Data center privacy

Patent metadata

Field	Value
Publication number	US-10068097-B2
Application number	US-201514824310-A
Country	US
Kind code	B2
Filing date	Aug 12, 2015
Priority date	Aug 12, 2015
Publication date	Sep 4, 2018
Grant date	Sep 4, 2018

Abstract

A data center has a plurality of secure processing units; a plurality of data stores holding encrypted data records; and a network connecting the secure processing units and the data stores. The secure processing units comprise computing functionality configured to execute a data processing operation in parallel on the secure processing units by being configured to read encrypted records from the stores, process one or more of the encrypted records within the secure processing units, send one or more of the encrypted records to the stores. The data center is configured to carry out a secret shuffle of the data records to protect the privacy of data processed in the data center from an observer observing any one or more of: the reading of the records, the sending of the records, the writing of the records; the secret shuffle comprising a random permutation of the records hidden from the observer.

First claim

The invention claimed is:

1. A data center comprising:
a plurality of secure processing units;
a plurality of data stores holding encrypted data records; and
a network connecting the secure processing units and the data stores,
wherein the secure processing units are configured to execute a data processing operation in parallel by being configured to read encrypted records from the plurality of data stores, process one or more of the encrypted data records within the secure processing units, send one or more of the encrypted data records between the secure processing units over the network, and write the encrypted data records to the plurality of data stores,
wherein the data processing operation is implemented using a plurality of mappers and a plurality of reducers, the plurality of mappers are configured to compute an execution plan, include a record key assignment, for the data processing operation to balance the amount of activity between individual ones of the plurality of secure processing units,
wherein the data processing operation is configured to carry out a secret shuffle of at least some of the encrypted data records to protect privacy of data being processed from an observer that may observe any one or more of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted data records,
wherein the secret shuffle comprises a random permutation of the encrypted data records hidden from the observer, and
wherein the plurality of secure processing units include a plurality of additional mappers and a plurality of additional reducers, the plurality of additional mappers and the plurality of additional reducers are arranged to carry out the secret shuffle.

2. The data center of claim 1 , further comprising:
a data uploader configured to upload the encrypted data records to the plurality of data stores by carrying out the secret shuffle of the encrypted data records as part of the upload.

3. The data center of claim 1 , wherein the plurality of secure processing units are configured to carry out the secret shuffle of the encrypted data records before executing the data processing operation.

4. The data center of claim 1 , wherein the plurality of secure processing units are configured to carry out the secret shuffle of the encrypted data records sent between secure processing units of the plurality of secure processing units.

5. The data center of claim 1 , wherein the data processing operation is implemented using the plurality of mappers and the plurality of reducers at the plurality of secure processing units.

6. The data center of claim 5 , wherein the plurality of mappers are arranged to pad their outputs.

7. The data center of claim 5 , wherein the plurality of reducers are arranged to pad their outputs.

8. The data center of claim 1 , wherein the plurality of additional mappers and the plurality of additional reducers are configured to execute at least twice per secret shuffle.

9. The data center of claim 1 , wherein the plurality of secure processing units comprise an execution plan for the data processing operation, the execution plan arranged to balance the amount of activity between individual ones of the plurality of secure processing units, where activity comprises any of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted data records.

10. The data center of claim 9 , wherein the execution plan having been computed using a sample from a data processing operation.

11. The data center of claim 9 , wherein the execution plan being specific to a particular data processing operation.

12. The data center of claim 1 , wherein the plurality of secure processing units are configured to compute an execution plan for the data processing operation to balance the amount of activity between individual ones of the plurality of secure processing units, where activity comprises any of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted data records, and
wherein the execution plan comprises an amount of padding to be applied to the encrypted data records.

13. The data center of claim 1 , wherein the activity comprises any of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted data records.

14. The data center of claim 13 , wherein the execution plan having been calculated from cached data about observed distributions of the encrypted data records produced by the plurality of mappers.

15. The data center of claim 13 , wherein the record key assignment indicates which encrypted data records are to be sent to which reducer of the plurality of reducers.

16. The data center of claim 13 , wherein the execution plan comprises a key assignment, assigning keys to reducers of the plurality of reducers, which hides key distribution among key-record pairs of the data processing operation.

17. A method of facilitating privacy at a data center comprising:
executing a data processing operation in parallel using a plurality of secure processing units, the data processing operation comprising reading encrypted data records from a plurality of data stores connected to the plurality of secure processing units via a network, processing one or more of the encrypted data records within the plurality of secure processing units, sending one or more of the encrypted data records between the plurality of secure processing units over the network, and writing encrypted data records to the plurality of data stores, wherein the data processing operation is implemented using a plurality of mappers and a plurality of reducers, the plurality of mappers are configured to compute an execution plan, include a record key assignment, for the data processing operation to balance the amount of activity between individual ones of the plurality of secure processing units; and
carrying out a secret shuffle of the encrypted data records to facilitate privacy of data being processed from an observer that may observe any one or more of: the reading of the encrypted data records, the sending of the encrypted data records, and the writing of the encrypted data records,
wherein the secret shuffle comprises a random permutation of the encrypted data records which is hidden from the observer, and
wherein the plurality of secure processing units include a plurality of additional mappers and a plurality of additional reducers, the plurality of additional mappers and the plurality of additional reducers are arranged to carry out the secret shuffle.

18. The method of claim 17 , wherein at least one of the plurality of mappers are arranged to pad their outputs and the plurality of reducers are arranged to pad their outputs.

19. One or more non-transitory device-readable media with device-executable instructions that, when executed by a computing system, direct the computing system to perform steps comprising:
executing a data processing operation in parallel using a plurality of secure processing units, the data processing operation comprising reading encrypted data records from a plurality of data stores connected to the plurality of secure processing units via a network, processing one or more of the encrypted data records within the plurality of secure processing units, sending one or more of the encrypted data records between the plurality of secure processing units over the network, and writing encrypted data records to the

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Ohrimenko Olga
• Costa Manuel
• Fournet Cedric
• Gkantsidis Christos
• Kohlweiss Markulf
• Sharma Divya

Classifications

• G06F9/5066 Primary

  Algorithms for mapping a plurality of inter-dependent sub-tasks onto a plurality of physical CPUs (mappping at compile time, see G06F8/451) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L2209/16

  Obfuscation or hiding, e.g. involving white box · CPC title