[Paper Review] Data protection by means of fragmentation in various different distributed storage systems - a survey

Katarzyna Kapusta, Gérard Memmi|arXiv (Cornell University)|Jun 16, 2017

Advanced Data Storage Technologies4 citations

TL;DR

This survey proposes a comprehensive analysis of distributed storage systems that use data fragmentation for both resilience and security, categorizing them into bitwise (for unstructured data) and structurewise (for structured, confidential data). It presents a scalable, multi-level architecture that optimizes security, performance, and cost by strategically placing data fragments across trusted, bare-metal, and public cloud environments based on confidentiality levels.

ABSTRACT

This paper analyzes various distributed storage systems that use data fragmentation and dispersal as a way of protection.Existing solutions have been organized into two categories: bitwise and structurewise. Systems from the bitwise category are operating on unstructured data and in a uniform environment. Those having structured input data with predefined confidentiality level and disposing of a heterogeneous environment in terms of machine trustworthiness were classified as structurewise. Furthermore, we outline high-level requirements and desirable architecture traits of an eficient data fragmentation system, which will address performance (including latency), availability, resilience and scalability.

Motivation & Objective

• To analyze existing distributed storage systems using data fragmentation for security, beyond just redundancy.
• To identify and classify systems into bitwise (unstructured data, uniform trust) and structurewise (structured data, heterogeneous trust) categories.
• To define high-level requirements for efficient data fragmentation systems, focusing on performance, availability, resilience, and scalability.
• To propose a future architecture that combines security, cost-efficiency, and performance through multi-level data placement based on confidentiality.
• To address open challenges such as key management, latency, and automated classification of sensitive data in structured systems.

Proposed method

• Categorizing existing systems into bitwise and structurewise based on data type (unstructured vs. structured) and trust model (uniform vs. heterogeneous).
• Introducing standardized notation (e.g., n = total fragments, k = fragments needed for recovery, p = fragments not revealing data) to unify system comparisons.
• Evaluating systems using criteria such as secrecy, key management, integrity, recovery, defragmentation, and trusted location control.
• Proposing a three-tier storage model: ultra-confidential (trusted zone), confidential (bare-metal clouds), and non-confidential (public clouds) based on data sensitivity.
• Designing a scalable, parallelized architecture that minimizes storage cost while maximizing security and performance through intelligent fragment distribution.
• Leveraging existing techniques like Shamir’s secret sharing and redundancy schemes, while emphasizing the need for automated sensitivity classification in structured data.

Experimental results

Research questions

• RQ1 How can data fragmentation be effectively used not only for resilience but also for enhancing data confidentiality in distributed storage systems?
• RQ2 What are the key architectural and performance trade-offs between bitwise and structurewise fragmentation approaches in heterogeneous trust environments?
• RQ3 How can multi-level data classification and placement across trusted, bare-metal, and public cloud storage optimize security and cost-efficiency?
• RQ4 What are the major open challenges in deploying secure, scalable, and performant fragmented storage systems, particularly regarding latency and key management?
• RQ5 To what extent can automated or semi-automated classification of sensitive data improve the usability and efficiency of structurewise fragmentation systems?

Key findings

• Bitwise systems, such as those using Shamir’s secret sharing, can achieve strong secrecy with k-out-of-n fragment recovery, where k > 1 increases attacker effort.
• Structurewise systems outperform bitwise systems in structured data environments by allowing fine-grained protection based on data sensitivity and trust levels.
• Current commercial and academic systems often require user-defined confidentiality levels and do not scale well beyond dozens of fragments.
• The use of bare-metal clouds enables physical control over data placement, reducing risks associated with virtualization and multi-tenancy.
• Fragmentation for security increases system latency, but this can be mitigated through parallel processing and optimized fragment distribution.
• A multi-level architecture—placing ultra-confidential data in trusted zones, confidential data in bare-metal clouds, and non-confidential data in public clouds—can minimize storage costs while maximizing security.