Features / Distributed storage
No single machine holds a whole file, and losing a site loses nothing.
Each sealed file is encrypted again with its own key, cut into five shards and spread over certified storage nodes. Any three of them rebuild it. No node ever sees plaintext.
3 of 5
shards are enough to rebuild a file
0
plaintext on any storage node
1 site
can be lost without losing a file
How it works
Split, certify, repair
1
Split
Erasure coding turns each file into five encrypted shards, with no more of them in one zone than the file can lose.
2
Certify
Nodes and PCs carry certificates from the grid administrator. A node answers nothing to an uncertified peer and serves a file only up to the requester's clearance.
- Every shard's hash is checked on arrival
3
Repair
Lost shards are rebuilt from ciphertext, without the key. Revoked keys spread from peer to peer.
Proven, and what is not
What is tested, and what is trusted
Tested
Tested on real machines
- A certified grid on one machine, in every build
- Packaged services on two machines
- A node refuses levels above its own clearance
Trusted, not proved
Tested and listed openly
- The grid administrator's key is a file, not yet a hardware token
- A revoked peer keeps access until the list reaches the nodes it talks to
- Nodes do not yet limit how often a certified peer asks