A high-efficiency storage distributed secret sharing method, system and storage medium

Abstract

The application relates to the technical field of privacy computing, and discloses a high-efficiency storage distributed secret sharing method, a system and a storage medium, which comprise the following steps: determining shares in storage nodes in advance; determining a storage node authorized access subset of a user; constructing a linear secret sharing equation and calculating and publishing an auxiliary secret recovery parameter through an extended Euclidean algorithm; a user downloads corresponding shares according to the storage nodes of the authorized access set and combines the public parameters to recover secret data; and dynamically expanding the storage nodes to support the demand of new users. Through the balanced storage uploading and dynamic expansion mechanism, the application improves the scalability and storage efficiency of the distributed secret sharing system, avoids delay inconsistency and node failure risks caused by uneven share storage, enhances the security of the system, ensures that the user can only access the authorized nodes, effectively prevents data leakage, and provides a more reliable and flexible secret sharing environment.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy computing, in particular to a high-efficiency storage distributed secret sharing method, system and storage medium. BACKGROUND

[0002] In today's Internet era, distributed systems have become an important support for cloud computing, big data analysis and artificial intelligence due to their advantages in improving business continuity and optimizing resource utilization. However, distributed systems face challenges in data security. Data is stored in multiple nodes, which may become a security risk point. Attackers can access sensitive information without authorization through unencrypted communication or weak identity verification, causing significant losses.

[0003] Existing distributed secret sharing schemes can effectively prevent data leakage and ensure that sensitive information is only visible to authorized users. This scheme uses data encoding and distribution mechanisms to ensure that even if some nodes are attacked or fail, secret information can still be protected, thereby having strong fault tolerance and attack resistance, and being widely used in finance, government and blockchain fields.

[0004] However, existing distributed secret sharing methods usually require data distributors to encode secret data into multiple shares and upload them. As the amount of data increases, the number of shares that storage nodes need to store increases, which not only leads to complex system structure and difficulty in expansion, but also causes inconsistent delays between different nodes due to uneven storage, increasing the risk of node failure. SUMMARY

[0005] To overcome the shortcomings of the prior art, the present application provides a high-efficiency storage distributed secret sharing method, system and storage medium, which solves the problems of large data storage overhead, uneven data storage, complex system structure and difficulty in expansion in the prior art.

[0006] To achieve the above purpose, the present application is implemented by the following technical scheme: a high-efficiency storage distributed secret sharing method, comprising the following steps:

[0007] Pre-determine the share in the storage node;

[0008] Determine the authorized access subset of the storage node of the user;

[0009] Construct a linear secret sharing equation, calculate and disclose an auxiliary secret recovery parameter;

[0010] The user downloads the corresponding share according to the storage node of the authorized access set, and recovers the secret data through the calculated public parameter;

[0011] Dynamically expand the storage node to support the needs of new users.

[0012] Preferably, initializing the share allocation of storage nodes comprises:

[0013] The distributor randomly selects n coprime shares;

[0014] Upload the shares to n storage nodes, ensuring that each node stores a unique share.

[0015] Preferably, determining the authorized access subset of a user's storage nodes comprises:

[0016] Using Sperner's theorem to construct the authorized access subset of storage nodes for each user;

[0017] Ensure that the access set of each user does not overlap to prevent users from obtaining other users' secret data.

[0018] Preferably, constructing linear secret sharing equations comprises:

[0019] Constructing a corresponding linear equation for each user's secret data;

[0020] Taking the shares in the authorized access set of the user as the coefficients of the equation.

[0021] Preferably, calculating and publishing auxiliary secret recovery parameters comprises:

[0022] Using the extended Euclidean algorithm to calculate the auxiliary parameters;

[0023] Publish the calculated auxiliary parameters for access by all users.

[0024] Preferably, the user recovers the secret data according to the authorized access storage nodes comprises:

[0025] Download the share in the specified node;

[0026] Combine the public parameters to construct a linear secret sharing equation to recover the secret data.

[0027] Preferably, dynamically expanding storage nodes further comprises:

[0028] Implement load monitoring to monitor the load of existing storage nodes in real time to determine when to dynamically expand;

[0029] During the expansion process, maintain secure communication between the new storage nodes and the existing nodes to ensure the security of data sharing.

[0030] The present application also provides a high-efficiency storage distributed secret sharing system, comprising:

[0031] A secret data distributor for distributing storage node shares;

[0032] n storage nodes for storing the shares uploaded by the distributor;

[0033] m users, whose authorized access nodes download and recover the secret data.

[0034] Preferably, the secret data distributor comprises:

[0035] a module for generating and distributing unique shares, ensuring that each storage node only stores specific shares;

[0036] an authorization management module for dynamically updating and managing the authorized access subset of the user's storage nodes, ensuring the security and flexibility of the system when the user changes;

[0037] an automatic expansion module that can automatically expand new storage nodes and assign corresponding shares when the number of users exceeds the maximum carrying capacity of the current storage nodes, to maintain the efficient operation of the system.

[0038] The present application also provides a high-efficiency storage distributed secret sharing storage medium, comprising:

[0039] a plurality of storage nodes, each node for storing the shares uploaded by the distributor, and having a data integrity check function to prevent data tampering;

[0040] an authorization management module for controlling user access to each storage node and implementing dynamic updates to adapt to user changes;

[0041] an auxiliary parameter storage unit for storing the calculated auxiliary secret recovery parameters to facilitate user invocation during the recovery process;

[0042] a load monitoring module that monitors the load of each storage node in real time and triggers a dynamic expansion mechanism to increase new storage nodes when the load exceeds a set threshold, to maintain efficient storage and access performance.

[0043] The present application provides a high-efficiency storage distributed secret sharing method, system and storage medium.

[0044] Has the following beneficial effects:

[0045] 1、The present application ensures that the system can maintain efficient storage and access performance when the number of users increases through dynamic expansion and load monitoring of the storage nodes. This flexibility not only improves the scalability of the system, but also enhances the user experience, allowing users to quickly and securely recover secret data.

[0046] 2、The present application combines the permission management module with the Sperner theorem, so that the access control of the user is more accurate and secure, each user can only access the authorized node, preventing the risk of data leakage, thereby enhancing the overall security of the system.

[0047] 3、The present application ensures that the data in the storage node is not tampered with through the data integrity verification function, improves the credibility of the data, and enhances the reliability of the system when processing sensitive data, providing a secure secret sharing environment for the user. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 The present application is a high-efficiency storage distributed secret sharing method model.

[0049] Figure 2 The present application is a method flowchart. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be described in detail below with reference to the drawings in the specification of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0051] Please refer to the drawings Figure 1 and the drawings Figure 2 The present application provides a high-efficiency storage distributed secret sharing method, system and storage medium, comprising the following steps:

[0052] The shares in the storage node are determined in advance, and the security and robustness of the system are enhanced through random allocation and redundancy design of the shares, ensuring that the data can still be recovered when the storage node fails;

[0053] The authorized access subset of the user's storage node is determined, and the system effectively prevents data leakage by accurately controlling the access rights, ensuring the security of each user's secret data;

[0054] The linear secret sharing equation is constructed, and the auxiliary secret recovery parameter is calculated and disclosed, the system not only optimizes the efficiency of data recovery, but also simplifies the operation steps of the user, making it more intuitive;

[0055] The auxiliary secret recovery parameter is calculated and disclosed, by disclosing the auxiliary recovery parameter, it does not occupy the memory of the storage node, simplifies the structure, reduces the storage cost and reduces the technical threshold of the user, so that the use of the system is more convenient, and the user experience is improved;

[0056] The user downloads the corresponding share according to the storage node of the authorized access set, and through the calculated public parameter, the user can quickly and efficiently recover the secret data through the simplified data recovery process, thereby improving the practicability and response speed of the system.

[0057] The dynamic expansion of the storage node supports the demand of the new user, through the dynamic expansion of the storage node, the system can flexibly adapt to the change of the user demand, guarantees the efficient storage and access performance, thereby enhances the scalability and flexibility of the system.

[0058] In a preferred embodiment of the present application, the share allocation of the initialization storage node comprises:

[0059] The distributor randomly selects n coprime shares;

[0060] Upload the share to the n storage nodes, ensure that each node stores a unique share of the share.

[0061] Specifically: the distributor first needs to randomly select n coprime shares to ensure that there is an auxiliary secret recovery parameter integer solution by accessing the linear secret sharing equation constructed by the coprime shares, and the uniqueness and effectiveness in data recovery, then the distributor will upload the selected shares to the n storage nodes according to the authorized access subset of each user, and upload to the n storage nodes according to certain rules. In the uploading process, the distributor needs to ensure that each storage node stores a unique share to achieve load balancing and avoid data redundancy, thereby enhancing the security and reliability of the data, so that in the case of node failure, the original data can still be recovered through other nodes, reducing the risk of data loss, and through the selection and uniform distribution of coprime shares, the security, recovery efficiency and stability of the system are improved, so that users can enjoy efficient and reliable secret sharing services in the use process.

[0062] In a preferred embodiment of the present application, the determination of the authorized access subset of the user's storage node comprises:

[0063] Use Sperner theorem to construct the authorized access subset of the storage node for each user;

[0064] Ensure that the access set of each user does not overlap to prevent users from obtaining the secret data of other users.

[0065] Specifically: Sperner theorem is an important theorem in combinatorics, which describes the maximum size of a subset of a set under certain conditions; through this theory, the distributor can effectively construct the access set of each user, so that it contains the most storage nodes under the condition of fixed storage nodes, and does not cause information leakage; first, all storage nodes are numbered, and these nodes are organized into a hierarchy, then, according to the demand and authority of each user, the distributor selects the appropriate subset by using Sperner theorem, ensures that the share in these nodes is necessary for each user to restore its own secret while not leaking the information of other user secrets, the authorized access set of each user is designed to be independent and non-overlapping, thereby ensuring the privacy and data security between users.

[0066] In a preferred embodiment of the present application, constructing linear secret sharing equations comprises:

[0067] Constructing a corresponding linear equation for the secret data of each user;

[0068] Taking the shares in the authorized access set of the user as the coefficients of the equation.

[0069] In a preferred embodiment of the present application, calculating and disclosing auxiliary secret recovery parameters comprises:

[0070] Using the extended Euclidean algorithm to calculate the auxiliary parameters;

[0071] Disclosing the calculated auxiliary parameters for access by all users.

[0072] Specifically: for the secret data of each user, the distributor first constructs a multivariate linear polynomial, the number of multivariate variables of the function is determined by the threshold required for secret recovery, for example, if it is desired to recover the secret data in at least k shares, a k-univariate linear polynomial can be used, after determining the polynomial, the distributor will select the corresponding shares from the authorized access set of the user as the coefficients of the equation. Specifically, since the distributor knows the secret s i and the shares in the access set A i ={x1,...,x k}, the equation can be constructed as follows:

[0073]

[0074] where i∈{1,...,m} represents the i-th user, represents the k-th unknown parameter of the i-th user, since the shares x i ,i∈{1,..,k} are pairwise coprime, it is ensured that the equation has an integer solution The integer solution is calculated by the extended Euclidean algorithm.

[0075] In a preferred embodiment of the present application, the user recovers the secret data according to the authorized access of the storage node, which includes:

[0076] Downloading the share in the specified node;

[0077] Combining the public parameters to construct a linear secret sharing equation to recover the secret data.

[0078] Specifically: first, the extended Euclidean algorithm is used to calculate the auxiliary parameter, second, the calculated auxiliary parameter will be disclosed to allow all users to access, in this way, the user only needs to download the share in the access set of nodes and combine the public parameters to recover the data when recovering the secret data;

[0079] When recovery is needed, user i downloads all shares A i = {x1,...,x k} of the secret recovery through the authorized access set of nodes, and then the user constructs a respective linear secret sharing equation according to the collected shares and public auxiliary parameters:

[0080]

[0081] to recover their own secret data s i Since the selection of shares is random and the combination of k shares is unique, it is guaranteed that each user can download a unique combination of k shares through their own authorized access set, and the secret that can be recovered is also unique, which ensures the convenience and effectiveness of the user in data recovery.

[0082] In a preferred embodiment of the present application, the dynamic expansion of the storage node further includes:

[0083] Implement load monitoring to monitor the load of existing storage nodes in real time to determine when to dynamically expand;

[0084] In the expansion process, the access set for the new node is determined by the Sperner theorem and the secure communication between the new storage node and the existing node is maintained to ensure the security of data sharing.

[0085] Specifically: first, the user downloads the corresponding share from the authorized storage node, after the user logs in the system, the system will automatically identify the access permission of the storage node owned by the user according to the identity verification result, and then the user downloads the share stored in the corresponding node through network request, the share is generated based on the previous secret data distribution, and is usually stored in the form of encryption or coding, second, the user recovers the secret data by using the downloaded share and the previously disclosed auxiliary parameter, and combining the linear secret sharing equation; this process ensures that the user can effectively recover the complete secret information from multiple shares;

[0086] Meanwhile, the principle of recovering the secret data is mainly based on the linear secret sharing theory, in the distributed secret sharing, the secret data is divided into multiple shares, and the shares are distributed according to a certain linear relationship; the storage node stores part of the secret information. When the user needs to recover the secret, the user downloads these shares depending on the access permission.

[0087] The application also provides a high-efficiency storage distributed secret sharing system, comprising:

[0088] A secret data distributor for distributing the share of the storage node;

[0089] n storage nodes for storing the share uploaded by the distributor;

[0090] m users download and recover the secret data according to the authorized node access.

[0091] Specifically: through the implementation of load monitoring, the system can automatically expand under high load, and the performance and reliability of the system are improved, and the security communication management ensures that the addition of the new node will not bring security risks, so as to protect the confidentiality and integrity of the data, and through the combination of dynamic expansion and security communication, the system has flexibility and security when facing load changes, which not only improves the response ability of the system under high concurrency, but also protects the privacy and security of the user data, and provides a more stable and secure distributed storage environment for the user.

[0092] In a preferred embodiment of the application, the secret data distributor comprises:

[0093] A module for generating and distributing unique shares, ensuring that each storage node only stores specific shares;

[0094] An authorization management module for dynamically updating and managing the authorized access subset of the storage node of the user, ensuring the security and flexibility of the system when the user changes;

[0095] An automatic expansion module can automatically expand new storage nodes and assign corresponding shares to them to maintain efficient operation of the system when the number of users exceeds the maximum carrying capacity of the current storage nodes;

[0096] Specifically: first, the module for generating and distributing unique shares is responsible for creating unique shares that need to satisfy the pairwise coprime condition. After generation, the distributor assigns these shares to n storage nodes, ensuring that each node only stores a specific share to reduce the risk of data leakage. Second, the permission management module is an important part of the system, responsible for dynamically managing authorized access of users to storage nodes. Through the permission management module, the system can adjust the access permissions of storage nodes in real time according to user changes, ensuring that only authorized users can access the corresponding secret data. Finally, the automatic expansion module plays a key role when the system load is too high. When the number of users exceeds the maximum carrying capacity of the current storage nodes, this module can automatically expand new storage nodes and assign corresponding shares to them. This process ensures that the system can always maintain efficient operation, avoiding performance degradation due to insufficient nodes.

[0097] The application also provides a high-efficiency distributed secret sharing storage medium, comprising:

[0098] A plurality of storage nodes, each node is used for storing the shares uploaded by the distributor, and has a data integrity check function to prevent data tampering;

[0099] A permission management module for controlling access permissions of users to each storage node and implementing dynamic updates to adapt to user changes;

[0100] An auxiliary parameter storage unit for storing calculated auxiliary secret recovery parameters to facilitate user invocation during the recovery process;

[0101] A load monitoring module for real-time monitoring of the load of each storage node and triggering a dynamic expansion mechanism to increase new storage nodes to maintain efficient storage and access performance when the load exceeds a set threshold.

[0102] Specifically: the permission management module dynamically manages user access permissions and uses access control algorithms to update in real time according to user roles, ensuring that the system adapts to user changes. At the same time, the auxiliary parameter storage unit stores auxiliary parameters in the secret recovery process to improve data recovery efficiency. In addition, the load monitoring module tracks node load in real time and automatically triggers a dynamic expansion mechanism to increase new nodes to maintain efficient performance.

[0103] While embodiments of the application have been shown and described, it is to be understood that the embodiments described are merely exemplary of the principles and application of the present application. Numerous modifications and adaptions can be effected without departing from the spirit and scope of the present application, which is not limited to the exact construction and arrangement described. It is intended, therefore, to cover all modifications and adaptions that fall within the scope of the claims and their equivalents.

Claims

1. A method for efficient storage of distributed secret sharing, characterized by, The initialization of the share allocation of the storage nodes comprises: The distributor randomly selects n coprime shares; The shares are uploaded to n storage nodes, ensuring that each storage node stores a unique share, and that a share of one storage node can correspond to multiple secret data, and one secret data can correspond to multiple shares of storage nodes; The distributor determines the number of users of the security service and determines the respective authorized access subsets of the storage nodes for each user to obtain the shares, ensuring that no user has access to all shares of another user, and ensuring the security of the scheme; A linear secret sharing equation with an auxiliary secret recovery parameter is constructed for the secret data and the shares distributed to each user; The auxiliary secret recovery parameter is solved by the extended Euclidean algorithm and publicly allowed to be accessed by all users; The user downloads the shares in the specified storage nodes through the authorized access subset and recovers the secret by combining the public auxiliary secret recovery parameter; When the number of users exceeds the maximum number of users that can be accommodated in the current storage nodes, the distributor expands new storage nodes and allocates a share to each new storage node, and determines the respective authorized access subsets of the storage nodes for the new users; The construction of the linear secret sharing equation comprises: A corresponding linear secret sharing equation is constructed for the secret data of each user; The shares in the authorized access subset of the user are used as the coefficients of the linear secret sharing equation; The recovery of the secret data by the user according to the authorized access of the storage nodes comprises: Downloading the shares in the specified storage nodes; Combining the public auxiliary secret recovery parameter to construct a linear secret sharing equation to recover the secret data.

2. The method of claim 1, wherein, The determination of the authorized access subset of the storage nodes for the user comprises: Supporting the determination of the authorized access subset for each user by using the Sperner theorem to achieve efficient storage; Efficient use of shares in the storage nodes, i.e., one share can participate in multiple secret recoveries while maintaining security.

3. The method of claim 1, wherein, The dynamic expansion of the storage nodes further comprises: Implementing load monitoring to monitor the load of the existing storage nodes in real time to determine when to dynamically expand; During the expansion process, maintaining secure communication between the new storage nodes and the existing storage nodes to ensure the security of data sharing.

4. A high-efficient storage distributed secret sharing system of the method according to any one of claims 1-3, characterized in that, Comprise: A secret data distributor for allocating storage node shares; n storage nodes for storing the shares uploaded by the distributor; m users download shares to recover their respective secret data according to their authorized access to the storage nodes.

5. The high efficient storage distributed secret sharing system according to claim 4, wherein, The secret data distributor comprises: A module for generating and allocating unique shares, ensuring that each storage node only stores a specific share; An authorization management module for dynamically updating and managing the authorized access subsets of the storage nodes for the users, ensuring the security and flexibility of the system when the number of users changes; An automatic expansion module that can automatically expand new storage nodes and allocate corresponding shares to them when it is detected that the number of users exceeds the maximum carrying capacity of the current storage nodes, to maintain the efficient operation of the system.

6. A distributed secret sharing storage medium for efficient storage of a method according to any one of claims 1-3, characterized by Comprise: A plurality of storage nodes, each for storing shares uploaded by the distributor, and having a data integrity verification function to prevent data tampering; An authorization management module for controlling the access rights of users to the storage nodes and enabling dynamic updates to adapt to changes in users; An auxiliary parameter storage unit is configured to store the calculated auxiliary secret recovery parameter, so as to be called by the user in the recovery process. A load monitoring module is configured to monitor the load of each storage node in real time, and trigger a dynamic expansion mechanism to increase a new storage node when the load exceeds a set threshold, so as to maintain efficient storage and access performance.

Images