Secure storage of data through a multifaceted security scheme
This disclosure is directed to a computing system that performs techniques relating to the secure storage, maintenance, and retrieval of data. Techniques described in this disclosure may prevent, limit, or otherwise insulate the data from unauthorized access by hackers, rogue devices, and unauthorized users. In some examples, a computing system may store a file by fracturing the file into multiple data blocks, encrypting the data blocks or the data stored within the data blocks, and storing the data blocks in scattered locations on a network. Further, the computing system may occasionally move at least some of the stored data blocks, and may, upon moving such data blocks, reencrypt the moved data blocks with a different encryption key. Still further, the computing system may inject fake data and/or fake data blocks into the system.
1. A method comprising:
receiving, by a computing system and from a computing device on a network, a plurality of data blocks generated by the computing device, wherein the computing device generates the plurality of data blocks by splitting a file into a plurality of fragments, encrypting the plurality fragments with at least one of a plurality of encryption keys, and packaging the encrypted fragments into the plurality of data blocks;
storing, by the computing system, the plurality of data blocks across a plurality of nodes on the network;
storing, by the computing system, instructions for reassembling the file from the plurality of data blocks;
moving, by the computing system, at least some of the plurality of data blocks to different nodes on the network;
storing, by the computing system, updated instructions for reassembling the file, wherein the updated instructions enable reassembling the file after moving the at least some of the plurality of data blocks to different nodes on the network; and
continuing to move at least some of the data blocks to different nodes on the network, wherein the data blocks are moved at a frequency based on utilization of the nodes on the network, and wherein the data blocks are moved more frequently during periods of low utilization.
2. The method of claim 1 , further comprising:
receiving, by the computing system and from the computing device, a request to reassemble the file;
responsive to the request, accessing, by the computing system, the updated instructions for reassembling the file; and
sending, by the computing system to the computing device, information based on the updated instructions for reassembling the file, wherein the information enables the computing device to reassemble at least a portion of the file from the plurality of data blocks.
3. The method of claim 1 , further comprising:
storing, by the computing system, fake data at one or more of the plurality of nodes on the network, wherein the fake data is stored as a plurality of fake data blocks.
4. The method of claim 3 , further comprising:
detecting, by the computing system, access to at least one of the plurality of fake data blocks; and
taking action, by the computing system and in response to detecting access to the at least one of the plurality of fake data blocks, to secure the plurality of data blocks stored at the plurality of nodes on the network.
5. The method of claim 1 , wherein encrypting the plurality of fragments includes:
encrypting a first fragment with a first encryption key; and
encrypting a second fragment with a second encryption key, wherein the first encryption key is different than the second encryption key.
6. The method of claim 5 , wherein encrypting the first fragment includes modifying the first encryption key by applying one of a plurality of masks associated with the first encryption key.
7. The method of claim 1 , wherein the at least one of a plurality of encryption keys is a first encryption key, and wherein moving at least some of the plurality of data blocks to different nodes on the network includes:
reencrypting at least one of the moved data blocks using a second encryption key, wherein the second encryption key is one of the plurality of encryption keys, and wherein the second encryption key is different than the first encryption key.
8. A computing system comprising:
processing circuitry; and
at least one storage device that stores instructions that, when executed, configure the processing circuitry to:
receive, from a computing device on a network, a plurality of data blocks generated by the computing device, wherein the computing device generates the plurality of data blocks by splitting a file into a plurality of fragments, encrypting the plurality fragments with at least one of a plurality of encryption keys, and packaging the encrypted fragments into the plurality of data blocks;
store the plurality of data blocks across a plurality of nodes on the network;
store instructions for reassembling the file from the plurality of data blocks;
move at least some of the plurality of data blocks to different nodes on the network;
store updated instructions for reassembling the file, wherein the updated instructions enable reassembling the file after moving the at least some of the plurality of data blocks to different nodes on the network; and
continue to move at least some of the data blocks to different nodes on the network, wherein the data blocks are moved at a frequency based on utilization of the nodes on the network, and wherein the data blocks are moved more frequently during periods of low utilization.
9. The computing system of claim 8 , wherein the instructions, when executed, further configure the processing circuitry to:
receive, from the computing device, a request to reassemble the file;
responsive to the request, access the updated instructions for reassembling the file; and
send, to the computing device, information based on the updated instructions for reassembling the file, wherein the information enables the computing device to reassemble at least a portion of the file from the plurality of data blocks.
10. The computing system of claim 8 , wherein the instructions, when executed, further configure the processing circuitry to:
store fake data at one or more of the plurality of nodes on the network, wherein the fake data is stored as a plurality of fake data blocks.
11. The computing system of claim 10 , wherein the instructions, when executed, further configure the processing circuitry to:
detect access to at least one of the plurality of fake data blocks; and
take action, in response to detecting access to the at least one of the plurality of fake data blocks, to secure the plurality of data blocks stored at the plurality of nodes on the network.
12. The computing system of claim 8 , wherein encrypting the plurality of fragments includes:
encrypting a first fragment with a first encryption key; and
encrypting a second fragment with a second encryption key, wherein the first encryption key is different than the second encryption key.
13. The computing system of claim 12 wherein encrypting the first fragment includes modifying the first encryption key by applying one of a plurality of masks associated with the first encryption key.
14. The computing system of claim 8 , wherein the at least one of a plurality of encryption keys is a first encryption key, and wherein the instructions that configure the processing circuitry to move at least some of the data blocks to different nodes on the network include instructions that, when executed, configure the processing circuitry to:
reencrypt at least one of the moved data blocks using a second encryption key, wherein the second encryption key is one of the plurality of encryption keys, and wherein the second encryption key is different than the first encryption key.
15. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure processing circuitry of a computing system to:
receive, from a computing device on a network, a plurality of data blocks generated by the computing device, wherein the computing device generates the plurality of data blocks by splitting a file into a plurality of fragments, encrypting the plurality fragments with at least one of a plurality of encryption keys, and packaging the encrypted fragments into the plurality of data blocks;
store the plurality of data blocks across a plurality of nodes on the network;
store instructions for reassembling the file from the plurality of data blocks;
move at least some of the plurality of data blocks to different nodes on the network;
store updated instructions for reassembling the file, wherein the updated instructions enable reassembling the file after moving the at least some of the plurality of data blocks to different nodes on the network; and
continue to move at least some of the data blocks to different nodes on the network, wherein the data blocks are moved at a frequency based on utilization of the nodes on the network, and wherein the data blocks are moved more frequently during periods of low utilization.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions, when executed, further configure the processing circuitry to:
receive, from the computing device, a request to reassemble the file;
responsive to the request, access the updated instructions for reassembling the file; and
send, to the computing device, information based on the updated instructions for reassembling the file, wherein the information enables the computing device to reassemble at least a portion of the file from the plurality of data blocks.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions, when executed, further configure the processing circuitry to:
store fake data at one or more of the plurality of nodes on the network, wherein the fake data is stored as a plurality of fake data blocks.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the instructions, when executed, further configure the processing circuitry to:
detect access to at least one of the plurality of fake data blocks; and
take action, in response to detecting access to the at least one of the plurality of fake data blocks, to secure the plurality of data blocks stored at the plurality of nodes on the network.
19. The non-transitory computer-readable storage medium of claim 15 , wherein encrypting the plurality of fragments includes:
encrypting a first fragment with a first encryption key; and
encrypting a second fragment with a second encryption key, wherein the first encryption key is different than the second encryption key.
20. The non-transitory computer-readable storage medium of claim 19 , wherein encrypting the first fragment includes modifying the first encryption key by applying one of a plurality of masks associated with the first encryption key.