Data re-encryption for software applications
Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a request to execute a task for re-encrypting a set of data associated with an application that has been encrypted with a first encryption key. The task is for re-encrypting the set of data using a second encryption key. The program further determines an amount of work to complete the task. The program also divides the task into a set of subtasks based on the amount of work. The program further assigns each subtask in the set of subtasks to a node in a plurality of nodes for execution of the subtask. The plurality of nodes are configured to implement the application.
1. A non-transitory machine-readable medium storing a program executable by at least one processing unit of a device, the program comprising sets of instructions for:
receiving a request to execute a task for re-encrypting a set of data associated with an application that has been encrypted with a first encryption key, wherein the task is for re-encrypting the set of data using a second encryption key;
determining an amount of work to complete the task, wherein the amount of work comprises an amount of data that is to be re-encrypted using the second encryption key;
dividing the task into a set of subtasks based on the amount of data that is to be re-encrypted; and
assigning each subtask in the set of subtasks to a node in a plurality of nodes for execution of the subtask, wherein the plurality of nodes are configured to implement the application.
2. The non-transitory machine-readable medium of claim 1 , wherein the device is a particular node in the plurality of nodes, wherein the program further comprises a set of instructions for executing the subtask assigned to the particular node.
3. The non-transitory machine-readable medium of claim 2 , wherein the subtask specifies a subset of the set of data, wherein executing the subtask comprises:
retrieving the subset of the set of data from a storage configured to store encrypted data;
using the first encryption key to decrypt the subset of the set of data;
using the second encryption key to encrypt the subset of the set of data, and
storing the encrypted subset of the set of data in the storage.
4. The non-transitory machine-readable medium of claim 1 , wherein the program further comprises a set of instructions for retrieving configuration data associated with the application, the configuration data comprising metadata specifying data in the set of data that is encrypted, wherein determining the amount of work is based on the metadata.
5. The non-transitory machine-readable medium of claim 1 , wherein dividing the task into the set of subtasks comprises dividing the task into a set of batches of work.
6. The non-transitory machine-readable medium of claim 5 , wherein the set of data is stored in a database, wherein each batch of work in the set of batches of work specifies a set of rows in the database storing a subset of the set of data.
7. The non-transitory machine-readable medium of claim 5 , wherein the set of data is stored in a file system comprising a plurality of files, wherein each batch of work in the set of batches of work specifies a set of files in the plurality of files storing a subset of the set of data.
8. A method executable by a device, the method comprising:
receiving a request to execute a task for re-encrypting a set of data associated with an application that has been encrypted with a first encryption key, wherein the task is for re-encrypting the set of data using a second encryption key;
determining an amount of work to complete the task, wherein the amount of work comprises an amount of data that is to be re-encrypted using the second encryption key;
dividing the task into a set of subtasks based on the amount of data that is to be re-encrypted; and
assigning each subtask in the set of subtasks to a node in a plurality of nodes for execution of the subtask, wherein the plurality of nodes are configured to implement the application.
9. The method of claim 8 , wherein the device is a particular node in the plurality of nodes, the method further comprising executing the subtask assigned to the particular node.
10. The method of claim 9 , wherein the subtask specifies a subset of the set of data, wherein executing the subtask comprises:
retrieving the subset of the set of data from a storage configured to store encrypted data;
using the first encryption key to decrypt the subset of the set of data;
using the second encryption key to encrypt the subset of the set of data, and
storing the encrypted subset of the set of data in the storage.
11. The method of claim 8 further comprising retrieving configuration data associated with the application, the configuration data comprising metadata specifying data in the set of data that is encrypted, wherein determining the amount of work is based on the metadata.
12. The method of claim 8 , wherein dividing the task into the set of subtasks comprises dividing the task into a set of batches of work.
13. The method of claim 12 , wherein the set of data is stored in a database, wherein each batch of work in the set of batches of work specifies a set of rows in the database storing a subset of the set of data.
14. The method of claim 12 , wherein the set of data is stored in a file system comprising a plurality of files, wherein each batch of work in the set of batches of work specifies a set of files in the plurality of files storing a subset of the set of data.
15. A system comprising:
a set of processing units; and
a non-transitory machine-readable medium storing instructions that when executed by at least one processing unit in the set of processing units cause the at least one processing unit to:
receive a request to execute a task for re-encrypting a set of data associated with an application that has been encrypted with a first encryption key, wherein the task is for re-encrypting the set of data using a second encryption key;
determine an amount of work to complete the task, wherein the amount of work comprises an amount of data that is to be re-encrypted using the second encryption key;
divide the task into a set of subtasks based on the amount of data that is to be re-encrypted; and
assign each subtask in the set of subtasks to a node in a plurality of nodes for execution of the subtask, wherein the plurality of nodes are configured to implement the application.
16. The system of claim 15 , wherein the system is a particular node in the plurality of nodes, wherein the instructions further cause the at least one processing unit to execute the subtask assigned to the particular node.
17. The system of claim 16 , wherein the subtask specifies a subset of the set of data, wherein executing the subtask comprises:
retrieving the subset of the set of data from a storage configured to store encrypted data;
using the first encryption key to decrypt the subset of the set of data;
using the second encryption key to encrypt the subset of the set of data, and
storing the encrypted subset of the set of data in the storage.
18. The system of claim 15 , wherein the instructions further cause the at least one processing unit to retrieve configuration data associated with the application, the configuration data comprising metadata specifying data in the set of data that is encrypted, wherein determining the amount of work is based on the metadata.
19. The system of claim 15 , wherein dividing the task into the set of subtasks comprises dividing the task into a set of batches of work.
20. The system of claim 19 , wherein the set of data is stored in a database, wherein each batch of work in the set of batches of work specifies a set of rows in the database storing a subset of the set of data.