Dual encrypted data streams in distributed systems

A non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing operation of a distributed system, the operations comprising:

• obtaining, by a client processing system of the distributed system and from a network security system of the distributed system, a potentially partially encrypted data stream originating from a data processing system of the distributed system, the network security system having access to a first decryption key to secure a potentially dual encrypted data stream;
• making, by the client processing system, a first determination regarding whether the potentially partially encrypted data stream comprises at least one portion of encrypted sensitive data;
• in a first instance of the first determination where the potentially partially encrypted data stream comprises the at least one portion of the encrypted sensitive data:
• decrypting, by the client processing system and using a second decryption key, the at least one portion of the encrypted sensitive data to obtain at least one portion of sensitive data;
• regenerating, by the client processing system, original content on which the potentially dual encrypted data stream is based using the potentially partially encrypted data stream and the at least one portion of the sensitive data;
• providing computer implemented services using the original content;
• in a second instance of the first determination where the potentially partially encrypted data stream does not comprise any encrypted sensitive data:
• concluding that the potentially partially encrypted data stream is the original content;
• and
• providing computer implemented services using the original content.

A system, comprising:

• a processor;
• and
• a memory coupled to the processor to store instructions, which when executed by the processor, cause the processor to perform operations for managing operation of a distributed system, the operations comprising:
• obtaining, by a client processing system of the distributed system and from a network security system of the distributed system, a potentially partially encrypted data stream originating from a data processing system of the distributed system, the network security system having access to a first decryption key to secure a potentially dual encrypted data stream;
• making, by the client processing system, a first determination regarding whether the potentially partially encrypted data stream comprises at least one portion of encrypted sensitive data;
• in a first instance of the first determination where the potentially partially encrypted data stream comprises the at least one portion of the encrypted sensitive data:
• decrypting, by the client processing system and using a second decryption key, the at least one portion of the encrypted sensitive data to obtain at least one portion of sensitive data;
• regenerating, by the client processing system, original content on which the potentially dual encrypted data stream is based using the potentially partially encrypted data stream and the at least one portion of the sensitive data;
• providing computer implemented services using the original content;
• in a second instance of the first determination where the potentially partially encrypted data stream does not comprise any encrypted sensitive data:
• concluding that the potentially partially encrypted data stream is the original content;
• and
• providing computer implemented services using the original content.