Integrated security and data redundancy
One embodiment provides a system that facilitates integrated security and high availability. During operation, the system obtains a number of data elements from a data stream based on a number of coded fragments that a code word includes. The system determines one or more bit-level operations for the data elements in such a way that at least one of the one or more bit-level operations becomes eliminated from a process of erasure encoding. The system then obfuscates the data elements based on one or more bit-level operations. Subsequently, the system generates a code word of the erasure encoding from the obfuscated data elements based on the generator matrix. The code word comprises a plurality of coded fragments.
1. A computer-implemented method for facilitating integrated security and high availability, the method comprising:
obtaining, by a computing system, a number of data elements based on a number of coded fragments that a code word of erasure encoding includes;
determining one or more bit-level operations for the data elements in such a way that at least one of the one or more bit-level operations becomes eliminated from a first set of operations of the erasure encoding;
obfuscating the data elements based on the one or more bit-level operations; and
generating the code word of the erasure encoding from the obfuscated data elements based on a generator matrix, wherein the generator matrix indicates a second set of operations derived from eliminating the at least one operation from the first set of operations.
2. The method of claim 1 , wherein the number of data elements comprises a first data element and a second data element, wherein the first data element comprises a first set of bytes from a first data stream, and wherein the second data element comprises a second set of bytes from the first data stream.
3. The method of claim 1 , wherein the number of data elements comprises a first data element and a second data element, wherein the first data element comprises a set of bytes from a first data stream, and wherein the second data element comprises a second set of bytes from a second data stream.
4. The method of claim 1 , wherein the one or more bit-level operations include one or more of: a bit shift operation, an exclusive OR (XOR) operation, and a replacement operation.
5. The method of claim 4 , wherein the XOR operation is between the data elements and a binary obfuscation matrix, wherein the binary obfuscation matrix is organized to incorporate security bits into the data elements.
6. The method of claim 4 , further comprising determining an obfuscation configuration, which specifies the bit shift operation and the replacement operations.
7. The method of claim 1 , wherein the data elements are represented in a numerical representation, wherein the numerical representation and the generator matrix include one or more complex numbers in a format composed of real and imaginary parts.
8. The method of claim 1 , wherein determining the one or more bit-level operations comprises:
determining a set of bit-level operations that share common properties with the obfuscation and the erasure encoding; and
selecting the one or more bit-level operations from the set of bit-level operations.
9. The method of claim 1 , further comprising:
retrieving a minimum number of coded fragments of the code word needed to recover the data elements;
applying an inverse of the one or more bit-level operations to the coded fragments to remove the obfuscation; and
obtaining the data elements from the coded fragments based on an inverted matrix of a sub-matrix of the generator matrix based on the minimum number of the coded fragments.
10. The method of claim 1 , further comprising:
identifying one or more of the coded fragments that are unavailable;
identifying remaining coded fragments that are available;
determining a sub-matrix of the generator matrix based on a minimum number of the remaining coded fragments needed to recover the unavailable coded fragments; and
recovering, at the same time, all of the unavailable coded fragments based on an inverted matrix of the sub-matrix and indices of the unavailable coded fragments, thereby avoiding recovery of one unavailable coded fragment at a time.
11. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for facilitating integrated security and high availability, the method comprising:
obtaining, by a computing system, a number of data elements from a data stream based on a number of coded fragments that a code word of erasure encoding includes;
determining one or more bit-level operations for the data elements in such a way that at least one of the one or more bit-level operations becomes eliminated from a first set of operations process of the erasure encoding;
obfuscating the data elements based on the one or more bit-level operations; and
generating the code word of the erasure encoding from the obfuscated data elements based on a generator matrix, wherein the generator matrix indicates a second set of operations derived from eliminating the at least one operation from the first set of operations.
12. The computer-readable storage medium of claim 11 , wherein the number of data elements comprises a first data element and a second data element, wherein the first data element comprises a first set of bytes from a first data stream, and wherein the second data element comprises a second set of bytes from the first data stream.
13. The computer-readable storage medium of claim 11 , wherein the number of data elements comprises a first data element and a second data element, wherein the first data element comprises a set of bytes from a first data stream, and wherein the second data element comprises a second set of bytes from a second data stream.
14. The computer-readable storage medium of claim 11 , wherein the one or more bit-level operations include one or more of: a bit shift operation, an exclusive OR (XOR) operation, and a replacement operation.
15. The computer-readable storage medium of claim 14 , wherein the XOR operation is between the data elements and a binary obfuscation matrix, wherein the binary obfuscation matrix is organized to incorporate security bits into the data elements.
16. The computer-readable storage medium of claim 14 , wherein the method further comprises determining an obfuscation configuration, which specifies the bit shift operation and the replacement operations.
17. The computer-readable storage medium of claim 11 , wherein the data elements are represented in a numerical representation, wherein the numerical representation and the generator matrix include one or more complex numbers in a format composed of real and imaginary parts.
18. The computer-readable storage medium of claim 11 , wherein determining the one or more bit-level operations comprises:
determining a set of bit-level operations that share common properties with the obfuscation and the erasure encoding; and
selecting the one or more bit-level operations from the set of bit-level operations.
19. The computer-readable storage medium of claim 11 , wherein the method further comprises:
retrieving a minimum number of coded fragments of the code word needed to recover the data elements;
applying an inverse of the one or more bit-level operations to the coded fragments to remove the obfuscation; and
obtaining the data elements from the coded fragments based on an inverted matrix of a sub-matrix of the generator matrix based on the minimum number of the coded fragments.
20. The computer-readable storage medium of claim 11 , wherein the method further comprises:
identifying one or more of the coded fragments that are unavailable;
identifying remaining coded fragments that are available;
determining a sub-matrix of the generator matrix based on a minimum number of the remaining coded fragments needed to recover the unavailable coded fragments; and
recovering, at the same time, all of the unavailable coded fragments based on an inverted matrix of the sub-matrix and indices of the unavailable coded fragments, thereby avoiding recovery of one unavailable coded fragment at a time.