunks comprises homomorphic encryption of a stripe of data, the stripe comprising one or more chunks of parity data;

storing, by the parallel file system, each of the plurality of chunks in a storage node according to the distribution map;

receiving, by the parallel file system, a request to perform a computation;

performing, by the parallel file system, the computation in parallel on the plurality of storage nodes, wherein the computation is performed on the encrypted data without decrypting the encrypted data; and

sending a result of computation.

16 . The computer system of claim 15 , wherein the distribution map comprises an erasure coding layout to be used for storing the data.

17 . The computer system of claim 15 , wherein encrypting the plurality of chunks comprises homomorphic encryption of each chunk independently.

18 . The computer system of claim 15 , wherein the computation comprises at least one of:

compression;

deduplication;

data mining; or

collaborative processing of shared data.

19 . The computer system of claim 15 , wherein the parallel file system includes a director node, wherein instructions for performing the computation on the encrypted data cause the one or more computer processors to perform steps comprising:

for each storage node:

performing computation on an encrypted chunk of data stored in the storage node to determine a partial result, and

sending the partial result to the director node; and

combining, by the director node, partial results received from the storage nodes to determine the result of the computation.

20 . The computer system of claim 15 , wherein the distribution map is determined based on server loading information received from the plurality of storage nodes.