Data protection using portable data structures

A computer system comprising:

• a memory;
• and
• a processor in communication with the memory, wherein the computer system is configured to perform a method comprising:
• packaging a plurality of ciphertext blocks into a plurality of portable data structures, the plurality of ciphertext blocks produced based on encryption of a plurality of plaintext blocks according to a block encryption mode that comprises dependencies between cryptographic processing of the plurality of plaintext blocks, the dependencies comprising decryption of a first ciphertext block of the plurality of ciphertext blocks being dependent on a second ciphertext block of the plurality of ciphertext blocks or decryption processing of the second ciphertext block, wherein the packaging comprises including, for each ciphertext block, of the plurality of ciphertext blocks, having a direct dependency on another ciphertext block, an associated dependency label in the portable data structure in which the ciphertext block is packaged, the dependency label indicating the another ciphertext block, and wherein the portable data structure in which the ciphertext block is packaged includes a respective sequence number associated with the ciphertext block;
• distributing the plurality of portable data structures to a plurality of nodes such that separation is provided between portable data structures, of the plurality of portable data structures, that package ciphertext blocks between which there exists direct dependencies indicated by the dependency labels included in the portable data structures, wherein at least one direct dependency as indicated by a dependency label exists between one ciphertext block packaged in one portable data structure of the plurality of portable data structures and another ciphertext block packaged into another portable data structure of the plurality of portable data structures, and wherein, based on the at least one direct dependency, the distributing distributes the one portable data structure to one node of the plurality of nodes and distributes the another portable data structure to another node, of the plurality of nodes, that is different from the one node, and storage of the one portable data structure and the another portable data structure on a same node of the plurality of nodes is avoided on account of the at least one direct dependency;
• and
• in response to a request to decrypt the plurality of ciphertext blocks:
• decrypting the plurality of ciphertext blocks to obtain decrypted data blocks;
• and
• assembling the decrypted data blocks to obtain a plaintext data message, the assembling being performed based on the respective sequence numbers associated with the plurality of ciphertext blocks.

A computer program product comprising:

• a non-transitory computer readable storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising:
• packaging a plurality of ciphertext blocks into a plurality of portable data structures, the plurality of ciphertext blocks produced based on encryption of a plurality of plaintext blocks according to a block encryption mode that comprises dependencies between cryptographic processing of the plurality of plaintext blocks, the dependencies comprising decryption of a first ciphertext block of the plurality of ciphertext blocks being dependent on a second ciphertext block of the plurality of ciphertext blocks or decryption processing of the second ciphertext block, wherein the packaging comprises including, for each ciphertext block, of the plurality of ciphertext blocks, having a direct dependency on another ciphertext block, an associated dependency label in the portable data structure in which the ciphertext block is packaged, the dependency label indicating the another ciphertext block, and wherein the portable data structure in which the ciphertext block is packaged includes a respective sequence number associated with the ciphertext block;
• distributing the plurality of portable data structures to a plurality of nodes such that separation is provided between portable data structures, of the plurality of portable data structures, that package ciphertext blocks between which there exists direct dependencies indicated by the dependency labels included in the portable data structures, wherein at least one direct dependency as indicated by a dependency label exists between one ciphertext block packaged in one portable data structure of the plurality of portable data structures and another ciphertext block packaged into another portable data structure of the plurality of portable data structures, and wherein, based on the at least one direct dependency, the distributing distributes the one portable data structure to one node of the plurality of nodes and distributes the another portable data structure to another node, of the plurality of nodes, that is different from the one node, and storage of the one portable data structure and the another portable data structure on a same node of the plurality of nodes is avoided on account of the at least one direct dependency;
• and
• in response to a request to decrypt the plurality of ciphertext blocks:
• decrypting the plurality of ciphertext blocks to obtain decrypted data blocks;
• and
• assembling the decrypted data blocks to obtain a plaintext data message, the assembling being performed based on the respective sequence numbers associated with the plurality of ciphertext blocks.