Systems and methods for secure multi-tenant data storage
View Patent ↗Systems and methods are provided for transmitting data for secure storage. For each of two or more data sets, a plurality of shares are generated containing a distribution of data from an encrypted version of the data set. The shares are then stored in a shared memory device, wherein a data set may be reconstructed from a threshold number of the associated plurality of shares using an associated key. Also provided are systems and methods for providing access to secured data. A plurality of shares containing a distribution of data from an encrypted version of a data set are stored in a memory device. A client is provided with a virtual machine that indicates the plurality of shares, and the capability to reconstruct the data set from the plurality of shares using an associated key.
1. A method of securely storing data in a multi-tenant data storage system, comprising:
receiving a first data set from a first data source;
receiving a second data set from a second data source;
encrypting the first data set with a first key;
encrypting the second data set with a second key, the second key different from the first key;
generating a first plurality of shares, wherein each of the first plurality of shares contains a distribution of data from the encrypted first data set;
generating a second plurality of shares, wherein each of the second plurality of shares contains a distribution of data from the encrypted second data set; and
storing at least one share of the first plurality of shares and at least one share of the second plurality of shares in a first shared memory device of the multi-tenant data storage system without a physical partitioning or a virtual partitioning of the first shared memory device between the stored at least one share of the first plurality of shares and the stored at least one share of the second plurality of shares,
wherein access to the first key and a threshold number of the first plurality of shares are necessary to restore the first data set.
2. The method of claim 1 , wherein the first and second data sources are unrelated.
3. The method of claim 1 , wherein the first data set is encrypted with the first key at a first server and the second data set is encrypted with the second key at a second server different from the first server.
4. The method of claim 3 , wherein the first and second servers are blades.
5. The method of claim 3 , wherein the first and second servers are virtual machines.
6. The method of claim 1 , wherein the at least one share of the first plurality of shares and the at least one share of the second plurality of shares are stored contiguously in the first shared memory device.
7. The method of claim 1 , further comprising:
storing some of the first plurality of shares and some of the second plurality of shares in a second shared memory device different from the first shared memory device.
8. The method of claim 7 , wherein at least one of the first plurality of shares is stored on both the first shared memory device and the second shared memory device.
9. The method of claim 1 , further comprising:
storing at least two of the first plurality of shares and at least two of the second plurality of shares in the first shared memory device.
10. The method of claim 1 , wherein access to the second key and a threshold number of the second plurality of shares are necessary to restore the second data set.
11. A system for securely storing data in a multi-tenant data storage system, comprising:
at least one processing device configured to receive a first data set from a first data source and a second data set from a second data source; and
a first shared memory device;
the at least one processing device further configured to:
encrypt the first data set with a first key;
encrypt the second data set with a second key, the second key different from the first key;
generate a first plurality of shares, wherein each of the first plurality of shares contains a distribution of data from the encrypted first data set;
generate a second plurality of shares, wherein each of the second plurality of shares contains a distribution of data from the encrypted second data set; and
store at least one share of the first plurality of shares and at least one share of the second plurality of shares in a first shared memory device of the multi-tenant data storage system without a physical partitioning or a virtual partitioning of the first shared memory device between the stored at least one share of the first plurality of shares and the stored at least one share of the second plurality of shares,
wherein access to the first key and a threshold number of the first plurality of shares are necessary to restore the first data set.
12. The system of claim 11 , wherein the first and second data sources are unrelated.
13. The system of claim 12 , wherein the at least one processing device comprises a first server and a second server, and wherein the first data set is encrypted with the first key at a first server and the second data set is encrypted with the second key at a second server different from the first server.
14. The system of claim 13 , wherein the first and second servers are blades.
15. The system of claim 13 , wherein the first and second servers are virtual machines.
16. The system of claim 11 , wherein the at least one share of the first plurality of shares and the at least one share of the second plurality of shares are stored contiguously in the first shared memory device.