Secure database storage system based on secret sharing
By using a secure database storage system based on secret sharing, and leveraging the Shamir threshold secret sharing algorithm and dynamic update mechanism, data is partitioned and stored in multiple databases, solving the security deficiencies of traditional database storage systems and achieving high security, flexibility, and fault tolerance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI YINAN TECHNOLOGY CO LTD
- Filing Date
- 2026-03-11
- Publication Date
- 2026-06-12
AI Technical Summary
Traditional database storage systems are not secure enough against advanced persistent threats, malicious insider attacks, and potential risks from third-party service providers, and cannot effectively protect data integrity and privacy.
A secure database storage system based on secret sharing is adopted. The Shamir threshold secret sharing algorithm is used to divide the data into multiple parts and store them in different databases. Data security and access control are ensured through partitioning scheme encoding and dynamic update rotation mechanism.
Significantly improves data security and reliability, enhances access control, improves system fault tolerance and flexibility, prevents data tampering, and adapts to changes in different security requirements.
Smart Images
Figure CN122197066A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of secure storage technology and relates to a secure database storage system based on secret sharing. Background Technology
[0002] Secret sharing is a cryptographic technique that allows a secret to be divided into multiple parts, called shares. The original secret can only be recovered when a certain number of shares are combined. This property ensures that even if some shares are lost or leaked, the security of the entire system is not affected, because the secret cannot be reconstructed without sufficient shares.
[0003] With the rapid development of information technology, data, as a core asset of modern enterprises and organizations, has become increasingly important in terms of security and privacy protection. Traditional database storage systems typically rely on a single copy of data or redundant backups to ensure data availability and integrity, but this model is particularly vulnerable to advanced persistent threats (APTs), insider malicious activities, and potential risks from third-party service providers.
[0004] Therefore, how to provide a secure database storage system based on secret sharing with high security is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention
[0005] In view of this, the present invention proposes a secure database storage system based on secret sharing, which uses a segmentation scheme to encrypt plaintext data and verify user permissions, and combines a dynamic update and rotation mechanism to solve the low security problem of traditional data storage.
[0006] To achieve the above objectives, the present invention adopts the following technical solution:
[0007] This invention discloses a secure database storage system based on secret sharing, comprising: a client and a server; The client includes: The encryption module is used to encrypt the plaintext to be stored according to the initial segmentation scheme, obtain encrypted data, and send it to the server. The request sending module is used to send the current segmentation scheme encoding as a signature of the target operation behavior instruction to the server. The server includes: The Shamir secret sharing module receives the encrypted data and performs N parallel segmentations on the encrypted data using the Shamir threshold secret sharing algorithm to obtain N sets of secret segmentation schemes, where N > 1; different sets of secret segmentation schemes include different numbers of M. i share,i ∈[1,N]; The storage module is used to store the corresponding shares in N secret partitioning schemes into different databases, assign partitioning scheme codes to each secret partitioning scheme, establish the association between partitioning scheme codes and corresponding share storage addresses, and initialize the current partitioning scheme identifier. The permission verification module is used to match and verify the signature sent by the request sending module with the segmentation scheme identifier. If the verification is successful, an execution instruction is sent to the operation execution module. The operation execution module is used to parse the target operation instruction, perform corresponding operations on the data stored in the storage module, and feed back the execution result to the client.
[0008] Preferably, the target operation behavior instruction includes a data acquisition request instruction; The operation execution module parses the signature corresponding to the data acquisition request instruction, queries the storage module for a secret partitioning scheme that matches the signature, obtains the share storage address, and extracts the secret based on the Shamir threshold secret sharing algorithm corresponding to the secret partitioning scheme. k Each share is returned to the client. k <M i .
[0009] Preferably, the client further includes a decryption module, used to encode the data returned by the server according to the current segmentation scheme. k Each share is decrypted to obtain the plaintext.
[0010] Preferably, the target operation behavior instruction includes a segmentation scheme encoding reallocation instruction; The operation execution module parses the signature corresponding to the data acquisition request instruction, determines a new segmentation scheme based on the signature according to a preset replacement rule, updates its corresponding segmentation scheme code to the current segmentation scheme code, assigns it a current segmentation scheme identifier, and returns the current segmentation scheme code to the client.
[0011] Preferably, the preset replacement rules in the operation execution module include: If a partition scheme code reallocation instruction has been received, the association between the partition scheme code and the corresponding share storage address is periodically reallocated to determine the new partition scheme code corresponding to the current partition scheme, assign it a current partition scheme identifier, and return the current partition scheme code to the client. If the instruction has been received, a partition scheme code is randomly selected from the remaining partition scheme codes, assigned a current partition scheme identifier, and returned to the client.
[0012] Preferably, the storage module stores M in the secret partitioning scheme. i Each share is stored in M. i A database.
[0013] Preferably, the step of the Shamir secret sharing module performing N parallel segmentations of the encrypted data using the Shamir threshold secret sharing algorithm includes: Create an independent random polynomial for each segmentation, and ensure that the constant terms of these polynomials are the encrypted data.
[0014] In the formula, S To encrypt data, ( ) is the first i The coefficients are randomly selected in each partition. Both are in finite fields GF ( p Random values on ) where p It is greater than S and prime numbers, i It is the index of the number of splits, ranging from 1 to N; For each polynomial Calculate M i points ( , As a share, each share is assigned an identifier indicating the partitioning scheme to which it belongs, denoted as ( i , , ).
[0015] Preferably, the client further includes a decryption module for decrypting the data returned by the server. k Each share is reconstructed using Lagrange interpolation to reconstruct its corresponding polynomial. Thus obtain = S Encrypt the data according to the current segmentation scheme. S Decryption is performed to obtain the plaintext.
[0016] Preferably, the request sending module is further configured to send a storage request instruction to the server; and receive the initial segmentation scheme code returned by the server; the storage module is further configured to pre-store the initial segmentation scheme code.
[0017] Preferably, the encryption module uses an initial segmentation scheme for encoding. C 0, combined with a randomly generated initialization vector as a key, the plaintext is processed using AES.P Encryption is performed to obtain encrypted data S( C 0, P ).
[0018] This invention proposes a secure database storage system based on secret sharing. By combining techniques such as partitioning scheme encoding, the Shamir threshold secret sharing algorithm, and a dynamic update rotation mechanism, it significantly improves the security, reliability, and flexibility of data storage. The main technical effects of this solution are as follows: 1. Significantly improve data security By employing the Shamir threshold secret-sharing algorithm to segment plaintext data and distributing different amounts of these shares across multiple databases, attackers are ensured that even if some databases are compromised or certain shares are leaked, they cannot reconstruct the original data. The original secret can only be recovered when a preset threshold value k is reached.
[0019] The dynamic update and rotation mechanism enables the periodic redistribution of the segmentation scheme code and the corresponding share storage address, increasing the difficulty for attackers to crack it and effectively resisting long-term attacks and internal threats.
[0020] Because a strict association is established between the segmentation scheme code and the share storage address, any tampering with the code or share will result in verification failure, thus preventing malicious tampering.
[0021] 2. Enhance user permission verification By encoding the segmentation scheme as a signature for the target operation instruction, the system can accurately verify user permissions, ensuring that only authorized users can perform specific operations. This mechanism not only improves system security but also simplifies the permission management process.
[0022] The system supports dynamically changing the segmentation scheme encoding according to preset rules. Administrators can flexibly adjust user access permissions as needed to ensure that sensitive data is always in a secure state.
[0023] 3. Improve system reliability and fault tolerance By distributing the data across multiple databases, the system achieves greater redundancy and fault tolerance. Even if some databases fail or are attacked, the system can still function normally and recover data as long as the remaining databases remain intact.
[0024] 4. Improved system flexibility and scalability: The system supports redistribution instructions for the segmentation scheme encoding, and can flexibly adjust the secret sharing strategy as needed, including parameters such as the number of shares and threshold values, to adapt to different security requirements.
[0025] The number of database nodes participating in secret sharing can be easily increased or decreased according to business growth or changes, without changing the overall system architecture or affecting existing services. Attached Figure Description
[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort. Figure 1 An organizational chart of a secure database storage system based on secret sharing, provided in an embodiment of the present invention; Figure 2 This is a flowchart illustrating how a client sends plaintext to be stored to a server, as provided in an embodiment of the present invention. Figure 3 This is a flowchart illustrating the server-side execution operation provided in an embodiment of the present invention. Detailed Implementation
[0027] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0028] like Figure 1 As shown, this embodiment of the invention provides a secure database storage system based on secret sharing, including: a client and a server; The client includes: an encryption module, used to encrypt the plaintext to be stored according to the initial segmentation scheme encoding, obtain encrypted data and send it to the server; and a request sending module, used to send the current segmentation scheme encoding as a signature of the target operation action instruction to the server. The server-side includes: a Shamir secret sharing module, used to receive encrypted data and perform N parallel segmentations on the encrypted data using the Shamir threshold secret sharing algorithm, obtaining N sets of secret segmentation schemes, where N > 1; different sets of secret segmentation schemes include different numbers of M... i share, i∈[1,N]; Storage module, used to store the corresponding shares in N secret partitioning schemes into different databases, assign partitioning scheme codes to each secret partitioning scheme, establish the association between partitioning scheme codes and corresponding share storage addresses, and initialize the current partitioning scheme identifier; Permission verification module, used to match and verify the signature sent by the request sending module with the current partitioning scheme identifier, and send an execution instruction to the operation behavior execution module if the verification is successful; Operation behavior execution module, used to parse the target operation behavior instruction and perform corresponding operations on the data stored in the storage module, and return the execution result to the client.
[0029] The execution of this embodiment mainly includes the following stages: Phase 1: Initial Setup Phase Client: The client generates the initial segmentation scheme code. C 0.
[0030] use C 0 pairs of plaintext data P Encryption is performed to obtain encrypted data S.
[0031] Encode the encrypted data S and the current segmentation scheme. C 0 is sent to the server.
[0032] Server-side: Receive encrypted data from the client. S and initial segmentation scheme encoding C 0.
[0033] storage C 0 is used as the initial segmentation scheme identifier and is associated with the corresponding encrypted data. S Connect them.
[0034] Pre-deposit C 0 for later use.
[0035] Phase Two: Data Storage Phase Server-side: The Shamir threshold secret sharing algorithm is used to encrypt data. S Perform N partitioning operations in parallel to obtain N secret partitioning schemes, each containing a different number of M partitions. i . share.
[0036] The shares in the N secret partitioning schemes are stored in different databases, and each secret partitioning scheme is assigned a partitioning scheme code, establishing a relationship between the code and the share storage address.
[0037] Phase 3: User Request Processing Phase Scenario 1: Client: When a user needs to perform certain operations (such as data retrieval), the client sends the current segmentation scheme encoding C as part of the target operation instruction to the server. For the first data retrieval, the initial segmentation scheme encoding... C 0 represents the current segmentation scheme code. C .
[0038] If it is a data retrieval request, the client is prepared to receive the share returned by the server for decryption.
[0039] Server-side: The authorization module receives operation instructions and signatures (i.e., the current segmentation scheme encoding) sent by the client. C ).
[0040] Verify that the signature matches the current segmentation scheme identifier. If the verification passes, the corresponding operation is allowed.
[0041] For data retrieval requests, the operation execution module parses the instructions and queries the secret partitioning scheme that matches the signature, extracts k shares and returns them to the client, ensuring that k shares are used correctly. <Mi。
[0042] Scenario 2: Client: When the segmentation scheme needs to be updated, the client sends a segmentation scheme encoding reallocation instruction to the server.
[0043] Server-side: After receiving the segmentation scheme code reallocation instruction, the operation execution module determines the new segmentation scheme code based on the preset replacement rules.
[0044] Update the segmentation scheme code to the current segmentation scheme code and assign it the current segmentation scheme identifier.
[0045] Return the new current segmentation scheme encoding to the client so that the client can use it in subsequent requests.
[0046] Phase Four: Data Decryption Phase Client: Received the server response k After each share, the corresponding polynomial is reconstructed using Lagrange interpolation to recover the encrypted data. S .
[0047] Encoded according to the current segmentation scheme C Encrypted data S Decryption is performed, and the original plaintext is finally obtained. P .
[0048] Through the above interaction process, the client and server can securely store, manage, and access sensitive data while maintaining efficient data processing capabilities and strong security guarantees.
[0049] In one embodiment, such as Figure 2 As shown, the request sending module is also used to send a storage request instruction to the server; and to receive the initial segmentation scheme code returned by the server; the storage module is also used to pre-store the initial segmentation scheme code.
[0050] In this embodiment, during execution, the storage module constructs an association table to store the association between the segmentation scheme code and the corresponding share storage address. Before use, the association table is first initialized with the segmentation scheme code, which can be located in the first row of the table, with the corresponding share storage address empty. After receiving N sets of secret segmentation schemes, the corresponding share storage addresses are sequentially filled into the association table row by row, and the remaining N-1 segmentation scheme codes are generated sequentially. The association table also stores the identifier of the current segmentation scheme.
[0051] In one embodiment, the target operation behavior instruction includes a data acquisition request instruction; The operation execution module parses the data to obtain the signature corresponding to the request instruction, queries the storage module for the secret partitioning scheme that matches the signature, and obtains the storage address of the share within it, such as... Figure 3 As shown, the secret sharing algorithm based on the corresponding Shamir threshold secret sharing algorithm in the secret partitioning scheme is used to extract... k Each share is returned to the client. k <M i .
[0052] In one embodiment, the client further includes a decryption module for encoding the data returned by the server according to the current segmentation scheme. k Each share is decrypted to obtain the plaintext.
[0053] In one embodiment, the target operation behavior instruction includes a segmentation scheme encoded reallocation instruction; The operation execution module parses the data to obtain the signature corresponding to the request instruction, determines the new segmentation scheme based on the signature according to the preset replacement rules, updates the corresponding segmentation scheme code to the current segmentation scheme code, assigns it the current segmentation scheme identifier, and returns the current segmentation scheme code to the client.
[0054] In one embodiment, the preset replacement rules in the operation behavior execution module include: Determine whether a partition scheme code reallocation instruction has been received. If not, periodically reallocate the association between the partition scheme code and the corresponding share storage address, determine the new partition scheme code corresponding to the current partition scheme, assign it the current partition scheme identifier, and return the current partition scheme code to the client. If yes, randomly select a partition scheme code from the remaining partition scheme codes, assign it the current partition scheme identifier, and return the current partition scheme code to the client.
[0055] In this embodiment, the server sets a set of preset replacement rules to determine when and how to redistribute the segmentation scheme encoding.
[0056] Rule 1: If the system detects that it has not received a partition scheme code reallocation instruction, it will periodically (e.g., once a month) reallocate the association between the partition scheme code and the corresponding share storage address to increase security.
[0057] Rule 2: When a partition scheme code reallocation instruction is received, the server will randomly select one from the remaining available partition scheme codes as the new current partition scheme code.
[0058] After each reassignment, the server updates all relevant records and notifies the client of the latest partitioning scheme encoding.
[0059] This embodiment implements periodic maintenance of the partitioning scheme. The server periodically checks whether the association between the partitioning scheme code and the corresponding share storage address needs to be periodically reallocated. If the condition is met, the partitioning scheme code is reallocated according to preset rules, and the client is notified to update the partitioning scheme code it holds.
[0060] In one embodiment, the storage module will secretly partition M in the scheme. i Each share is stored in M. i In each database, we ensure that each database stores only a portion of the information. Each share has a unique identifier that indicates its partitioning scheme and specific location.
[0061] In this way, even if a database is attacked, attackers cannot obtain enough information to reconstruct the original data unless they can access multiple databases simultaneously and reach a threshold.
[0062] In one embodiment, the step of the Shamir secret sharing module performing N parallel splits of encrypted data using the Shamir threshold secret sharing algorithm includes: Create an independent random polynomial for each partition, and ensure that the constant terms of these polynomials are encrypted data.
[0063] In the formula, S To encrypt data, ( ) is the first i The coefficients are randomly selected in each partition. Both are in finite fields GF ( p Random values on ) where p It is greater than S and prime numbers, i It is the index of the number of splits, ranging from 1 to N; For each polynomial Calculate M i points ( , As a share, each share is assigned an identifier indicating the partitioning scheme to which it belongs, denoted as ( i , , ).
[0064] for N The next partition will yield N×M i Each share can be represented as:
[0065] This means that for each piece of encrypted data, there are N corresponding segmentation schemes. N The shares in each partition scheme come from... N Several different polynomials. It's important to note that although each share is based on the same encrypted data... S However, because of the other coefficients of the polynomial It is randomly selected, so the shares between different divisions are completely independent.
[0066] In one embodiment, the client further includes a decryption module for decrypting the data returned by the server. k Each share is reconstructed using Lagrange interpolation to reconstruct its corresponding polynomial. Thus obtain = S Encrypt the data according to the current segmentation scheme. S Decrypt to obtain the plaintext.
[0067] In one embodiment, the encryption module uses the initial segmentation scheme for encoding. C 0, combined with a randomly generated initialization vector as the key, uses AES to process the plaintext. P Encryption is performed to obtain encrypted data S( C 0, P ).
[0068] It should be noted that the randomly generated initialization vector (IV) is 128 bits (for AES-128), 192 bits (for AES-192), or 256 bits (for AES-256), depending on the length of the chosen AES key. The IV is used to increase encryption security, ensuring that even the same plaintext using the same key will produce different ciphertexts.
[0069] The encryption module encodes the initial segmentation scheme. C The AES key is generated by combining 0 with a randomly generated initialization vector and then using a key derivation function (such as PBKDF2, bcrypt, scrypt, etc.). This process may include hashing, expansion, or mixing operations to ensure the security and uniqueness of the key.
[0070] In summary, the secure database storage system based on secret sharing provided by this invention significantly improves data security, flexibility, availability, and processing efficiency by introducing secret sharing cryptography and optimized system design, making it suitable for various application scenarios with high data security requirements.
[0071] The secure database storage system based on secret sharing provided by the present invention has been described in detail above. Specific examples have been used in this embodiment to illustrate the principle and implementation of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core idea of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation and application scope based on the idea of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.
[0072] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined in these embodiments may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A secure database storage system based on secret sharing, characterized in that, include: Client and server; The client includes: The encryption module is used to encrypt the plaintext to be stored according to the initial segmentation scheme, obtain encrypted data, and send it to the server. The request sending module is used to send the current segmentation scheme encoding as a signature of the target operation behavior instruction to the server. The server includes: The Shamir secret sharing module receives the encrypted data and performs N parallel segmentations on the encrypted data using the Shamir threshold secret sharing algorithm to obtain N sets of secret segmentation schemes, where N > 1; different sets of secret segmentation schemes include different numbers of M. i share, i ∈[1,N]; The storage module is used to store the corresponding shares in N secret partitioning schemes into different databases, assign partitioning scheme codes to each secret partitioning scheme, establish the association between partitioning scheme codes and corresponding share storage addresses, and initialize the current partitioning scheme identifier. The permission verification module is used to match and verify the signature sent by the request sending module with the segmentation scheme identifier. If the verification is successful, an execution instruction is sent to the operation execution module. The operation execution module is used to parse the target operation instruction, perform corresponding operations on the data stored in the storage module, and feed back the execution result to the client.
2. The secure database storage system based on secret sharing according to claim 1, characterized in that, The target operation behavior instruction includes a data acquisition request instruction; The operation execution module parses the signature corresponding to the data acquisition request instruction, queries the storage module for a secret partitioning scheme that matches the signature, obtains the share storage address, and extracts the secret based on the Shamir threshold secret sharing algorithm corresponding to the secret partitioning scheme. k Each share is returned to the client. k <M i .
3. A secure database storage system based on secret sharing according to claim 2, characterized in that, The client also includes a decryption module, used to encode the data returned by the server according to the current segmentation scheme. k Each share is decrypted to obtain the plaintext.
4. A secure database storage system based on secret sharing according to claim 1, characterized in that, The target operation behavior instruction includes a segmentation scheme encoding reallocation instruction; The operation execution module parses the signature corresponding to the data acquisition request instruction, determines a new segmentation scheme based on the signature according to a preset replacement rule, updates its corresponding segmentation scheme code to the current segmentation scheme code, assigns it a current segmentation scheme identifier, and returns the current segmentation scheme code to the client.
5. A secure database storage system based on secret sharing according to claim 4, characterized in that, The preset replacement rules in the operation execution module include: If a partition scheme code reallocation instruction has been received, the association between the partition scheme code and the corresponding share storage address is periodically reallocated to determine the new partition scheme code corresponding to the current partition scheme, assign it a current partition scheme identifier, and return the current partition scheme code to the client. If the instruction has been received, a partition scheme code is randomly selected from the remaining partition scheme codes, assigned a current partition scheme identifier, and returned to the client.
6. A secure database storage system based on secret sharing according to claim 1, characterized in that, The storage module will store M in the secret partitioning scheme. i Each share is stored in M. i A database.
7. A secure database storage system based on secret sharing according to claim 1, characterized in that, The Shamir secret sharing module employs the Shamir threshold secret sharing algorithm to perform N parallel segmentations on the encrypted data, including the following steps: Create an independent random polynomial for each segmentation, and ensure that the constant terms of these polynomials are the encrypted data. In the formula, S To encrypt data, ( ) is the first i The coefficients are randomly selected in each partition. Both are in finite fields GF ( p Random values on ) where p It is greater than S and prime numbers, i It is the index of the number of splits, ranging from 1 to N; For each polynomial Calculate M i points ( , As a share, each share is assigned an identifier indicating the partitioning scheme to which it belongs, denoted as ( i , , ).
8. A secure database storage system based on secret sharing according to claim 6, characterized in that, The client also includes a decryption module for decrypting the data returned by the server. k Each share is reconstructed using Lagrange interpolation to reconstruct its corresponding polynomial. Thus obtain = S ; Encrypted data is encoded according to the current segmentation scheme. S Decryption is performed to obtain the plaintext.
9. A secure database storage system based on secret sharing according to claim 1, characterized in that, The request sending module is also used to send a storage request instruction to the server; and receive the initial segmentation scheme code returned by the server; the storage module is also used to pre-store the initial segmentation scheme code.
10. A secure database storage system based on secret sharing according to claim 1, characterized in that, The encryption module uses an initial segmentation scheme for encoding. C 0, combined with a randomly generated initialization vector as the key, uses AES to process the plaintext. P Encryption is performed to obtain encrypted data S( C 0, P ).