The Datalake on the Desktop
Shown on Tessera Desktop with fictional exercise documents. The Windows drive offers the same functions in File Explorer.
Tessera Datalake
One store for protected documents, held at several sites and replicated between them. It keeps working when links are denied, degraded or intermittent. The storage never holds a readable copy and never holds a key.
A coalition or a distributed organisation needs one place for its documents that every site can reach. Placing that store with one partner gives that partner control of the data. Tessera Datalake avoids this: each document is sealed before it is stored, so the storage operator holds only encrypted objects.
Storage nodes run at different sites and replicate documents between them. A document written at one site can be read at another. Each node can be limited to the classifications its site is accredited for, and objects above that level are not stored there.
Access is not decided by the storage. Every read of a document needs its key, and the key is released by a key access service only after it has checked the reader's clearance against the document's label at that moment.
On Windows the datalake is a drive in File Explorer. On Linux it is a folder in the file manager. Users open, save and organise documents with the tools they already use.
Every document the user may see is listed. Its content is fetched when it is first opened. Mark a document to keep it on the device, or free up space to return it to online only.
Storage nodes at different sites exchange documents with each other, so a document written at one site can be read at another (see degraded networks).
A storage node accepts only sealed, labelled documents. An attempt to store a plaintext file is refused, so nothing readable reaches the store by mistake.
Each storage node belongs to a zone with a ceiling. The replication policy keeps documents above that ceiling off the node (see policy-driven replication).
Every key release and every refusal is recorded centrally, with the user, the document and the label. The record covers all sites.
Where a document may be stored is decided by a policy, not by the person who saves it. Each storage node applies the policy to the document's own metadata before it accepts or replicates the document.
The policy reads the metadata bound to the document (ADatP-5636 and ADatP-4774): its classification, releasability, categories, format and origin. Two documents with the same metadata replicate the same way.
The replication rules are written in Rego, the policy language of Open Policy Agent. Every node evaluates the same rules, and a rule the zone limits cannot express, such as a size limit, is added to the policy.
The policy travels to every node in a signed bundle, together with the zone of each node. A change takes effect only after a second administrator approves it.
Forward sites work on networks that are denied, disrupted, intermittent or limited (DDIL). The protection is in each document, so the datalake needs a link only for the operations that cannot work without one.
The security policy and the sealing are local to the user. A command post with no link to any other site classifies and seals documents as normal, and the author's signature records who applied the marking.
Each document names several key access services at different sites. When the nearest one is unreachable, another releases the key, and the access decision is the same. Nothing has to be reconfigured at the site that lost its service.
A site cut off from the others keeps serving and storing the documents it holds. When the link returns, the sites exchange what changed while they were apart.
Replication is prioritised by the kind of document. On a congested link, essential items such as revocation lists travel before bulk content, and documents meant to stay at a site never leave it.
When the site that holds write authority is lost, another site can take it over. The takeover needs confirmation from a majority of the remaining sites, so no single compromised host can claim it.
Access is decided at every open, so withdrawing a clearance takes effect at the next attempt, at every site. A deleted document is removed from sites that were offline as soon as they reconnect.
Shown on Tessera Desktop with fictional exercise documents. The Windows drive offers the same functions in File Explorer.
Standards implemented in Tessera Datalake
ADatP-5674 ADatP-4774 ADatP-4778 ADatP-5663 XMLSPIF v2.1/v3.0