Data distributed storage method and system based on secret sharing technology

Abstract

The present invention discloses a data distributed storage method and system based on secret sharing technology, which belongs to the field of data storage technology. The technical problem to be solved is how to realize the security and privacy of data in distributed storage based on secret sharing technology. The method includes: dividing the original data into multiple data blocks, encrypting the data blocks by symmetric keys; dividing the symmetric key into multiple key fragments based on the Shamir threshold scheme, and distributing and storing the multiple key fragments to multiple different nodes; dividing the encrypted data block into multiple data fragments based on the Shamir threshold scheme, and distributing and storing the multiple data fragments to multiple different nodes; reconstructing the symmetric key based on the key fragments collected by the Shamir threshold scheme, reconstructing the encrypted data block by collecting a predetermined number of data fragments based on the Shamir threshold scheme, and decrypting the reconstructed encrypted data block based on the reconstructed symmetric key to restore the data block.

Description

Technical Field

[0001] The present invention relates to the technical field of data storage, and in particular to a data distributed storage method and system based on secret sharing technology. Background Art

[0002] With the widespread application of distributed storage technology, the security and privacy of data storage are becoming increasingly important. Traditional distributed storage systems usually use block encryption to protect data security, but if some storage nodes are attacked or leaked, there may still be a risk of data privacy exposure. In order to enhance storage security, secret sharing technology can be further used to re-encrypt encrypted data to ensure that even if some storage nodes fail or are attacked, attackers still cannot restore the complete data.

[0003] How to achieve the security and privacy of data in distributed storage based on secret sharing technology is a technical problem that needs to be solved. Summary of the invention

[0004] The technical task of the present invention is to address the above shortcomings and provide a data distributed storage method and system based on secret sharing technology to solve the technical problem of how to achieve the security and privacy of data in distributed storage based on secret sharing technology.

[0005] In a first aspect, the present invention provides a data distributed storage method based on secret sharing technology, comprising the following steps:

[0006] Data block division: divide the original data into multiple data blocks, and encrypt each data block using a symmetric key to generate an encrypted data block;

[0007] Secret key sharing: split the symmetric key into multiple key fragments based on Shamir threshold scheme, and store the multiple key fragments in a distributed manner on multiple different nodes;

[0008] Data secret sharing: For each encrypted data block, the encrypted data block is divided into multiple data slices based on the Shamir threshold scheme, and the multiple data slices are distributed and stored in multiple different nodes, where the data slices and key slices can be distributed on different nodes or on the same node;

[0009] Data recovery: For symmetric keys, a predetermined number of key shards are collected based on the Shamir threshold scheme, and the symmetric key is reconstructed based on the collected key shards to obtain a reconstructed symmetric key. For each encrypted data block, a predetermined number of data shards are collected based on the Shamir threshold scheme, and the encrypted data block is reconstructed based on the collected data shards to obtain a reconstructed encrypted data block. The reconstructed encrypted data block is decrypted based on the reconstructed symmetric key to restore the original data block.

[0010] As a preferred method, when the key is secretly shared, the symmetric key is divided into key shards, The key shards are distributed and stored in different nodes, and it is required to collect at least Reconstruct and recover the symmetric key using key shards;

[0011] Correspondingly, when recovering data, the Shamir threshold scheme is used to recover data from at least The key shards are collected on nodes, based on at least The key is sharded and the symmetric key is reconstructed by Lagrange difference method. The calculation formula of symmetric key reconstruction is as follows:

[0012] ;

[0013] in, and Both represent the key shard number. Indicates key shards, Represents the reconstructed symmetric key.

[0014] As a preferred method, when sharing data secrets, the encrypted data blocks are divided into data shards, Data is distributed and stored in different nodes, and it is required to collect at least Reconstruct and restore the encrypted data block using key fragments;

[0015] Correspondingly, when recovering data, the Shamir threshold scheme is used to recover data from at least The data is collected on the nodes, based on at least The encrypted data blocks are reconstructed by Lagrange difference method. The calculation formula for reconstructing the encrypted data blocks is as follows:

[0016] ;

[0017] in, and Both represent the data shard number. Indicates Encrypted data blocks The corresponding Data shards, Represents a reconstructed encrypted data block.

[0018] Preferably, when data is divided into blocks, the data blocks are encrypted based on a symmetric key using an AES encryption algorithm to generate encrypted data blocks.

[0019] In a second aspect, the present invention provides a data distributed storage system based on secret sharing technology, which is used to implement data distributed storage through a data distributed storage method based on secret sharing technology as described in any one of the first aspects, wherein the system includes a data block module, a key secret sharing module, a data secret sharing module, and a data recovery module;

[0020] The data block module is used to perform the following: divide the original data into multiple data blocks, and for each data block, encrypt the data block by using a symmetric key to generate an encrypted data block;

[0021] The key secret sharing module is used to perform the following: split the symmetric key into multiple key fragments based on the Shamir threshold scheme, and store the multiple key fragments in a distributed manner to multiple different nodes;

[0022] The data secret sharing module is used to perform the following: for each encrypted data block, split the encrypted data block into multiple data slices based on the Shamir threshold scheme, and store the multiple data slices in a distributed manner to multiple different nodes, wherein the data slices and the key slices can be distributed on different nodes or on the same node;

[0023] The data recovery module is used to perform the following: for a symmetric key, a predetermined number of key fragments are collected based on the Shamir threshold scheme, and the symmetric key is reconstructed based on the collected key fragments to obtain a reconstructed symmetric key; for each encrypted data block, a predetermined number of data fragments are collected based on the Shamir threshold scheme, and the encrypted data block is reconstructed based on the collected data fragments to obtain a reconstructed encrypted data block; and the reconstructed encrypted data block is decrypted based on the reconstructed symmetric key to recover the original data block.

[0024] Preferably, the key secret sharing module is used to split the symmetric key into key shards, The key shards are distributed and stored in different nodes, and it is required to collect at least Reconstruct and recover the symmetric key using key shards;

[0025] Correspondingly, the data recovery module is used to recover at least The key shards are collected on nodes, based on at least The key is sharded and the symmetric key is reconstructed by Lagrange difference method. The calculation formula of symmetric key reconstruction is as follows:

[0026] ;

[0027] in, and Both represent the key shard number. Indicates key shards, Represents the reconstructed symmetric key.

[0028] As a preferred embodiment, the data secret sharing module is used to divide the encrypted data block into data shards, Data is distributed and stored in different nodes, and it is required to collect at least Reconstruct and restore the encrypted data block using key fragments;

[0029] Correspondingly, the data recovery module is used to recover at least The data is collected on the nodes, based on at least The encrypted data blocks are reconstructed by Lagrange difference method. The calculation formula for reconstructing the encrypted data blocks is as follows:

[0030] ;

[0031] in, and Both represent the data shard number. Indicates Encrypted data blocks The corresponding Data shards, Represents a reconstructed encrypted data block.

[0032] Preferably, the data block module is used to encrypt the data block based on the symmetric key through the AES encryption algorithm to generate an encrypted data block.

[0033] The data distributed storage method and system based on secret sharing technology of the present invention have the following advantages:

[0034] 1. Enhanced data privacy protection: Through secret sharing technology, secondary encryption is performed. Even if some storage nodes are attacked or leaked, the attacker cannot recover the complete data, which greatly improves storage security;

[0035] 2. Improve anti-attack capabilities: Even if some storage nodes fail or are attacked, data can still be restored through the remaining valid node fragments, which enhances the fault tolerance of the system;

[0036] 3. Balance between security and performance: Block encryption and secret sharing technology are used to ensure data security without significantly increasing storage and computing overhead, making it suitable for large-scale distributed storage scenarios;

[0037] 4. No centralized dependency: It uses distributed storage and secret sharing technology, does not rely on a single centralized service, and prevents centralized nodes from becoming a single point of failure. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] The present invention is further described below in conjunction with the accompanying drawings.

[0040] Figure 1 This is a flowchart of a data distributed storage method based on secret sharing technology in Example 1. DETAILED DESCRIPTION

[0041] The present invention is further described below in conjunction with the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments may be combined with each other.

[0042] The embodiments of the present invention provide a data distributed storage method and system based on secret sharing technology, which are used to solve the technical problem of how to achieve the security and privacy of data in distributed storage based on secret sharing technology.

[0043] Embodiment 1:

[0044] The invention discloses a data distributed storage method based on secret sharing technology, which comprises four steps of data segmentation, key secret analysis, data secret analysis and data recovery.

[0045] Step S100: Data segmentation: The original data is divided into a plurality of data blocks. For each data block, the data block is encrypted by a symmetric key to generate an encrypted data block.

[0046] As a specific implementation of data segmentation, the data block is encrypted by an AES encryption algorithm based on a symmetric key to generate an encrypted data block.

[0047] Step S200: Secret key sharing: based on the Shamir threshold scheme, the symmetric key is divided into multiple key fragments, and the multiple key fragments are distributed and stored in multiple different nodes.

[0048] As a specific implementation of key secret analysis, when the key secret is shared, the symmetric key is divided into key shards, The key shards are distributed and stored in different nodes, and it is required to collect at least The symmetric key is reconstructed and restored using key shards.

[0049] Step S300: Data secret sharing: For each encrypted data block, the encrypted data block is divided into multiple data slices based on the Shamir threshold scheme, and the multiple data slices are distributed and stored in multiple different nodes, wherein the data slices and key slices can be distributed on different nodes or on the same node.

[0050] As a specific implementation of data secret sharing, the encrypted data block is divided into data shards, Data is distributed and stored in different nodes, and it is required to collect at least The encrypted data block is reconstructed and restored using the key fragments.

[0051] Step S400 data recovery: for the symmetric key, a predetermined number of key fragments are collected based on the Shamir threshold scheme, and the symmetric key is reconstructed based on the collected key fragments to obtain a reconstructed symmetric key. For each encrypted data block, a predetermined number of data fragments are collected based on the Shamir threshold scheme, and the encrypted data block is reconstructed based on the collected data fragments to obtain a reconstructed encrypted data block. The reconstructed encrypted data block is decrypted based on the reconstructed symmetric key to restore the original data block.

[0052] As a specific implementation of data recovery, first, based on the Shamir threshold scheme, from at least The key shards are collected on nodes, based on at least The key is sharded and the symmetric key is reconstructed by Lagrange difference method. The calculation formula of symmetric key reconstruction is as follows:

[0053] ;

[0054] in, and Both represent the key shard number. Indicates key shards, Represents the reconstructed symmetric key.

[0055] Secondly, based on Shamir threshold scheme, from at least The data is collected on the nodes, based on at least The encrypted data blocks are reconstructed by Lagrange difference method. The calculation formula for reconstructing the encrypted data blocks is as follows:

[0056] ;

[0057] in, and Both represent the data shard number. Indicates Encrypted data blocks The corresponding Data shards, Represents a reconstructed encrypted data block.

[0058] Finally, the reconstructed encrypted data block is decrypted using the reconstructed symmetric key to restore the data block. The calculation formula is as follows:

[0059] ;

[0060] Indicates recovery data blocks, Represents the decryption function.

[0061] The method of this embodiment performs secondary encryption on the data by combining the block encryption mechanism of distributed storage with the privacy computing method of secret sharing technology to ensure the security and privacy of the data in distributed storage. This method not only improves the basic storage security by encrypting the data in blocks, but also encrypts the encrypted data blocks again in combination with secret sharing technology to ensure that the data still has a high degree of security and privacy even when some storage nodes fail or are attacked.

[0062] Embodiment 2:

[0063] The present invention discloses a data distributed storage system based on secret sharing technology, comprising a data block module, a key secret sharing module, a data secret sharing module and a data recovery module.

[0064] The data block module is used to perform the following: divide the original data into multiple data blocks, and for each data block, encrypt the data block by using a symmetric key to generate an encrypted data block.

[0065] As a specific implementation of the data block module, the module is used to encrypt the data block based on the symmetric key through the AES encryption algorithm to generate an encrypted data block.

[0066] The key secret sharing module is used to perform the following: split the symmetric key into multiple key fragments based on the Shamir threshold scheme, and distribute and store the multiple key fragments to multiple different nodes.

[0067] As a specific implementation of the key secret sharing module, when the key secret is shared, the module is used to split the symmetric key into key shards, The key shards are distributed and stored in different nodes, and it is required to collect at least The symmetric key is reconstructed and restored using key shards.

[0068] The data secret sharing module is used to perform the following: for each encrypted data block, the encrypted data block is divided into multiple data fragments based on the Shamir threshold scheme, and the multiple data fragments are distributed and stored in multiple different nodes, wherein the data fragments and the key fragments can be distributed on different nodes or on the same node.

[0069] As a specific implementation of data secret sharing, this module is used to split the encrypted data block into data shards, Data is distributed and stored in different nodes, and it is required to collect at least The encrypted data block is reconstructed and restored using the key fragments.

[0070] The data recovery module is used to perform the following: for a symmetric key, a predetermined number of key fragments are collected based on the Shamir threshold scheme, and the symmetric key is reconstructed based on the collected key fragments to obtain a reconstructed symmetric key; for each encrypted data block, a predetermined number of data fragments are collected based on the Shamir threshold scheme, and the encrypted data block is reconstructed based on the collected data fragments to obtain a reconstructed encrypted data block; and the reconstructed encrypted data block is decrypted based on the reconstructed symmetric key to recover the original data block.

[0071] As a specific implementation of the data recovery module, first, the module performs the following operations: based on the Shamir threshold scheme, from at least The key shards are collected on nodes, based on at least The key is sharded and the symmetric key is reconstructed by Lagrange difference method. The calculation formula of symmetric key reconstruction is as follows:

[0072] ;

[0073] in, and Both represent the key shard number. Indicates key shards, Represents the reconstructed symmetric key.

[0074] Secondly, this module is used to perform the following operations: based on the Shamir threshold scheme from at least The data is collected on the nodes, based on at least The encrypted data blocks are reconstructed by Lagrange difference method. The calculation formula for reconstructing the encrypted data blocks is as follows:

[0075] ;

[0076] in, and Both represent the data shard number. Indicates Encrypted data blocks The corresponding Data shards, Represents a reconstructed encrypted data block.

[0077] Finally, this module is used to decrypt the reconstructed encrypted data block using the reconstructed symmetric key to recover the data block. The calculation formula is as follows:

[0078] ;

[0079] Indicates recovery data blocks, Represents the decryption function.

[0080] The system of this embodiment can execute the method disclosed in Example 1 to realize data distributed storage.

[0081] The present invention has been shown and described in detail above through the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art can know that the means in the above different embodiments can be combined to obtain more embodiments of the present invention, and these embodiments are also within the protection scope of the present invention.

Claims

1. A data distributed storage method based on secret sharing technology, characterized in that: The steps include: Data block division: divide the original data into multiple data blocks. For each data block, encrypt the data block based on the symmetric key and the AES encryption algorithm to generate an encrypted data block. Secret key sharing: Based on the Shamir threshold scheme, the symmetric key is divided into N key shards, and the N key shards are distributed and stored in N different nodes, and it is required to collect at least M key shards to reconstruct and recover the symmetric key; Data secret sharing: For each encrypted data block, the encrypted data block is divided into T data shards based on the Shamir threshold scheme, and the T data shards are distributed and stored on T different nodes, and it is required to collect at least t key shards to reconstruct and restore the encrypted data block, where the data shards and key shards can be distributed on different nodes or on the same node; Data recovery: For a symmetric key, key shards are collected from at least M nodes based on the Shamir threshold scheme, and the symmetric key is reconstructed by the Lagrange difference method based on the collected at least M key shards to obtain a reconstructed symmetric key. For each encrypted data block, data shards are collected from at least a nodes based on the Shamir threshold scheme, and the encrypted data block is reconstructed by the Lagrange difference method based on the collected at least t data shards to obtain a reconstructed encrypted data block. The reconstructed encrypted data block is decrypted based on the reconstructed symmetric key to recover the original data block. The calculation formula for symmetric key reconstruction is as follows: Where m and j represent the key shard numbers, K j represents the jth key shard, K1 represents the reconstructed symmetric key; The calculation formula for reconstructing the encrypted data block is as follows: Where m and j represent the numbers of data fragments, F ij Represents the i-th encrypted data block E i The corresponding j-th data shard, E1 i Represents a reconstructed encrypted data block.

2. A data distributed storage system based on secret sharing technology, characterized in that: Used to implement data distributed storage through a data distributed storage method based on secret sharing technology as claimed in claim 1, the system includes a data block module, a key secret sharing module, a data secret sharing module and a data recovery module; The data block module is used to perform the following: divide the original data into multiple data blocks, and for each data block, encrypt the data block based on the symmetric key and the AES encryption algorithm to generate an encrypted data block; The key secret sharing module is used to perform the following: split the symmetric key into N key fragments based on the Shamir threshold scheme, distribute and store the N key fragments to N different nodes, and limit the need to collect at least M key fragments to reconstruct and recover the symmetric key; The data secret sharing module is used to perform the following: for each encrypted data block, the encrypted data block is divided into T data slices based on the Shamir threshold scheme, the T data slices are distributed and stored in T different nodes, and it is required to collect at least t key slices to reconstruct and recover the encrypted data block, wherein the data slices and the key slices can be distributed on different nodes or on the same node; The data recovery module is used to perform the following: for a symmetric key, based on the Shamir threshold scheme, key fragments are collected from at least M nodes, based on the collected at least M key fragments, the symmetric key is reconstructed by the Lagrange difference method to obtain a reconstructed symmetric key, for each encrypted data block, based on the Shamir threshold scheme, data fragments are collected from at least a nodes, based on the Shamir threshold scheme, the encrypted data block is reconstructed by the Lagrange difference method based on the collected at least t data fragments, to obtain a reconstructed encrypted data block, and the reconstructed encrypted data block is decrypted based on the reconstructed symmetric key to recover the original data block; The calculation formula for symmetric key reconstruction is as follows: Where m and j represent the key shard numbers, K j represents the jth key shard, K1 represents the reconstructed symmetric key; The calculation formula for reconstructing the encrypted data block is as follows: Where m and j represent the numbers of data fragments, F ij Represents the i-th encrypted data block E i The corresponding j-th data shard, E1 i Represents a reconstructed encrypted data block.

Images