ARCHITECTURAL APPROACHES TO BIG DATA PROTECTION IN DISTRIBUTED DIGITAL SERVICES

1Department of Information Protection This paper proposes SecureMesh – a five–plane reference architecture for big data protection in distributed digital services that combines data–centric security (classification and tagging, tokenization, format–preserving and field–level encryption, masking), privacy–preserving computation (differential privacy, homomorphic encryption, federated learning, trusted execution environments), and a zero–trust model with attribute–based access control at the service–mesh level. The architecture overcomes the limitations of traditional perimeter–based approaches, which fail to protect data during processing and do not account for its heterogeneous sensitivity. Its key element is an adaptive, risk–oriented mechanism that maps the data sensitivity class to a minimally sufficient set of controls. The approach is validated by a prototype based on Kubernetes, Istio, Apache Spark, Kafka, and Delta Lake across three scenarios – medical data protection, financial fraud detection, and telecom–IoT stream analytics. Compared with an unprotected data lake and a centralized database, SecureMesh increased the integral confidentiality level to 91% (versus 38–55% in the baseline configurations), access control to 94%, and traceability to 96%, with only an 11% rise in access latency and 17% in computation cost, confirming the architecture's practical applicability at an acceptable overhead level.