Encryption for distributed storage and processing

A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more computing devices effectuates operations comprising:

• obtaining a cluster of computing nodes in a distributed storage and processing application, each computing node corresponding to one of a plurality of network hosts executing on a plurality of computing devices and with which the distributed storage and processing application is executed, wherein:
• the cluster stores a plurality of ciphertexts each redundantly stored on two or more of the plurality of computing devices,
• the ciphertexts are obtained by the distributed storage and processing application encrypted with a data-owner encryption key of a data owner that caused data in the ciphertexts to be loaded to the distributed storage and processing application, and
• the plurality of ciphertexts belong to at least part of a data set upon which a MapReduce job is being performed by the distributed storage and processing application;
• accessing a transformation key with a first computing node among the cluster of nodes in the distributed storage and processing application;
• transforming the ciphertext with the first computing node based on the transformation key into a transformed ciphertext configured to be decrypted with a temporary access key;
• accessing the transformed ciphertext and the temporary access key with a second computing node among the cluster of nodes in the distributed storage and processing application;
• decrypting the transformed ciphertext with the second computing node based on the temporary access key to obtain plaintext data;
• and
• performing a mapping task or a reducing task with the second computing node on the plaintext data;
• and
• storing a result of the mapping task or the reducing task in memory.